Privacy Policy

Zealvert® Consulting | Version 3.21.0 | Effective Date: 31 October 2026 | Last updated: 31 October 2026

Version 3.21.0 (31 October 2026) adds the customer page to Sections 3.4 and 14A. When a business shares the first quotation of a deal, we host a page on kranzar.com for that customer, locked by their mobile number or a PIN, where the customer sees the deal’s quotations, answers them and writes to the business in a chat that both sides keep. For these records the business is the Data Fiduciary and we are its Data Processor, as for every other Kranzar record. It also says in Section 14A what our support backend shows, and that opening it is recorded but not notified. Nothing else changes.

Version 3.20.0 (30 October 2026) adds the Enquiries module to Kranzar, in Sections 3.4, 7, 10, 13 and 14A. An enquiry received through a connected lead source, or through the Kranzar enquiry page, is held first as an enquiry, with the reasons Kranzar found for the business’s attention, and becomes a lead only when a member of the business accepts it, or a setting the admin chose for that source accepts it at once. The admin of a business may also keep a list of blocked senders. A rejected enquiry, and one marked suspicious, is deleted 90 days after it was handled. For these records the business is the Data Fiduciary and we are its Data Processor, as for every other Kranzar record. Nothing is sent to the person who made the enquiry, nothing about an enquiry goes to any artificial intelligence service, and no decision about the person is made by Kranzar: a member of the business decides every enquiry. This version takes effect on 30 October 2026, the day it is published: nothing is held as an enquiry for any business until the module is switched on, which happens only after this version is published.

Version 3.19.1 (26 October 2026) corrects the paragraph Paying for it in Section 14A for Kranzar: every plan - Pro, Business and Enterprise - is bought at once, with a 14-day refund guarantee of the first payment, no questions asked; the free trial is a separate account. Nothing else changes.

Version 3.19.0 (23 October 2026) adds the Kranzar enquiry page to Sections 3.4 and 14A. The admin of a business may switch on a public page on kranzar.com where a buyer can send the business an enquiry; we host the page for the business, and the enquiry becomes one of the business’s leads. For these enquiries the business is the Data Fiduciary and we are its Data Processor, as for every other Kranzar record. The page sets no cookie and counts no visitors. This version takes effect on 23 October 2026, the day it is published: nothing is collected for any business until its admin switches its page on, so nobody relying on the service is affected by it taking effect at once. Nothing else changes.

Version 3.18.0 (23 October 2026) adds connected lead sources to Kranzar, in Sections 3.4, 6, 7 and 14A. The admin of a business may connect the business’s own website form, its IndiaMART seller account or its own email, so that enquiries arriving there become leads in Kranzar without being typed. For these leads the business is the Data Fiduciary and we are its Data Processor, as for every other Kranzar record. Kranzar sends nothing back to the person who made the enquiry, and receiving an enquiry sends nothing to any artificial intelligence service. This version takes effect on 23 October 2026, the day it is published: nothing is received for any business until its admin connects a source, so nobody relying on the service is affected by it taking effect at once. Nothing else changes.

Version 3.17.1 (22 October 2026) corrects one sentence of Section 14A, “Paying for it”: an upgrade to a higher Kranzar plan takes effect at once. No personal data is handled differently.

Version 3.17.0 (22 October 2026) changes Section 14A for Kranzar in two ways. First, it corrects what is sent to our AI provider: since 20 October 2026 no customer name is sent; the name of an account, contact, lead or customer is replaced by a code before a request leaves Kranzar, and put back when the answer arrives. Second, it states how Kranzar is paid for: only the Pro plan has a free trial, and Business and Enterprise are bought at once, with a full refund of the first payment if the business admin asks within 14 days; Bookkeeping is part of the Business and Enterprise plans and not of the trial. Nothing else changes.

Version 3.16.0 (20 October 2026) changes Sections 3.1, 6, 7, 12 and 14A. Zealvert now also counts visits to zealvert.com and to the public pages of kranzar.com with a counter of its own, which sets no cookie, records counts only and identifies nobody. It keeps three dates in the visitor’s own browser storage so that each visitor is counted once a day, once a week and once a month; those dates never leave the browser. Nothing else changes.

Version 3.15.0 (20 October 2026) changes Kranzar in Sections 3.1, 3.4, 6, 7, 12 and 14A. First, Kranzar AI may read a business’s records to answer a question, but only after the business admin has been shown what is sent and has agreed to it in Settings, Business; until then Kranzar AI works from the question alone, as before. Second, the public pages of kranzar.com are counted with Cloudflare Web Analytics, which sets no cookie. This also corrects our earlier statement that Kranzar used no analytics service: from September 2026 Cloudflare’s automatic setup counted visits to the whole of kranzar.com, the signed-in application included, and on 20 October 2026 we limited it to the public pages. Third, the trial form may record how a visitor first reached kranzar.com, to tell us which of our efforts bring businesses to Kranzar. Fourth, we name what Kranzar now holds that this Policy did not yet describe: the trial form, leads, accounts and contacts, quotations shared with a customer and the customer’s answer, messages between team members, a team member’s targets, last activity and favourite pages, and the emails Kranzar sends. Sales insights, removed from Kranzar on 6 October 2026, is no longer described. No new provider receives anything. This version takes effect on 20 October 2026, the day it is published: reading records stays off for every business until its admin agrees, recording where a sign-up came from is a single setting we switch on only once this version is published, and the remaining changes describe what already happens, so nobody relying on the service is affected by it taking effect at once. Nothing else changes.

Version 3.14.0 (18 October 2026) adds Bookkeeping to Kranzar, for the Pro plan and the trial, in Sections 3.4, 7 and 14A. A business that switches it on can record the invoices it issued from its own accounts software, the payments its customers made, advances, refunds and adjustments, and who is following up on each customer and what they promised to pay. Kranzar does not issue invoices, does not move money, and sends nothing to the business’s customers. For these records the business is the Data Fiduciary and we are its Data Processor, as for every other Kranzar record. No new provider receives anything: the records are not given to any AI service, are not sent by email, and stay in the same database as the rest of the business’s records. This version takes effect on 18 October 2026, the day it is published. Bookkeeping is a new feature that is off for every business until its admin chooses to switch it on, and it changes nothing about the data any business already holds with us, so nobody relying on the service is affected by it taking effect at once. Nothing else changes.

Version 3.13.0 (12 October 2026) adds one item to Section 3.4: a photo of a team member, which the business admin may add in Kranzar and which is shown to the team inside that business. Adding one is optional, the admin can remove it at any time, and it is never sent to any AI service. Nothing else changes.

Version 3.12.0 (12 October 2026) adds one Kranzar AI feature in Section 14A: help inside the Support page. When a user describes a problem with Kranzar in their own words and nothing in our written help fits it, the description they typed is sent to OpenAI together with our own help text, so that an answer can be written. No record of your business is sent with it. Nothing else changes.

Version 3.11.0 (25 September 2026, revised 27 September 2026) adds the last three Kranzar AI features in Section 14A: drafting a follow-up message and deals at risk. Both send OpenAI facts about an enquiry - its name, stage, value, how long it has been since it changed, and the dates that stand against it - so that a short message or a short judgement can be written. Neither sends a prospect’s telephone number, email address or postal address, and neither sends comments or attached files. Drafting a follow-up does not send the prospect’s name at all; deals at risk sends it only where an enquiry has no name of its own. Both are off until a business switches them on, and nothing is written to your records by either. It was revised on 27 September 2026 to add a third such feature, Sales insights, which reads a user’s own enquiries, leads and quotations together and says what needs attention. This version takes effect on 27 September 2026 rather than on 1 November as first announced: Kranzar has no subscribers, so there is nobody using it whose data these features could touch, and the 30 days’ notice in Section 17 protects people already relying on the service. Anyone who signs up does so under this version. Nothing else changes.

