Privacy Policy

Last updated 28 October 2026

Karya Falak is a business name of Achyut Labs Pty Ltd (ABN 19 639 614 332), Melbourne, Australia ("we", "us"). This policy explains how we handle personal information when you use Karya Falak at karyafalak.com and app.karyafalak.com. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Two kinds of people, two roles

Businesses use Karya Falak to talk with their customers. For the people who work in a business’s account (its owners, admins and team members), we decide how their account information is handled.

For the business’s own customers, whose messages, names and numbers arrive through SMS, WhatsApp, email or a web form, we handle that information on behalf of the business and on its instructions. The business is responsible for telling its customers how it uses their information and for having their consent to contact them. If you are one of those customers, please contact the business first; we will help them, and you, where we can.

What we collect

Account details: your name, email address, a hash of your password (never the password itself), and, if you sign in with Google or Apple, the name, email address and account identifier they give us.
Organisation details: the business name, address, tax number, settings, and the people invited to it.
What a business puts into Karya Falak: conversations (SMS, WhatsApp, email and web form messages, with the phone numbers, email addresses and names they carry), files and pictures, contacts, tickets, comments, checklists, quotes, invoices, visits and site addresses.
Billing details: the plan and payment status. Card numbers are handled by Stripe and never reach us.
Technical details: IP address, browser, sign-in times and security events, kept to protect accounts and to show an organisation its audit log.
In the Karya Falak Field phone app: the phone’s name and platform, kept with its sign-in so it can be signed out; and its location, read only while the app is open, to show how far away a job is and, when you tap On my way, I’ve arrived or Finish visit, kept with that visit as a record of attendance. If the business has switched on live On my way links, your location is shared with that customer only while you’re on the way to their job, while the app is open, and it stops when you arrive (or after two hours at most): they see your first name, roughly where you are and about how long you will be, and the position kept for the link is deleted when it ends. There is no tracking in the background and no location outside a visit.

How we use it

To run the service: deliver and receive messages, keep the inbox and boards, send the emails and notifications you ask for.
To keep accounts and data safe, prevent misuse, and investigate problems.
To bill for the service and to give support when you ask.
To meet our legal obligations.

We do not sell personal information, use it for advertising, or use the content of conversations to train AI models.

A business can connect its WhatsApp Business number through Meta’s WhatsApp Business Platform. Messages then travel through Meta, and Meta’s own terms and privacy policy apply to that part. We use WhatsApp data only to show the conversation to that business and to send its replies; we do not use it for any other purpose or share it with anyone else, apart from the service providers below where they are needed to run the service.

Claude, ChatGPT and other AI apps you connect

You can connect Karya Falak to an AI app you use, such as Claude, ChatGPT, Cursor or VS Code, at karyafalak.com/help/claude-and-chatgpt. You sign in, choose one organisation and tick what the app may do: read, change tickets, or send to customers. The app then acts as you, in that organisation, and only as far as your role allows.

What it reads: what you can already see in that organisation (tickets, boards, contacts, conversations with customers, the calendar, quotes and invoices), only when the app asks. It never reads passwords, two-step secrets, card details or other organisations.
What it changes: only what you ticked, through the same rules as the web app. Sending to customers keeps their consent and opt-outs, and every change is recorded in the organisation’s audit log as you, “via” the app.
Where it goes: what the app reads is sent to that app’s provider (for example Anthropic for Claude, OpenAI for ChatGPT), which you chose and whose own terms and privacy policy apply to it. We do not choose, pay or instruct that provider, and we send it nothing you or your app did not ask for. Our part of the connector runs in Sydney, Australia, and stores no copy of what it reads.
What we keep: the connection itself (the app, the organisation, what it may do and when it was last used), and sign-in tokens stored only in a form that cannot be read back, deleted within a day of expiring (within 30 days for a renewal token once used). Drafts the app saves for you are kept for 14 days.
Ending it: disconnect at any time under Account > Connected apps, and it stops at once. Owners and admins can disconnect anyone’s app in their organisation, and an owner can switch connected apps off for the whole organisation. Leaving an organisation or deleting your account disconnects your apps.

Customers’ messages reach a connected app only when someone in the business connects one and asks about them, the same as when that person reads them in Karya Falak. A business that connects an AI app is responsible for using it in line with what it tells its own customers.

Where it is stored

The database and every file live in Sydney, Australia. Some providers above process information in other countries, mainly the United States, to deliver email, WhatsApp messages and payments. We take reasonable steps to make sure they protect it as the Australian Privacy Principles require.

How long we keep it

Message content is kept for 365 days by default. A business can choose between 30 days and 3 years; after that, message text is removed automatically.
Account and organisation information is kept while the account is open. When an account or organisation is closed, we delete its information within 90 days, except records the law requires us to keep (such as tax invoices, kept for 5 years).
Backups are kept for up to 35 days and then overwritten.
A connected AI app’s sign-in tokens are deleted within a day of expiring; the record of the connection stays with the account, so you can see what was connected and when.

How we protect it

Everything travels over HTTPS. Access tokens for connected services are encrypted at rest. Each organisation’s data is separated by the database itself, on every query. Our staff accounts require two-step verification and every staff action is logged. No system is perfectly secure; if a breach is likely to cause serious harm we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Cookies

We use only the cookies Karya Falak needs to work: one that keeps you signed in, and a short-lived one while you sign in with Google or Apple. Your theme choice is kept in your browser. We do not use advertising or analytics cookies.

Your choices

You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it. An organisation can export its contacts and boards at any time. Someone who receives SMS from a business on Karya Falak can reply STOP to stop them.

Deleting your data

If you have a Karya Falak account: delete it yourself, at once, under Account > Delete account, on the web or in the Karya Falak Field app. You are removed from every organisation and signed out everywhere; work you did stays with the organisation, under “Deleted user”. Or email us at admin@karyafalak.com from the address you sign in with and we delete it within 30 days.
If you own an organisation: email us to close it, and we delete its data within 90 days (export it first if you want a copy). To remove one customer, open Contacts, choose the contact, then Erase; their details and message content are removed within minutes.
If you messaged a business that uses Karya Falak (for example on WhatsApp): ask that business to delete your information, or email us with your phone number or email address and the business’s name, and we will work with them to delete it within 30 days.

Children

Karya Falak is a tool for businesses and is not meant for anyone under 16.

Questions and complaints

Email admin@karyafalak.com. We reply within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If we change this policy in a way that matters, we will tell account owners by email before it takes effect. The date at the top shows when it last changed.