Privacy Policy

1. Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how Kritmatta, including our AI Agent Builder platform and our assistant Ask Kritmatta (in the Kritmatta app and in Microsoft Teams), connects to, uses, and protects data from third-party integrations, including Google Workspace and Microsoft 365.

2. Google OAuth Scopes & Justification

To automate your hiring, outreach, and scheduling workflows, our platform requests access to certain Google APIs. Below is a detailed breakdown of the exact scopes we request, why they are required, and how they are used:

3. Ask Kritmatta, Microsoft 365, Microsoft Teams and Slack

Ask Kritmatta is Kritmatta's assistant. You can use it in the Kritmatta app, in Microsoft Teams (the Ask Kritmatta app) and in Slack (the Kritmatta app).

• Connecting Microsoft 365. When you connect your Microsoft 365 account in Kritmatta, you choose the level of access and approve the Microsoft Graph permissions on Microsoft's own consent screen. We use that access only to carry out your requests and the tasks of agents you set up, for example reading your calendar or email when you ask, and acting on your behalf only where you have granted write access.
• Messages in Teams. When you message Ask Kritmatta in Teams, Microsoft sends us your message, your Microsoft account and organisation identifiers, and the conversation details needed to reply. We use your connected Microsoft 365 account to confirm the message is from you before answering, and Ask Kritmatta answers using only your own Kritmatta account and connections.
• Channels and group chats. Ask Kritmatta only reads channel and group chat messages that @mention it. Its reply in a channel or group chat is visible to everyone in that conversation.
• What we keep. Your Teams questions and Ask Kritmatta's answers are saved in your Ask Kritmatta conversation in Kritmatta, so you can see them in the app. You can clear that conversation in Kritmatta. Disconnecting Microsoft 365 deletes the access tokens we hold for it.
• Slack. The Kritmatta app for Slack works the same way: Slack sends us your message and your Slack user and workspace identifiers. We link your Slack account to your Kritmatta account only after you confirm it while signed in to Kritmatta, using the same email address.
• What we do not do. We do not sell your Microsoft or Slack data or use it for advertising.

4. Data Retention and Deletion

You can disconnect integrated accounts in Workspace Settings, or manage ChatGPT access at Kritmatta in ChatGPT. Disconnecting prevents future use of that connection. It does not undo work already submitted to a provider, cancel queued jobs, or delete prospects, organisation knowledge, campaigns or agents you created. Security records and safeguards against duplicate work may remain as described below.

ChatGPT plugin data

When you use the Kritmatta plugin, we receive the task-specific instructions, selected contact rows, URLs, findings and conversation text or summaries you choose to send. We do not automatically retrieve your ChatGPT conversation history. We use this material to prepare agent briefs, import and enrich leads, prepare campaign drafts, provide your owned-agent results and save selected content into organisation knowledge. Knowledge imports require owner/admin access and your chosen organisation-wide or founders-only visibility. Requested results are returned to OpenAI for presentation in ChatGPT. Existing connected enrichment providers and AI processors receive the data needed for the requested service under your workspace permissions and limits.

ChatGPT OAuth credentials are stored as one-way hashes. Authorization codes and consent challenges expire after five minutes, access tokens after one hour, and refresh grants after 30 days. Consumed refresh hashes help detect credential replay. We retain minimal operational references and rate-limit information to protect account access and prevent duplicate work; logs must not include raw credentials or private contact lists.

Private plugin intake briefs expire after seven days. Saved plugin response bodies are removed after 30 days. Scheduled cleanup runs hourly, so deletion occurs on the next successful cleanup after these periods. Disconnecting clears active credential hashes and requests immediate removal of private intake briefs and response bodies; scheduled cleanup retries that removal if needed. Minimal grant and duplicate-request records, including records of uncertain work, remain until 90 days after revocation or refresh-grant expiry. They are not replayed automatically. Native job results, approval records, imported prospects, saved organisation knowledge, campaigns and agents follow the workspace's normal controls and are not removed by disconnecting the plugin. Contact support to request deletion of workspace artifacts or assistance with an uncertain action.

5. Information Security

Reusable provider credentials are protected with encryption at rest. ChatGPT plugin credentials are stored as one-way hashes rather than recoverable tokens. We restrict access to credential stores. Public API calls use HTTPS.

6. Contact Us

If you have any questions about this Privacy Policy, the scope justifications, or our data handling practices, please contact us at support@kritmatta.com.