Version 3.10.0 (24 September 2026) adds a third Kranzar AI feature in Section 14A: a weekly brief for the business owner. Once a week it sends OpenAI a summary of the week just gone, which includes the names of a small number of deals and the names of team members, so that a short written read of the week can be produced. Telephone numbers, email addresses and postal addresses are not sent, and a customer's name is sent only where a deal has no name of its own. The feature is off until a business switches it on. Version 3.9.0 remains in force until this version takes effect on 24 October 2026, which is the 30 days' notice Section 17 requires. Nothing else changes.

Version 3.9.0 (21 September 2026) changes how ZealCA protects your records. ZealCA no longer encrypts records on your device with a passkey and six numbers. Records are now stored in readable form, protected by your Google sign-in, by keeping every account's records separate from every other's, and by encryption in transit and at rest. We made this change because a key that only the customer holds can be lost, and with it every record, permanently, and because a person leaving a business could take the business's records with them. Sections 2, 3.2, 5, 7, 8, 9, 11, 12 and 14 are rewritten where they described the old lock. This version also records four new things: deleting a record no longer destroys it at once, every change to a record is kept with the name of whoever made it, bill photographs are made smaller before they are stored, and you are emailed when your account is signed in to on a device it has not used before, which needs one further essential cookie (Section 12). The service emails go from nine to eleven. No ZealCA account held any record when this change was made. Nothing about Kranzar or Zealvert Payslips Processor is changed.

Published 9 September 2026. Version 3.2.0 takes effect on 1 October 2026 and remains in force until this version takes effect on 10 October 2026, which is the 30 days' notice Section 17 requires.

The one-line version for ZealCA. Your business records are stored with us in readable form, so that they open wherever you sign in and for every member of your team. They are encrypted in transit and at rest, kept separate from every other account's, and never sold, shared for marketing or given to any AI service. We do not look at them in the ordinary course. Section 3.2 sets out what we hold.

The one-line version for Kranzar. Kranzar is a sales CRM, so a business using it records details of its own prospects and team with us. For that data the business is the Data Fiduciary and we only process it on its behalf; we never sell it or use it to market to anyone. A business that is not renewed becomes read-only and its data is permanently deleted after a retention period. Sections 2.3, 3.4 and 14A set out the detail.

Language. This document is published in English. Every consent notice we give you is available in English and in any language listed in the Eighth Schedule to the Constitution of India, as Section 5(3) of the Digital Personal Data Protection Act, 2023 requires. If you would also like this document itself in an Eighth Schedule language, write to consult@zealvert.com and we will send you a translation free of charge within 15 working days.

Version 3.8.0 (21 September 2026) describes three changes to Kranzar and corrects one earlier statement. First, Kranzar gains a second AI feature: a salesperson may paste the message a customer sent them, or record a short voice note, and have the new deal form filled in for them. Unlike the Ask feature, this one does send what is pasted or recorded to OpenAI, because that text is the thing being read; Sections 6 and 14A now say so in full. It is switched off unless the business turns it on. Second, deleting a record in Kranzar no longer destroys it at once: it is moved to a recycle bin that everyone in the business can see, anyone may put their own records back, and it is destroyed for good only when the business admin approves it by email. Section 14A sets this out, and Section 11 explains what it means for an erasure request. Third, we now take a weekly off-site backup of the Kranzar database and of uploaded documents. This corrects Sections 7 and 14A, which until now said we took no separate copies and that uploaded documents were not backed up. That is no longer true, and the new wording says what we actually do. Nothing about ZealCA or Zealvert Payslips Processor is changed, and no existing section number has moved.

Version 3.7.0 (21 September 2026) adds to Section 14A what Kranzar records every time Zealvert support opens a business, and how the business is shown it. It also removes the sections for a product we no longer offer, including its former Section 13A and its sub-processor and retention rows. No other product's terms are affected.

Version 3.6.0 (20 September 2026) names two further ZealCA service emails in Sections 3.2 and 6, taking them from seven to nine: a GST tax invoice, sent when a payment is taken, and a confirmation when a subscription is cancelled. Both are records of something you have done yourself, sent to the address already on your account, through Resend, which Section 6 has named since Version 3.1.0. No new provider is involved and there is no new purpose. One thing does change, and Sections 3.2 and 6 now say so: the tax invoice is attached as a PDF, so Resend carries the billing name, and the address and GSTIN where you have given them, that appear on that invoice. Your business records, meaning the entries in your book, still never reach it. We must issue a tax invoice for every payment under Rule 46 of the CGST Rules, 2017, and sending it to you is the point of issuing it. Nothing about Kranzar or Zealvert Payslips Processor is changed, and no existing section number has moved. Version 3.5.0 (last updated 17 September 2026) adds Kranzar, our sales CRM web application for small businesses at kranzar.com, in new Sections 2.3, 3.4, 5.6 and 14A, and names Kranzar in Sections 1, 2.1, 4, 6, 7, 8, 10, 12, 13, 15 and 18. It names the providers that handle Kranzar data (Cloudflare, Google sign-in, Resend, Razorpay and, for the optional Ask feature, OpenAI) in Section 6 (updated 20 September 2026: Section 14A now describes Kranzar's one AI feature, which sends the typed question and the names of columns, stages, team members and product categories to OpenAI, and never the records). The Kranzar sections apply to Kranzar from 17 September 2026, because they concern a new product; every other part of this version takes effect on 10 October 2026 as announced for Version 3.4.0. Nothing about ZealCA or Zealvert Payslips Processor is changed, and no existing section number has moved. Version 3.4.0 changes how long we keep a ZealCA account's records, and says so more precisely than Version 3.3.0 did. Records are kept while a subscription is running. When a paid period ends the account becomes readable and exportable but not writable for 30 days, with reminders to download, and everything is then erased within 48 hours. Closing your own account is no longer immediate: it is erased 48 hours after you ask, and you may withdraw the request inside those hours. This is a shorter retention than before for anyone who leaves, and the reason is stated plainly in Section 7: we do not wish to hold books we are not being paid to hold, and Section 8(7) of the DPDP Act points the same way. It also takes the service emails from six to seven by naming the reminder to download your records before they are erased, and gives security and access logs a stated purge at one year rather than only a minimum. No new data is collected, no new third party receives anything, and the counters in Section 12 are unchanged. Version 3.3.0 describes what ZealCA has gained since Version 3.2.0 was written. It adds notifications on your phone or computer and the settings that drive them (new Section 3.3), takes the service emails from four to six by naming the weekly reminder and the GST filing reminder, names the push delivery services as recipients in Section 6, and lists in Section 3.2 the further items held in readable form: your reminder settings, the days you mark as having nothing to record, whether an entry is starred or still awaiting your confirmation, your chosen language, and the size and date of a bill photo whose contents remain encrypted. It also states plainly, in Section 12, that we keep a small number of counters about how the product is used, which the previous version's wording did not allow for. No new third party receives your business records, which at that time remained encrypted and unreadable to us; Version 3.9.0 changed that arrangement. Version 3.1.0 named Resend as our email delivery provider in Section 6 and rewrites the closing note of Section 3.2, because ZealCA is about to begin sending the service emails that Version 3.0.0 declared in advance. No new data is collected and no new purpose is introduced - the purposes were already stated and consented to; what changes is that a named provider now delivers them. Version 3.0.0 (29 August 2026) replaced Version 2.2.0. It introduced ZealCA, our hosted transaction record-keeping application, and described the end-to-end encryption it uses and the limits that places on what we can see, produce or restore. Version 2.2 corrected what we say about Google Analytics: Google Signals and every advertising-personalization feature are switched off, and the statement about IP addresses now describes what Google Analytics actually does rather than a setting that does not exist.

Zealvert® Consulting ("we", "us", "our") collects, uses, stores and protects personal data.

Today the laws that apply are the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 - the "SPDI Rules". The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 take full effect on 13 May 2027. We already follow them.

1. Who we are, and what this Policy covers

Legal name: Zealvert Consulting
Constitution: Sole proprietorship (proprietor: Nasir Islam), MSME/Udyam registered and GST-registered in India, UDYAM-UP-50-0094047
GSTIN: 09AATPI1884P2ZO
Principal place of business: 37 Mewa Nursery, Nishatganj, Lucknow 226007, Uttar Pradesh, India
Other branches: We operate from the above address only and have no branches.
Websites: https://zealvert.com, https://zealca.in and https://kranzar.com

This Policy applies to:

• our website, zealvert.com;
• our consulting, Applied AI education, business process quality and project management services;
• ZealCA, our hosted transaction record-keeping application at zealca.in;
• Kranzar, our sales CRM web application for MSMEs and small businesses at kranzar.com (Section 14A); and
• our desktop software, including Zealvert Payslips Processor (Section 15).

