LEGAL & TRUST
United States State Privacy Notice
KRAVIA provides a common privacy baseline and additional U.S. state rights where the relevant law applies. We do not sell private personal information or share it for cross-context behavioural advertising. Applicability, data categories and historical disclosures must be assessed for the actual service, not inferred from global availability alone.
1
Scope and applicability
This Notice supplements the Global Privacy Policy for relevant U.S. residents and processing. State laws differ in thresholds, definitions, exceptions, coverage of employment or business contacts, sensitive-data rules and effective dates. The corporate framework does not assert that KRAVIA is a covered business under every state law.
Where a statutory provision does not apply, KRAVIA's adopted global choices may still provide a practical request route. Mandatory rights under an applicable state law are not reduced by a narrower corporate contractual term. A product involving children, health, biometrics, education, employment or consumer reporting requires an additional assessment before launch.
2
Categories, sources and purposes
The following describes corporate processing categories associated with relevant functions. It is not an unverified statement about all information collected during a historical reporting period.
The collection-point notice and actual data inventory identify applicable categories, purposes and retention. A historical category-and-disclosure schedule required by law must be populated from actual records before publication; blank information must not be converted to “not collected.”
| Category | Corporate examples and purpose | Relevant sources and recipient types |
|---|---|---|
| Identifiers and contact information | Name, email, phone and account references for accounts, enquiries and requests | Individual or authorized organization; necessary account, communication and support providers |
| Commercial and billing records | Service interest, orders, invoices and transaction status for fulfilment and reconciliation | Individual, customer organization or payment provider; relevant payment, accounting and service providers |
| Internet or electronic activity | Necessary session, request, security and limited permitted analytics records | Device and service interactions; relevant infrastructure, security or analytics providers |
| Professional or business information | Company name, role if supplied, business requirements and enquiry files | Individual or organization; authorized staff and necessary service providers |
| Correspondence and submitted content | Support messages, deliberately supplied files and optional assistant interactions | Individual, authorized customer or integration; approved support, storage and AI providers as relevant |
| Limited derived information | Disclosed service-relevant classifications or security-risk indicators | Relevant authorized interactions; necessary internal and provider functions |
3
Sensitive information
Ordinary corporate registration does not require biometric identifiers, precise GPS history, health records, government identity numbers or complete payment credentials. Users should not submit them unnecessarily. Authentication information and other records can nevertheless be sensitive under a particular state definition and require appropriate handling.
A specialized product that needs sensitive data must identify the specific category, purpose, consent or other lawful authorization, retention, recipients and available controls. We do not use sensitive information for undisclosed advertising inferences. Where the law requires an opt-in, a right to limit use, or withdrawal, the product implements that requirement rather than relying on a general Terms checkbox.
5
Rights and requests
Where applicable, you may request confirmation or access, correction, deletion and a portable copy of eligible personal information, and opt out of regulated sale, targeted advertising or certain profiling. Some laws provide additional sensitive-information controls or protections concerning significant automated decisions. These rights have jurisdiction-specific conditions and exceptions.
Use the public Privacy Request Form or privacy@kraviaprivatelimited.com. Provide the product and enough information to locate the relevant records. We verify sensitive requests proportionately and permit authorized agents where required, but do not impose unnecessary verification for opt-outs or browser signals. An agent may need to demonstrate authority without requiring the user to create a new account.
6
Signals, preferences and nondiscrimination
Recognized legally applicable universal opt-out signals, including Global Privacy Control where relevant, are honored according to their required effect. We do not interpret a signal as a request to delete an account or prevent a requested necessary function. The no-sale and no-behavioural-advertising commitments apply whether or not a signal is enabled.
We do not unlawfully discriminate against someone for exercising a privacy right. Optional processing is not forced through a higher privacy price. Any future legally regulated financial-incentive program would require its own prior notice and assessment; this Notice does not establish such a program.
7
Response and appeal
KRAVIA targets acknowledgement within 48 hours and a substantive response within 30 days, subject to the applicable statutory clock and lawful extension rules. We explain material limitations or refusals and provide a statutory appeal route where applicable. To appeal, contact legal@kraviaprivatelimited.com and identify the privacy decision to be reviewed; no lawyer is required.
The appeal is reviewed under the relevant state requirements. The response explains the outcome and applicable external complaint route, including the relevant attorney general or regulator when required. We do not assume all states have the same response or appeal period.
8
Automated decision-making and high-impact products
The corporate assistant is not intended to make significant employment, credit, healthcare or legal decisions. A product using consequential scoring, ranking or eligibility systems must separately assess notices, assessments, opt-outs, access and review rights as applicable. A generic human-in-the-loop label does not establish compliance.
California's updated regulations have separate effective and compliance provisions for different requirements. KRAVIA must not infer that every audit or automated-decision obligation began on the same date. The internal legal register controls review of applicability and transition dates before deploying such functionality.
9
Retention, recipients and contact
The Retention Policy explains corporate periods and necessary exceptions, while the provider register identifies actual recipients and roles. Customer-controlled processing is governed by the relevant product notice and DPA, including applicable service-provider or contractor restrictions.
Contact privacy@kraviaprivatelimited.com or write to the Privacy Function at KRAVIA's registered office. We do not publish an unverified U.S. office, representative or registered copyright agent as if it exists. This Notice is supplemented when a product's actual U.S. processing requires additional disclosures.