Privacy Policy

This Privacy Policy applies to personal data that we process in connection with the Services.

Depending on the context, we may process personal data in different roles:

• When you visit our website, use the discovery experience, create an account, communicate with us, or purchase the Services, Varunastra generally determines why and how your personal data is processed. Under Indian law, we act as the Data Fiduciary for this data. Similar terms used in other jurisdictions include “controller” or “business”.
• When a customer connects its business systems or submits data to Kordn, the customer generally determines why and how that data is processed. For personal data contained in that customer data, we ordinarily act on the customer’s instructions as a Data Processor or “processor/service provider”. The customer’s privacy policy and agreement with us govern that processing.
• If your employer or another organisation provides your Kordn account, that organisation may administer your account, control your access, and receive information about your use of the Services.

This Privacy Policy does not govern the independent privacy practices of third-party services that you choose to connect to Kordn.

The data we collect depends on how you use the Services and which systems you connect.

We may use personal data to:

• provide, operate, maintain, and improve the Services;
• create and administer accounts, workspaces, teams, roles, and permissions;
• conduct the discovery experience and generate product, workflow, or configuration recommendations;
• connect, synchronise, organise, analyse, and reconcile information across authorised third-party services;
• generate alerts, summaries, drafts, insights, forecasts, and recommended actions;
• carry out actions that an authorised user approves or configures;
• personalise the Services and remember user preferences;
• process subscriptions, billing, payments, and taxes;
• provide customer support and respond to enquiries;
• monitor performance, troubleshoot errors, and develop new features;
• detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms;
• maintain audit trails and protect the rights, safety, and property of our customers, users, Varunastra, and others;
• send service-related communications and, where permitted, marketing communications;
• comply with legal obligations, enforce agreements, and respond to lawful requests; and
• create aggregated or de-identified information that does not reasonably identify an individual.

We will not use personal data for a new, incompatible purpose without providing appropriate notice and, where required, obtaining consent.

Where applicable law requires a legal ground, we process personal data based on one or more of the following:

• your consent;
• the performance of a contract with you or steps requested by you before entering into a contract;
• compliance with a legal obligation;
• our legitimate interests or those of another person, where permitted and not overridden by your rights; or
• another lawful ground recognised under applicable law.

Under India’s Digital Personal Data Protection Act, 2023, where applicable and in force, we process digital personal data on the basis of consent or for certain legitimate uses permitted by law. You may withdraw consent using the method described in Section 11, although withdrawal does not affect processing already carried out lawfully.

Some parts of the Services use artificial intelligence and automated systems. To provide these features, relevant prompts, files, connected-service data, instructions, and contextual information may be processed by Varunastra and contracted AI or infrastructure providers.

AI-generated outputs may be incomplete, inaccurate, or unsuitable for a particular purpose. You are responsible for reviewing outputs and proposed actions before relying on them. Kordn is designed to keep authorised users in control of actions that can affect connected systems.

We do not permit third-party AI providers to use Customer Data submitted through Kordn to train their general-purpose models unless the relevant customer has expressly authorised that use or we have clearly disclosed it and have a lawful basis to do so.

We may disclose personal data to:

• service providers and processors that support cloud hosting, data storage, AI functionality, authentication, security, analytics, communications, customer support, billing, and other business operations;
• connected third-party services when you or your organisation directs us to connect, retrieve, synchronise, or send data;
• your organisation and its administrators, including authorised workspace owners, managers, and team members, according to configured roles and permissions;
• professional advisers, such as lawyers, auditors, insurers, accountants, and consultants, where reasonably necessary;
• law-enforcement authorities, regulators, courts, and other parties when required by law or reasonably necessary to protect rights, security, safety, or prevent harm; and
• parties involved in a corporate transaction, such as a merger, financing, acquisition, restructuring, insolvency, or sale of all or part of our business, subject to appropriate confidentiality protections.

We may disclose aggregated or de-identified information that does not reasonably identify an individual.

We do not sell personal data for money. We do not share personal data for cross-context behavioural advertising.