Different sections apply to different services. Where a section applies to only one service, it says so.

2. The two different roles we play

This is the most important thing to understand about how we handle data, so we state it first.

2.1 When we decide why and how data is used, we are the Data Fiduciary

We are the Data Fiduciary - the party responsible under the DPDP Act - for:

• people who visit our website or contact us;
• a client's contact and billing details;
• the person who signs up for, uses and pays for ZealCA;
• the customer who creates and pays for a Kranzar business, for that customer's own account and billing data;
• prospects, leads and inquiries.

For this data we decide the purpose, and the rights in this Policy are ours to honour directly.

2.2 When you record another person's details inside ZealCA, you are the Data Fiduciary and we are the Data Processor

ZealCA is a book-keeping application for your own business. When you record a transaction you may name the other party to it - a customer, a supplier, their GSTIN or invoice number. That is personal data of someone who is not our customer.

For that data, you are the Data Fiduciary and Zealvert is the Data Processor. You decide what is recorded and how long you keep it. We process it only to store it and give it back to you, never for our own purposes. We do not sell it, we do not use it to train any model, and we do not use it to market to anyone.

Our role as Processor is to store that data, return it to you and your team, back it up and erase it, on your instructions and for no purpose of our own. We do not look at it in the ordinary course, and we never use it for any purpose of our own.

The contract required by Section 8(2) of the DPDP Act between us is set out in Section 8 of our Terms and Conditions.

2.3 When you record prospects and team members inside Kranzar, you are the Data Fiduciary and we are the Data Processor

Kranzar is a sales CRM for your own business. When you, or your team, record a prospect - a name, a mobile number, an email address, an address, what they are interested in, and how the sale is progressing - that is personal data of someone who is not our customer. So are the names and email addresses of the team members you invite.

For that data, you, the customer who operates the Kranzar business, are the Data Fiduciary and Zealvert is the Data Processor. You decide what is recorded, who in your team can see it, and how long you keep it. We process it only to store it, show it to the people you have allowed, and give it back to you, never for our own purposes. We do not sell it, and we do not use it to market to anyone.

For your own account and billing data as a Kranzar customer, we are the Data Fiduciary (Section 2.1).

Kranzar data is not encrypted on your device. We hold it in readable form, because a CRM has to search, sort and filter it for you. We therefore state plainly that our Processor role is a real one: access to it is limited to providing, securing and supporting the service, on your instructions, or where the law requires.

The contract required by Section 8(2) of the DPDP Act for Kranzar is set out in Section 8.7 of our Terms and Conditions.

3. What we collect, why, and what it enables

This section describes everything we collect and why. It is a reference document, not the consent notice. Where we ask for your consent, we give you a separate, standalone notice at that moment, presented independently of this Policy, in the form required by Rule 3 of the DPDP Rules, 2025.

3.1 Data we hold as Data Fiduciary

We do not collect card numbers, bank account numbers, passwords, biometrics, health data, caste, religion or political affiliation. Card and bank details are handled entirely by our payment gateway and never reach us. We never receive your Google password - Google confirms your identity to us and tells us only your name and email address.

3.2 ZealCA: what we hold

This is the section to read if you read only one. Your records are held in readable form. We would rather list them plainly than let you assume something is hidden.

Your records

Everything you record about a transaction: the date, the amount, the other party's name, the description, the category, the payment method, whether it is still owed and when it falls due, and all GST details including any GSTIN, invoice number, taxable value, rate and tax split. Also the bill photographs you attach, together with their file names; the list of parties you have hidden from your own suggestions; and your own saved settings, such as your business name and GSTIN, the groups you use to club transactions together, and any recurring-entry rules you set up.

Everything we hold, and why

Three things we would rather you knew in advance

• There is nothing for you to lose. No key, code or passkey stands between you and your records, so there is none to forget.
• Exporting is yours to do, from inside the application. There is no arrangement under which we send you a copy. Please export regularly and keep those copies with your own business records.
• We can be required to produce records. If a court or an authorised agency lawfully orders it, we can produce the records we hold. We will tell you if that happens, unless the law forbids us.

Your email address, and emails we send

We keep your email address for as long as you hold an account, and afterwards only within the billing and tax records the law obliges us to retain (Section 7). It is your account identity and our means of reaching you, so it is not something we can discard while the account exists.

What we use it for: to identify your account at sign-in, and to send you service communications - renewal and billing reminders, notices that a trial is about to end, security alerts, and notices of material changes to the service or to these policies. These are part of providing the service you asked for, not marketing.

What we never use it for: marketing unrelated to your subscription, newsletters you did not ask for, sale or sharing with anyone, or any purpose beyond running your account. We do not sell or rent it, ever.

Stated plainly, as at the effective date of this Policy: ZealCA sends service email through Resend, named in Section 6. We send eleven kinds of message and no others: a welcome note when you create your account; a warning before a trial account and everything in it is deleted; a reminder a few days before your subscription renews; a notice if a payment could not be collected; a weekly note if your book has had a quiet few days, sent only to people whose device cannot receive a notification; a reminder that a GST filing date is approaching, sent only if you switch it on; a weekly reminder to download your records, sent only while an account whose subscription has ended is waiting to be erased; your GST tax invoice, sent when a payment is taken; a confirmation when you cancel a subscription; a confirmation link when you ask to erase deleted records for good; and a notice when your account is signed in to on a device it has not used before. The GST reminder and the quiet-book note are reminders you can turn off in Settings; the other nine are part of running your account. None of them is marketing. Every one also appears inside the application, so email is never the only way you are told something that matters. Resend receives your email address and the text of the message. The tax invoice is attached to its message as a PDF, so for that one message Resend also carries what the invoice shows: the billing name you gave, the address and GSTIN if you gave them, the amount and the tax on it. It never receives your business records, meaning the entries in your book. One message names one further thing: the confirmation link for erasing deleted records names the email address of the person who deleted them and how many there are.

Your payment provider sends its own receipts under its own policy, independently of us.

3.3 ZealCA: reminders on your phone or computer

ZealCA can send you two kinds of notification. Both are off until you switch them on, and both can be switched off again in Settings at any moment.

• A close-of-day reminder, at an hour you choose, on days when nothing has been recorded.
• A GST filing reminder, on a day you choose, before the return you told us you file.

What the server has to know to send them, and what it does not. To decide whether to send the evening reminder, the server asks one question: does any entry carry today's date, or have you marked today as closed? It learns yes or no, and nothing else - not what was recorded, not how much, not with whom. It does not ask anything further.

What the notification says. Fixed wording that is the same for every customer - "Nothing is recorded for today yet", or that a filing date is approaching, naming the period only. No figure, party, description or transaction from your book ever appears in a notification.

Who carries it. Your browser, not us, chooses the service that delivers a notification to your device - Google's, Apple's or Mozilla's, depending on the browser you use. They are named in Section 6. We encrypt each message for your device before handing it over, so the service delivering it cannot read the text either, and we hold the address it gave us for that device so we can send to it again. Turning reminders off, or clearing your browser data, ends that subscription; we also delete it ourselves as soon as a service tells us the device is gone.

If your device cannot receive notifications at all - an older iPhone, or permission refused - the close-of-day reminder falls back to the weekly email described above, and nothing else changes.

3.4 Kranzar: what we hold, and why

Kranzar holds data for two different purposes, and the role we play differs between them (Sections 2.1 and 2.3).

