Privacy Policy

Last updated 7 November 2026

1. Who we are

Karobly (karobly.com) is a web application that helps small businesses manage their business details, publish customer-approved content and follow up enquiries. It is operated by Nikhil Shinde. Questions or requests about your data: [email protected].

2. Information we collect

  • Account information: your name, email address, password (stored only as a one-way hash) and, if you use “Continue with Google”, your Google account name, email address and profile picture.
  • Business information you enter: business profile, products, offers, goals, competitors, enquiries, customer contact details you add for follow-ups, quotes, invoices and uploaded images.
  • Connected account data: only for accounts you choose to connect (see sections 4 and 5).
  • Technical information: a session cookie that keeps you signed in, IP address and request logs used for security, rate limiting and troubleshooting.
  • Payment information: if paid plans are enabled, payments are processed by Razorpay. We receive the payment status and reference, not your full card details.

3. How we use information

  • To provide the features you request: show your dashboard, prepare suggested content, and publish content you have approved.
  • To generate AI-assisted suggestions. Relevant business details and prompts are sent to our AI provider (OpenAI) for this purpose only.
  • To send account emails such as verification, password reset and reminders you enable (sent through Brevo).
  • To keep the service secure, prevent abuse, and provide support.

4. Google user data

If you connect a Google account, you choose which services to grant. Depending on your choice we access:

  • Google Search Console (read-only): search performance for websites you select, to show traffic and recommendations.
  • Google Analytics (read-only): visitor and traffic reports for properties you select.
  • Google Business Profile: your business locations, reviews and posts, so you can read reviews, approve replies and approve posts. We only publish a reply or post after you approve it.
  • Google Ads: account and campaign information for accounts you select, for reporting and planning.

We use Google user data only to provide these user-facing features. We do not sell it, do not use it for advertising, and do not use it to train generalized AI or machine-learning models. Karobly’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. People do not read this data except with your permission for support, when needed for security, or when required by law.

5. Facebook and Instagram data

If you connect Facebook, we access the list of Pages you manage, their linked Instagram professional accounts, and basic Page engagement, and we publish posts to the Page or Instagram account you select — only after you approve each post. We use this data only to provide these features and do not sell it.

6. Sharing

We share information only with service providers that help us run the service, and only as needed:

  • Cloudflare (secure network delivery), OpenAI (AI suggestions), Brevo (email), Razorpay (payments, if enabled).
  • Google and Meta, when you ask us to publish approved content or read your connected accounts.
  • Authorities, when required by law.

We do not sell personal information.

7. Storage and security

Data is stored in our database on servers we control. Access tokens for connected Google and Meta accounts are encrypted (AES-256). Connections use HTTPS. Access to production systems is limited to the operator. No system is perfectly secure; please report suspected unauthorized access to [email protected].

8. Retention and deletion

We keep your information while your account is active. You can disconnect a Google or Facebook account at any time in Integrations, which stops further access; you can also remove our access from your Google account (myaccount.google.com/permissions) or Facebook settings. To delete your account and its data, email [email protected]; we delete it within 30 days, except records we must keep by law. Backups are overwritten within about 14 days. Content already published to Google, Facebook or Instagram stays there until you remove it on that service.

9. Your choices and rights

You can view and update your details in the app, ask for a copy of your data, correct it, or ask us to delete it by emailing [email protected]. You may also have rights under the laws where you live, including India’s Digital Personal Data Protection Act, 2023.

10. Children

The service is for businesses and is not intended for anyone under 18.

11. Changes

We will update this page when our practices change and show the date of the latest version. Material changes will be notified in the app or by email.

See also our Terms & Conditions, Pricing, Refund policy and Contact.