The Services may allow you to connect third-party platforms or may contain links to third-party websites. When you enable a connection, data may flow between Kordn and that third party according to the permissions you approve and the instructions you provide.

Third-party services independently determine how they process data in their own environments. Their privacy policies, security practices, and terms apply to their processing. You can usually review or revoke a connection through Kordn or the relevant third-party service.

We may use cookies, local storage, pixels, software development kits, and similar technologies to:

• keep you signed in and provide essential functionality;
• remember preferences and settings;
• protect accounts and prevent abuse;
• understand how the Services are used and improve performance; and
• measure communications or marketing where permitted.

Where required by law, we will request consent before using non-essential cookies. You can manage cookies through our cookie controls, where available, or through your browser settings. Blocking some cookies may affect how the Services function.

Varunastra is based in India, and our service providers or connected third-party services may process data in India and other countries. These countries may have privacy laws that differ from those where you live.

Where required, we use appropriate contractual, organisational, and technical safeguards for international transfers. Transfers from India will be subject to restrictions or requirements issued by the Government of India and other applicable law.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal and contractual obligations, resolve disputes, enforce agreements, maintain security, and prevent fraud or abuse.

Retention periods depend on the type of data and context. In general:

• account and workspace data is retained while the account or customer relationship remains active and for a limited period afterwards;
• Customer Data is retained according to the relevant customer agreement, configured retention settings, and lawful customer instructions;
• discovery and chat data may be retained to provide the experience, preserve conversation continuity, improve reliability, and maintain security, subject to applicable settings and law;
• billing, transaction, tax, and contractual records may be retained for legally required periods; and
• security, access, and audit logs may be retained for periods required by law or reasonably necessary for security and compliance.

When data is no longer required, we will delete or de-identify it. Residual copies may remain temporarily in backups or archives until they are overwritten or deleted under our retention procedures.

Depending on applicable law and our role in processing your data, you may have the right to:

• obtain information about or access personal data we process about you;
• correct, complete, or update inaccurate personal data;
• request erasure of personal data;
• withdraw consent;
• object to or restrict certain processing;
• request a portable copy of certain data;
• opt out of direct marketing communications;
• nominate another individual to exercise rights on your behalf where Indian law permits; and
• raise a grievance or lodge a complaint with the competent data-protection authority.

To exercise a right, email support@dropchain.in. We may need to verify your identity and authority before completing a request. We will respond within the period required by applicable law.

If we process personal data on behalf of a customer, please direct your request to that customer first. We will assist the customer as required by our agreement and applicable law.

You may unsubscribe from marketing emails using the link in the message. You will continue to receive essential service, security, billing, and account communications.

If your concern is not resolved through our grievance process, you may have the right to complain to the Data Protection Board of India once the relevant provisions apply, or to another competent authority in your jurisdiction.

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures may include access controls, encryption, logging, monitoring, backups, secure development practices, and contractual safeguards with service providers, as appropriate to the risk.

No system is completely secure. You are responsible for maintaining the confidentiality of your credentials, using appropriate access controls, and promptly notifying us if you suspect unauthorised access to your account.

If a personal-data breach occurs, we will take reasonable steps to contain and investigate it and will notify affected individuals, customers, the Data Protection Board of India, or other authorities where and when required by applicable law.

The Services are intended for businesses and are not directed to individuals under 18 years of age. We do not knowingly collect personal data directly from a child for the child’s own use of the Services.

If you believe a child has provided personal data to us without appropriate authorisation, contact us at support@dropchain.in. Where applicable law permits a customer to process children’s data through a connected business system, the customer is responsible for obtaining any required verifiable parental consent and complying with applicable restrictions, and we process that data only on the customer’s documented instructions.

We may update this Privacy Policy from time to time. We will post the updated version on our website and change the “Last updated” date above. If a change materially affects how we process personal data, we will provide additional notice or request consent where required by law.

For questions, privacy requests, or complaints, contact:

We aim to acknowledge and resolve privacy grievances within 30 days, or within another period required by applicable law.