Emails Kranzar sends

Kranzar sends service emails only, from noreply@kranzar.com, through Resend (Section 6): the link that starts a trial, sent to the address typed into the trial form; invitations to join a business; a morning email at 07:00 listing a team member’s own follow-ups for the day, sent only to the members the business admin switches it on for; reminders before a trial ends, and 7 days before and again 1 day before a subscription renews; confirmations of a purchase, each renewal, extra users and a cancellation, and a notice if a payment fails; the one-time links the business admin uses to approve a permanent deletion or to close the business; and notices that a business has expired or been closed, and that its data is about to be, or has been, deleted. None of them is marketing. Resend receives the recipient’s email address and the text of the message; the morning email also carries the names, reference codes and follow-up dates of that member’s own leads and deals. Razorpay sends its own payment receipts and invoices under its own policy.

4. Consent, and how to withdraw it

Where we rely on your consent, we ask for it separately and plainly before we collect the data, not by burying it in a long document.

You may withdraw your consent at any time, and it is as easy to withdraw as it was to give. Write to consult@zealvert.com with the word "WITHDRAW" in the subject line. We will act on it and confirm. For ZealCA specifically, you may also delete your account and everything in it yourself, immediately, from the Danger Zone screen. For Kranzar, the business admin may close the business from inside the application, and once it is closed may ask us to delete all of its data immediately (Section 14A).

Withdrawing consent does not make our earlier processing unlawful, and it may mean we can no longer provide a service to you. Where we must keep some data by law, we will tell you which data and why.

Processing that does not need consent. Section 7 of the DPDP Act treats certain uses as "legitimate uses". Section 7 is a closed list, and we rely only on the limbs that genuinely apply to us: Section 7(a), where you have voluntarily given us your personal data for a specified purpose and have not told us you object; and Sections 7(d) and 7(e), which cover disclosures we are obliged by law to make to the State or under a court order.

Where we keep data to meet a record-keeping obligation - such as the income-tax and GST record rules - we do so because another law requires the retention, so Section 8(7) of the DPDP Act does not require us to erase it. We will tell you which law and which record on request.

5. Where your data is stored and processed

This section is our data residency statement. We state it in full because we would rather you knew than assumed.

5.1 The application and its database

ZealCA runs on Cloudflare. Its database is stored in Cloudflare's Asia-Pacific region - not in India.

The legal basis for that transfer today is Rule 7 of the SPDI Rules, 2011. We transfer data to Cloudflare, Inc. only because it is necessary for the performance of our contract with you, and only under a written agreement that requires Cloudflare to maintain a level of data protection at least equivalent to that required by those Rules.

From 13 May 2027, when Section 16 of the DPDP Act and Rule 15 of the DPDP Rules take effect, this transfer will additionally be subject to any requirement the Central Government specifies about making personal data available to a foreign State or its agencies, and to any notification restricting transfer to a particular country. As at the date of this Policy no such notification has been issued affecting the region we use. If one is issued, we will relocate the data and tell you before we do.

5.2 Backups

Cloudflare's database service maintains its own automatic point-in-time recovery, which lets the ZealCA database be restored to an earlier moment after an accident or a fault. Those copies live inside the same Cloudflare service and region described in Section 5.1, and are held under the same protections as the live database.

5.3 Our own business records

Correspondence, invoices, contracts, engagement notes and consulting deliverables are held in Google Workspace and on company computers in India.

5.4 The desktop software

Zealvert Payslips Processor stores nothing anywhere except on your own computer. See Section 15.

5.5 Service email and notifications

Service emails are delivered by Resend, in its Asia-Pacific (Tokyo) region, through Amazon Simple Email Service. What passes through it is your email address and the text of the message - a renewal reminder or a trial warning. No business record ever passes through it, encrypted or otherwise. The same legal basis stated in Section 5.1 applies to this transfer.

Notifications are delivered by the push service belonging to your own browser, on that company's own network, which is outside India. What passes through it is the address of your device's subscription and a message we have already encrypted for that device. Neither the delivering service nor anyone intercepting it can read the text, and no business record passes through it in any form. The same legal basis applies.

5.6 Kranzar

Kranzar runs on Cloudflare: the application on Cloudflare Workers, the database on Cloudflare D1, and uploaded documents on Cloudflare R2 storage. The database's primary location is in Cloudflare's Asia-Pacific region (Singapore), and uploaded documents are stored in Cloudflare's Asia-Pacific region - not in India. Requests are served through Cloudflare's global network, so a request may pass through a Cloudflare location near the person using the application.

The legal basis for that transfer is the one stated in Section 5.1, and the position from 13 May 2027 described there applies to Kranzar in the same way.

Backups. Cloudflare's database service lets the Kranzar database be restored to an earlier point within a limited period (currently up to 30 days). In addition we take a weekly off-site backup: once a week a copy of the Kranzar database, and of the documents businesses have uploaded, is written to separate storage under our control, and a copy may also be placed in a Google Drive account belonging to Zealvert. We keep the last 12 weekly copies and no more, and they are used only to restore the service after a failure or a mistaken deletion. A business's data is removed from these copies as they age out. This replaces our earlier statement that we took no separate copies and that uploaded documents were not backed up.

Service email for Kranzar is sent through Resend, which may process email addresses outside India. Payments are processed by Razorpay through zealvert.com. Sign-in is provided by Google. What each receives is set out in Section 6.

6. Who else is involved in handling your data

We do not sell, trade or rent personal data to anybody, for any purpose.

We use the following service providers. Each is bound by a contract that requires it to protect the data and to act only on instructions. The list for ZealCA is deliberately short.

No artificial-intelligence service processes your ZealCA records, ours or anyone else's, and none is used to interpret, summarize or analyze them. Your data is never used to train any model. This is a commitment we make and keep, and it matters more now that your records are held in readable form.

Kranzar uses an AI service only when a user asks it to, or, for the weekly brief, when the business has switched it on. In the search box a question is turned into a search of the business’s records; only the question and the names of columns, deal stages, team members and product categories are sent, unless the business admin has agreed to let Kranzar AI read the records, in which case the records the question needs are sent as well. Every feature, and exactly what it sends, is set out in Section 14A. We instruct the provider not to use any of it to train a model.

Lead sources a business connects. The admin of a business may connect sources of enquiries: IndiaMART, the business’s own website, Google Ads lead forms, JustDial, Zapier or Make, and forwarded email. Each is the business’s own arrangement with that party, under that party’s terms and privacy policy; Zealvert has no agreement with them and sends them nothing. Kranzar receives only what the business directed that party to send to its Kranzar address. Email forwarded to a business’s Kranzar address is received for us by Cloudflare Email Routing, part of the Cloudflare service listed above.

If you want to know the specific country your data currently sits in for any provider above, write to consult@zealvert.com and we will tell you within 7 working days. Section 10 also gives you the right to ask for the full list of parties your data has been shared with.

We will also disclose personal data where we are legally required to - to a court, a regulator, or a government agency lawfully entitled to it - and, if our business is ever sold or merged, to the acquirer under a confidentiality agreement. We will tell you if that happens, unless we are legally barred from doing so. What we can disclose is limited by Section 3.2: encrypted records can be handed over only as ciphertext we cannot decrypt.

7. How long we keep things

When a retention period ends, data is deleted or permanently stripped of anything that identifies a person.

Why we do not keep your books after you leave. Section 8(7) of the DPDP Act asks us to erase personal data once the purpose it was given for has ended, and holding a business's records when we are no longer keeping them for that business serves no purpose we could name. We would rather not hold them. The law that requires you to keep your books is a different law and it applies to you, not to us: Income Tax Rule 6F(5) asks for at least six years, and Section 36 of the CGST Act, 2017 for seventy-two months. That is why we remind you to download, and why the application makes a full download of everything you have recorded available at any time, as a PDF, a spreadsheet or a data file.

8. How we protect your data

We apply the safeguards required by Rule 6 of the DPDP Rules, 2025:

• How your ZealCA records are protected. Every request is checked against the account it belongs to, so no account can read, change or delete another's records, and this is tested on every route before each release. Sign-in is through Google, so we never hold a password for you. A bill photograph is only ever handed back as a download, never run as a page. Our own admin backend opens only after a fresh Google sign-in, closes itself after a short time, and has no screen that displays a customer's records. You are emailed when your account is signed in to on a device it has not used before.
• The part that is yours. Whoever can sign in to your Google account can open your records. Switch on 2-Step Verification, lock your devices, and use "Sign out from all other devices" if one is lost.
• Encryption in transit and at rest. All traffic uses HTTPS/TLS, and the database and the file store are encrypted at rest by Cloudflare.
• Access control. Access to systems is restricted to the people who need it. Administrative access to ZealCA is limited to named accounts and, by design, confers no ability to read customer records.
• Monitoring and logs. We keep logs of access and of significant actions and retain them for at least one year, so that unauthorized access can be detected and investigated.
• Logs held in India - stated precisely, including what is not yet done. The CERT-In Directions of 28 April 2022, issued under Section 70B(6) of the IT Act, 2000, require logs of all ICT systems to be maintained for a rolling 180 days within Indian jurisdiction. The request and connection logs generated by our hosting provider's network are not yet copied into Indian jurisdiction. We are building that, and we will update this Policy when it is in place. We would rather tell you this than let you assume otherwise.
• Contracts. Every service provider that processes data for us is contractually required to apply reasonable security safeguards.
• Kranzar, stated precisely. Kranzar data is not end-to-end encrypted: it travels over HTTPS/TLS and is stored in readable form on Cloudflare so that the application can search and filter it. Inside a business, what each person can see and do depends on the user type the business admin gives them. An audit log records actions taken in the business. The sign-in cookie cannot be read by scripts on the page.
• Deletions are thorough. When an account is erased, its rows are removed from every table that holds them, together with its records, its deleted records, its history of changes and its bill photographs, by a single audited process.

No system is perfectly secure, and we do not claim otherwise. What we do claim is that we apply these measures, review them, and tell you promptly if something goes wrong.

9. If there is a personal data breach

Where we are the Data Fiduciary, if personal data we hold is subject to a breach we will:

1. Tell every affected person without delay, in plain language, stating the nature, extent and timing of the breach, where it happened, what it is likely to mean for you, what we have done to limit the damage, what you can do to protect yourself, and the name and contact details of a person who can answer your questions.
2. Report it to the Data Protection Board of India without delay, and give the Board full details within 72 hours of becoming aware.
3. Report it to CERT-In within 6 hours of noticing the incident, where it falls within the categories in Annexure I to the CERT-In Directions of 28 April 2022.

Where we are the Data Processor - that is, where the breach affects records belonging to you - we tell you within 6 hours, with enough detail for you to make your own notifications.

We do this for every breach. There is no severity threshold below which we stay silent.

10. Your rights

You have the following rights over personal data for which we are the Data Fiduciary. To exercise any of them, write to consult@zealvert.com stating which right you are using, your full name, and the email address you use with us - we need that to be sure it is really you.

We respond to rights requests within 30 days. Grievance timelines are in Section 11.

A nomination does not hand over your books. A nominee can exercise your rights over the account data we hold as Data Fiduciary. We do not hand over business records on a nomination alone. If you want someone to be able to reach your records after you, give them access as a team member, or keep your exports where they can find them.

If your details are inside somebody else's ZealCA account - because a business recorded you as a customer or supplier - your request goes to that business, for the reason given in Section 2.2. We cannot see, correct or delete an entry inside an account, and would not be permitted to alter another party's records on your instruction in any event. Write to consult@zealvert.com if you need help identifying who to approach.

If your details are inside somebody else's Kranzar business - because a business recorded you as a prospect or invited you to its team - your request goes to that business, for the reason given in Section 2.3. Its admin can correct or delete your details directly in the application. Deleting is a two-step act in Kranzar: the record is moved to that business's recycle bin, and it is destroyed for good when the business admin approves it from the link Kranzar emails them (Section 14A). Until then the business still holds it. We act on that business's instructions and will not alter its records on your instruction alone, but we will pass your request to the business and help you identify who to approach if you write to consult@zealvert.com.

If your details reached a business as an enquiry - through its website form, its IndiaMART account, an email it forwarded, or its Kranzar enquiry page - the same applies: your request goes to that business. Its admin can see every enquiry the business holds, including those not yet decided, and can remove yours directly in the application; an enquiry is deleted at once when the admin deletes it, without the recycle bin. An accepted enquiry has become a lead and is corrected or deleted as a lead. We cannot see, correct or delete an enquiry inside a business on your instruction, for the reason given in Section 2.3.

Your duties

The DPDP Act also places duties on you: to give authentic information, not to impersonate anyone else, not to suppress material information when providing personal data for a legal purpose, and not to register false or frivolous grievances. A breach of these duties carries a penalty of up to ₹10,000 under the Act.

11. Grievances, and how to escalate

Grievance Officer
Name: Nasir Islam
Designation: Founder & Head - Grievance Officer
Email: consult@zealvert.com
Phone: +91 6393680341
Address: 37 Mewa Nursery, Nishatganj, Lucknow 226007, Uttar Pradesh, India

Nodal Person of Contact (required by Rule 4(1)(b) of the Consumer Protection (E-Commerce) Rules, 2020 - a separate role from the Grievance Officer, responsible for compliance and liaison with law enforcement)
Name: Nasir Islam | Designation: Founder & Head - Nodal Person of Contact | Resident in India at: 37 Mewa Nursery, Nishatganj, Lucknow 226007, Uttar Pradesh, India
Email: consult@zealvert.com | Phone: +91 6393680341

What we commit to. We will:

• acknowledge every complaint within 24 hours, and give you a ticket number so you can track it;
• remove or disable access to content within 3 hours of a court order or a reasoned intimation from an authorized government officer;
• act within 2 hours on a complaint about non-consensual intimate imagery;
• act within 36 hours on a complaint that content is unlawful;
• resolve complaints under the IT (Intermediary Guidelines) Rules, 2021 within 7 days;
• give a substantive response to every other complaint within 7 business days; and
• fully resolve every complaint within 30 days.

How to complain to the Data Protection Board. If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India. Under Section 13(3) of the DPDP Act you must use our grievance process first. The Board functions as a digital office and complaints are filed electronically through its official portal. The Board is being constituted and its complaint portal is not yet open; we will publish the link here as soon as it is. If you cannot access the portal, write to consult@zealvert.com and we will send you the Board's current filing particulars in writing within 3 working days.

You may also approach a Consumer Commission under the Consumer Protection Act, 2019. Nothing in this Policy takes that right away.

12. Cookies and website analytics

Our website uses cookies and Google Analytics to count visitors and understand which pages are used. You may block or delete cookies in your browser; parts of the site may then not work properly.

ZealCA uses no advertising cookies, no tracking pixels and no third-party analytics. It sets one cookie that keeps you signed in, one that lets it recognise a browser you have signed in on before so that it can tell you when your account is used somewhere new, and a short-lived one during the sign-in exchange itself. For the owner of Zealvert only, there is one more, which opens the admin backend for a short time. All are essential to the service, none can be read by scripts on the page, and nothing about your use of the application is reported to anyone outside Zealvert.

We do keep a small number of counters of our own, and we would rather describe them than let the sentence above be read too generously. We record that an account finished signing up, that a first transaction was entered, that a tenth was, that an export pack was produced, that a recurring entry was set up, that a reminder was switched on, that a trial notice was shown, that a checkout was opened, and that a subscription started, renewed or was cancelled. Each is stored as three things and no more: your account's identifier, one name from that fixed list, and the time. There is no column in which an amount, a party, a description or a photograph could be put, and the server rejects any attempt to send one. We do not record which pages you look at, how long you spend anywhere, or what you type.

What they are for, and what they are never used for. They tell us whether people who sign up actually get their books going, which is the only way we can tell whether the product works. They are not used to profile you, to target you, to advertise to anything, or to decide anything about you, and they are never shared or sold. Their retention is set out in Section 7.

Kranzar uses one essential cookie and no advertising or tracking cookies. That cookie is a session cookie which keeps a user signed in for up to 30 days. It is marked HttpOnly, so scripts on the page cannot read it. Nothing about your use of Kranzar is reported to any advertising or tracking service.

Visits to the public pages of kranzar.com are counted with Cloudflare Web Analytics. The public pages are the home page and the pages anybody can read without signing in, such as Features, Pricing and the FAQ. Cloudflare Web Analytics sets no cookie and keeps nothing in the visitor’s browser; it counts page views, the page and the site a visitor came from, the type of browser and device, and the country, and it does not identify individual visitors. It is not used inside the signed-in application. We use it only to see how many people read the pages and how they found them. From September 2026 until 20 October 2026, Cloudflare’s automatic setup also counted visits to the signed-in application; those counts are statistics that identify nobody, and we have limited the counting to the public pages.

Zealvert’s own visit counter. zealvert.com and the public pages of kranzar.com also run a small counter of our own. It sets no cookie and sends us no identifier of any kind. For each page it sends the page’s address, the name of the website that sent the visitor (never the full address), any campaign tags in the link, how long the page stayed on screen, and which links were pressed. To count each visitor once a day, once a week and once a month, it keeps three dates in your browser’s own storage, and for the current tab a note of the first page and the number of pages seen; these never leave your browser. From each request we read the country and the kind of device and browser, and keep only a count against them. We keep daily totals only: nothing we keep can tell one visitor from another. Your internet address is used only to stop one connection sending too many requests and is never kept with a count. The counter does not run inside the signed-in Kranzar application, and it does not count a person who is signed in to Kranzar. You can clear the stored dates by clearing your browser’s data for the site.

Where a sign-up came from. When a visitor opens the home page or the trial form of kranzar.com, the page keeps a small note in that visitor’s own browser storage, not in a cookie, for 90 days: the name of the site the visitor came from (not its full address), any campaign tags in the link, whether the visit came from a Google advertisement, and the first page opened. The note never leaves the browser unless the visitor sends the trial form, which then sends it to us together with the optional answer to “How did you hear about Kranzar?”. We keep it with the trial form (Sections 3.1 and 7) and use it only to count which channels bring trials and paying customers. Clearing the browser’s data for kranzar.com removes the note.

The Payslips Processor desktop application uses no cookies and no tracking of any kind.

13. Children

ZealCA is not for anyone under 18. It is a business tool, and our Terms require account holders to be adults. If we learn that a child holds an account, we suspend the account immediately and delete the child's personal data.

Kranzar is not for anyone under 18 either, on the same terms. It is a business tool, and it carries no advertising or tracking cookies. An enquiry a business receives through a connected lead source or its enquiry page is not checked for the sender’s age, because we cannot tell a child from an adult from an enquiry; if a business learns that an enquiry came from a child, it must delete it, and the admin can do so at once in the Enquiries module.

We do not profile, track or behaviorally monitor any user of ZealCA, of any age. The application carries no advertising cookie, no tracking pixel and no third-party analytics. The counters described in Section 12 record that a named thing happened once, and are never used to build a picture of a person, to predict anything about them, or to target them; no advertising audience exists to add anyone to. This satisfies Section 9(3) of the DPDP Act regardless of who is signed in.

Our website uses Google Analytics for aggregate visitor statistics. Because Section 9(3) of the DPDP Act prohibits tracking or behavioral monitoring of children, and because we cannot tell a child from an adult from a website visit, we have switched off the features that would turn counting into profiling:

• Google Signals is switched OFF. With it on, Google would link a visit to that person’s own signed-in Google account and report their age band, gender and interests back to us. It does not, because it is off.
• Advertising personalization and remarketing are switched OFF, for every region. We do not advertise, and no visitor to our website is added to any advertising audience.

On IP addresses, stated as it actually works rather than as a setting. Google Analytics does not give us any visitor’s IP address. Google uses it momentarily to work out an approximate city and then does not make it available to us at all. For visitors from the European Economic Area, Switzerland and the United Kingdom, Google does not log or store the IP address in the first place. We have no way to see, export or store the IP address of anyone who visits this website.

We do not run targeted advertising anywhere in our services.

We do not knowingly collect a child's personal data. If we ever need to, we will first obtain verifiable consent from a parent or lawful guardian in the manner prescribed by Rule 10 of the DPDP Rules, 2025, and we will describe that mechanism here before we do so.

If you believe a child's data has reached us, write to consult@zealvert.com.

14. ZealCA - additional detail

What it is. A hosted application for recording day-to-day business transactions and exporting them for your own records and for your accountant. Each account's records are kept separate from every other account's, and no account can read, change or delete another's.

Signing in. With your Google account. We never see your Google password. Google tells us your name and email address, and nothing else.

Signing in is all there is. Once you have signed in with Google, your records open. There is no second step, and no key, code or passkey to set up or remember. Whoever can sign in to your Google account can open your records, so keep that account secure, with 2-Step Verification switched on. We email you when your account is signed in to on a device it has not used before.

Exporting. You can export everything, at any time, as PDF, CSV or JSON, from the Export screen. Do this regularly. There is no arrangement under which we send you a copy; exporting is yours to do.

The editing window. Each edition allows past-dated entries to be edited only within a set number of days. Entries older than that become read-only, though they can still be deleted and still appear in exports.

Deleting a record, and Deleted records. Deleting a record does not destroy it at once. It moves to Deleted records, with any bill photograph on it, where everybody in your business can see what was deleted, by whom and when. Whoever deleted it may put it back, and so may the account holder. Only the account holder can erase a record for good, one person's deletions at a time, by confirming through a link we email them. Until then it still counts towards your plan's entry limit. This exists so that a mistake, or a departing employee, cannot wipe a business's records.

History of changes. When a record is changed, the version it replaced is kept, with who changed it and when. Everybody in your business can see it on the record. Nobody can remove a line from it. It is erased only with the record or the account.

Deleting your account. You may delete your account and everything in it at any time from the Danger Zone screen. It erases everything, deleted records and history included. Export first if you want to keep anything.

After you cancel a subscription. Your data is kept for 30 days, during which you can sign in and export it. After that we erase it. There is no arrangement under which we send you a copy; exporting is yours to do.

Bill photographs. You may attach a photograph of a bill to an entry. It is made smaller on your device before it is uploaded, so that it uploads quickly and costs less to keep; we do not keep the original, full-size photograph. Photographs and PDF files are accepted, and a stored file is only ever handed back as a download. Removing a photograph, or deleting the entry it is on, moves it to Deleted records; it is erased when the entry is erased for good, or with the account.

Team members. You may give staff their own sign-in. Each signs in with their own Google account, enters the invite code you give them, and is let in when you approve them. Removing a member ends their access from that moment. A person who leaves takes nothing the business needs: your records stay with your account.

Recurring entries. A rule you set up is stored with your other business settings. The drafts it produces are prepared by your own device, the next time you open the application, and sit waiting until you confirm them.

Reminders. See Section 3.3. Both kinds are off until you switch them on, and off again whenever you choose.

Who at Zealvert can see your records. ZealCA records are stored in readable form, so we are technically able to reach them, and we tell you plainly rather than claim otherwise. Our admin backend has no screen that displays a customer's records. We would reach them only through the database itself, only to provide, secure or support the service at your request, or where the law obliges us. We do not look at your records in the ordinary course, and we never use them for any purpose of our own.

Sub-processors (other companies that handle data on our behalf) are listed in Section 6. We give 30 days' notice before adding a new one.

14A. Kranzar - additional detail

What it is. A sales CRM web application for MSMEs and small businesses, at kranzar.com, wholly owned and operated by Zealvert Consulting. A customer creates a business in it, records prospects and follows them through sales stages, keeps a list of products, attaches documents, and works with a team.

Signing in. Only with a Google account. We never see your password, and we store no passwords at all. Google tells us your name, email address, profile picture and Google account identifier.

The team. The business admin can invite team members and give each one of the user types admin, supervisor, user or viewer. Each member signs in with their own Google account. The invitation is sent by email from noreply@kranzar.com.

Who is responsible for what. For the prospects and team members a business records, the business is the Data Fiduciary and we are its Data Processor. For the customer's own account and billing data, we are the Data Fiduciary. See Section 2.3.

Paying for it. Kranzar may start with a free trial that needs no payment details. A trial does not turn into a paid subscription unless the business admin subscribes. Every plan - Pro, Business and Enterprise - is bought at once: it is charged at once and starts the day it is paid for, and the trial ends. Payments are processed by Razorpay through zealvert.com. Paid plans renew automatically through a card or UPI mandate until cancelled, and Razorpay issues the invoice, which shows the product name Kranzar.com. We never receive card, bank or UPI details. The business admin changes the plan or billing period, or cancels the automatic renewal, inside the application from Settings, Subscription; automatic renewal may also be cancelled by writing to consult@zealvert.com. An upgrade to a higher plan takes effect at once, with the difference for the rest of the period charged then; any other plan change takes effect from the next renewal, and after cancelling, access continues to the end of the period already paid. Cancellation terms, including the 14-day refund guarantee of the first payment of any plan, no questions asked, are in Section 4B of our Cancellation and Refund Policy.

When a trial or subscription ends. The business becomes read-only. We send reminder emails before a trial ends, and 7 days before and again 1 day before each renewal date. If the business is not renewed, all of its data - records, products, documents, team and logs - is permanently deleted after a retention period, currently 6 months, with a final warning email before deletion. Deletion cannot be undone.

Downloading your data. The business admin can download sales records and products as CSV files at any time, from Settings, Business, and, where Bookkeeping is used, its invoices, payments, adjustments, refunds and collection follow-ups from the Bookkeeping page; every such download is written in the business’s audit log. Uploaded documents can be downloaded one by one. All of these keep working while a business is read-only or locked. Do this regularly, and before a subscription ends.

Closing a business. The business admin can close the business. It becomes read-only at once, and its data is deleted after the retention period. Once a business is expired, closed or locked, the admin may write to consult@zealvert.com and we will delete all of its data immediately.

Backups. The database can be restored to an earlier point within a limited period (currently up to 30 days). We also take a weekly off-site copy of the database and of uploaded documents, keep the last 12 such copies, and use them only to restore the service after a failure or a mistaken deletion (Section 7).

Deleting a record, and the recycle bin. When anyone in a business deletes a deal or a product, it is not destroyed at once. It is moved to Deleted records, where it is kept whole, with its documents and its history. This is deliberate, so that a mistake or a departing employee cannot wipe a business's records. Everyone in the business can see Deleted records, under the same visibility rules that apply everywhere else in Kranzar, and anyone may put their own deleted records back at any time, without asking. Nothing is destroyed for good except by the business admin, and only by using a one-time link that Kranzar emails them. The admin decides one person's records at a time, and Kranzar states plainly when that person is no longer in the team. Anything the admin does not choose to destroy is put back. Until the admin decides, the record is still held by us and still counts towards the business's plan limits, because it is still being kept for that business. Once the admin approves, the record and any documents on it are removed from Kranzar, and they then age out of the weekly backup copies described above.

Bookkeeping (Business and Enterprise). A business on the Business or Enterprise plan may switch on Bookkeeping. Its team can then record, against an account, the invoices the business issued from its own accounts software, the payments received, advances, refunds, adjustments, and collection follow-ups with any promise to pay. Kranzar records these; it does not issue invoices, take or send payments, or write to the business’s customers. Nothing a team member records counts until the business admin approves it. An approved entry cannot be changed or deleted, only reversed by the admin with a reason, and an account or deal that an entry names cannot be deleted. Who sees what follows the user types: the admin and supervisors see the money of every account they may see, and a salesperson sees the money of the accounts and deals they own and the entries they recorded. Reminders of a collection follow-up appear in the bell inside Kranzar and are not emailed. None of Kranzar’s AI features reads bookkeeping records, and no bookkeeping record is sent to OpenAI, Resend or any other provider. A business that leaves the Pro plan keeps its bookkeeping records, read-only.

Connected lead sources and the Enquiries module. The admin of a business may connect its own website form, its IndiaMART seller account, or its own email, in Settings, Lead sources, and may switch on the Kranzar enquiry page described below. Each connection has its own secret receiving address. The business decides which sources it connects, who in its team takes the enquiries, and what happens to each one; Kranzar processes them on those instructions alone.

Where an enquiry lands. An enquiry that arrives there lands in the business’s Enquiries module, and not in Leads. Kranzar works out which of the members the admin chose it is proposed to, in turn; whether the product asked for matches the business’s catalogue; and the reasons the enquiry needs the business’s attention, written on it in plain words - for example that the business already holds a lead, contact or deal with the same phone number or email address, that the message carries a link, that the same message was sent before, that the sender’s earlier enquiry was rejected, or that the phone number cannot be read. A barred word the admin listed, a sender the admin blocked, or many enquiries from one sender within an hour mark the enquiry suspicious, and such an enquiry is shown to the admin alone. These reasons are worked out from the business’s own records and from the enquiry itself, never from any other business’s records and never from any outside source.

A person decides, not Kranzar. The reasons and the mark “suspicious” are information for the business, not a decision about the person who enquired. Kranzar refuses no enquiry on their account, sends nothing to the person because of them, and makes no decision that has a legal or similar effect on anyone: a member of the business reads the enquiry and accepts it, rejects it with a reason, or marks it suspicious or not. The admin may at any time clear the mark, unblock a sender, and remove a barred word.

How it becomes a lead. Only an accepted enquiry becomes a lead, and the lead then records who accepted it and the enquiry it came from. The one exception is a source for which the admin chose “Becomes a lead at once”: an enquiry from that source that carries no reason becomes a lead the moment it arrives, as every enquiry did before this version, and the lead records that it was made that way. An enquiry from a buyer the business already knows, one that arrives while the business’s lead limit is full, and one marked suspicious always wait for the admin.

What is received. The details the sending party passes on: the name, phone number, email address, company and city of the person who made the enquiry, the product asked for, their message, and the party’s own reference for it; from a forwarded email, the sender’s name and address, the subject and the text of the message, and not its attachments. A phone number or email address that cannot be read is kept as it was sent, so the business can still see it. Nothing else is collected about the person: no internet address, no device, no location beyond the city they typed.

Blocked senders. The admin of a business may block a phone number, an email address or every address of an email domain, with a reason. An enquiry from a blocked sender is marked suspicious and is not proposed to anybody; it is still received and still shown to the admin, who may accept it after all. The list is the admin’s alone to see and to change, it is never shared with another business, and an entry is kept until the admin removes it.

What is not done. Nothing is sent to the person who made the enquiry, by email, message or any other means, whatever the business decides. Nothing about an enquiry goes to any artificial intelligence service: not when it arrives, not when its reasons are worked out, and not while it waits. Once it is a lead, it is treated as any other lead under the paragraphs on artificial intelligence below. Enquiries and blocked senders are never sold, never shared with another business, and never used by Zealvert for any purpose of its own.

Who sees it. An enquiry is seen by the member it was proposed to and by the admin; a supervisor sees the enquiries of every member, and a viewer those of the members chosen for them. An enquiry from a known buyer, one that arrived while the lead limit was full, and one marked suspicious are seen by the admin alone, as is the list of what the business already holds for that person. The lead an accepted enquiry becomes follows the rules for any lead. Every decision on an enquiry is written in the business’s audit log, with who took it and when.

How long it is kept. A waiting enquiry is kept until a member of the business decides it or the business deletes it. An accepted enquiry is kept with its lead. A rejected enquiry, and one marked suspicious, is deleted automatically 90 days after it was handled; the admin may delete either sooner. A blocked sender is kept until the admin removes it. All of these are deleted with the business (Section 7). Deleting an enquiry is immediate and does not use the recycle bin.

The person’s rights. The business is the Data Fiduciary for every enquiry it receives, and it is the business that must give the person the notice the Act requires and answer their requests to see, correct or delete what it holds (Section 10). Kranzar gives the admin the means to do so: every enquiry the business holds is listed in the Enquiries module, and the admin can delete any of them.

Switching it off. The admin may switch any connection off, or make a new receiving address for it, at any time. The old address stops accepting anything at once. We keep only a one-way fingerprint of the secret part of each address, so nobody can read an address back out of our records.

The Kranzar enquiry page. The business admin may also switch on an enquiry page that we host for the business on kranzar.com, showing the business’s name and logo, and share its link or QR code. A buyer who fills it in gives the business their name and their phone number or email address, and may add their company, city, the product they are looking for and a message. The enquiry goes to that business alone, into its Enquiries module, exactly as an enquiry from a connected lead source does, and it is handled as described above. The page sets no cookie, counts no visitors and asks for nothing else, and it is not shown to search engines. The admin may switch the page off, or make a new link for it, at any time; the old link stops at once.

The customer page. When a business shares the first quotation of a deal, we host a page for that customer on kranzar.com. It opens only with the customer’s mobile number or a PIN the business gives them; three wrong tries lock it until the business unlocks it. On it the customer sees the quotations of that deal, may approve or reject each one (a rejection carries the customer’s reason) or send feedback, and may write to the deal’s owner in a chat; the business writes back from Kranzar, and both sides see the whole chat. What the customer writes is held by Kranzar for that business alone, with the deal, and is shown to the business’s team as the deal’s other records are. The page sets one cookie that keeps the customer signed in for twelve hours, counts no visitors and loads nothing from anybody else; it is not shown to search engines. The business may switch the page off or on at any time; it closes by itself a set number of days after the deal is won or lost, and while the business’s subscription is read-only. The page and its chat are never deleted on their own: they are kept with the deal and deleted with the business’s data, as Section 7 says.

Locking. We may lock a business, which makes it read-only, for misuse or for unpaid dues.

Artificial intelligence, stated precisely. Kranzar has six AI features, and each is stated separately. The first is Kranzar AI in the search box: a user types a question in plain words (for example "overdue follow-ups in Pune" or "deals of electrical items") and presses AI Search, and Kranzar turns the question into a search of its deals, leads or products, or opens its accounts, contacts or quotations with the words to look for. To do this, Kranzar sends to OpenAI (Section 6) only the text of the question, the names of the columns, and the names of the business’s deal stages, team members and product categories. When the question names a kind of item, OpenAI also returns related words, which Kranzar looks for in the business’s own records. The records themselves are not sent, and the search is run by Kranzar on its own database, under the user’s own visibility rules. Please do not type personal details into a question. Under OpenAI’s terms for its API, this content is not used to train its models. The Business Admin can switch the feature off for the whole business at any time, from Settings, Business; the rest of Kranzar works without it. We keep a count of AI requests per business (date, feature, size and cost), not their content.

Kranzar AI reading your records. The business admin may also allow Kranzar AI to read the business’s records, so that it can understand a question by what the records mean and answer it in words. It is off until the admin switches it on in Settings, Business, after being shown what is sent; the date it was switched on and the admin who did it are recorded in the business’s audit log. The admin may switch it off at any time, and it then stops at once for everyone in the business. When it is on, a question sends OpenAI, besides what is set out above, the records the question needs: at most a set number of records of one kind (deals, leads, accounts, contacts, products or quotations), newest first, and only records the person asking can already see in Kranzar. For each record it sends its reference and whichever of these it holds: its name; the name of the prospect, lead, contact or company and of its account, each replaced by a code (see “Customer names go as codes” below); a contact’s job title, an account’s industry and city; the product, or the products on a quotation; its stage or status; its value or price; its dates; its owner’s name; where it came from and why it was lost; and the first 160 characters of its description. Mobile numbers, email addresses, documents, pictures, voice notes, internal notes, a customer’s feedback on a quotation and bookkeeping records are never sent. The counts and totals shown with the answer are worked out by Kranzar; the sentence of the answer is written by the AI service and can be incomplete or wrong. Kranzar does not keep the records it sent or the answer; we keep a count of the request, not its contents. Under OpenAI’s terms for its API the content is not used to train its models, and OpenAI may keep it for up to 30 days for abuse monitoring before deleting it. The records may hold personal data of the business’s own customers and their staff; the business, as Data Fiduciary (Section 2.3), decides whether to allow this.

Capturing an enquiry without typing. On a new deal a user may press Capture an enquiry and either paste the message a customer sent them - on WhatsApp, by SMS or by email - or record a short voice note describing it. Kranzar then fills the form in for them. Unlike Ask, this feature does send what the user pastes or records to OpenAI (Section 6), because reading it is the whole purpose; a voice note is first turned into words and those words are then read the same way. Along with it Kranzar sends the names of that business's products and of its team members, so that the right product and the right deal owner can be chosen. The business's saved records, prospects, documents and reports are never sent, and nothing is sent unless the user presses the button. Kranzar does not keep the message or the recording: the recording is not stored at all, and only the details the user accepts and saves become part of the deal. We keep a count of the request, not its contents. Under OpenAI's terms for its API the content is not used to train its models. Please tell your team not to paste anything more than the enquiry itself. The details the feature fills in are suggestions: nothing is saved until the user checks them and presses Create, and a telephone number, an email address or an amount read from a message can be wrong. The feature is off unless it is switched on for your business, and the business admin can switch off all AI features at any time from Settings, Business.

The weekly brief for the business owner. Once a week Kranzar can write the admin of a business a short note about the week that has just finished - what was created, won and lost, which follow-ups are overdue, which deals have gone quiet, and a few suggestions of what to attend to. It waits in the bell inside Kranzar and is not sent by email. To write it, Kranzar sends to OpenAI (Section 6) a summary of the week: the business name and the dates; how many deals were created, won, lost and moved between stages; the value of those deals, shown separately for each currency; the reasons deals were marked lost and where new deals came from; the names of team members with how many deals each created, won and lost; and the names, reference codes, values and dates of a small number of deals - those won, those lost, those whose follow-up is overdue, those closing soon and those with no next step. How many deals are named is a setting, and it is a few for each list rather than all of them. No customer name is sent: any name of an account, contact, lead or customer, including one inside a deal name, is replaced by a code (see “Customer names go as codes” below). Telephone numbers, email addresses and postal addresses are never sent, and neither are descriptions, comments, voice notes, documents or reports. It is one request for the whole business each week, not one for each person. Kranzar does not keep the summary it sent; we keep a count of the request, not its contents. Under OpenAI's terms for its API the content is not used to train its models. The figures in the brief are worked out by Kranzar from the business's own records; the sentences around them are written by the AI service and can be wrong or can miss something, and the brief is not financial, legal or business advice. The feature is off unless it is switched on for your business, and the business admin can switch off all AI features at any time from Settings, Business.

Drafting a follow-up message. A user may ask Kranzar to write a short follow-up message for one enquiry. To do this we send our AI provider the name of the enquiry, its stage, the product asked about, its value, how long it has been since the enquiry last changed, the user’s own note about it, and whatever the user types as the point of the message. We do not send the prospect’s name, telephone number, email address or postal address. The message is written for the user to read, change and send themselves; Kranzar does not send messages to your customers.

Deals at risk. A user may ask Kranzar which of their open enquiries are most likely to be lost. To do this we send our AI provider, for a limited number of enquiries, the enquiry number and name, its stage, its value, how long it has been since it changed, how its closing and follow-up dates stand, and where it came from. Any customer name in it is replaced by a code (see “Customer names go as codes” below). We do not send telephone numbers, email addresses, postal addresses, comments or attached files. The judgement it returns is a suggestion for the user and nothing is changed in your records because of it.

Customer names go as codes. Since 20 October 2026, before any request leaves Kranzar for our AI provider, every name the business holds for its accounts, contacts, leads and customers is replaced by a code, such as [A1] for a company or [P1] for a person, wherever it appears in the text sent, and the codes in the answer are turned back into the names before anybody reads it. This applies to every AI feature of Kranzar. A name that Kranzar does not yet hold cannot be recognised, such as a new customer’s name inside a message pasted into Capture an enquiry, or a name spoken in a voice note, and is sent as it is.

Help inside the Support page. A user who has a problem with Kranzar may open Support, choose the part of Kranzar it concerns, and either pick a question from our written help or describe the problem in their own words, up to 500 characters. A description is first matched against our written help, and against answers our support team has already given to similar problems, which are shown word for word and never name another customer, record or person. Only when none of those fits is the description sent to OpenAI (Section 6), together with our own help text for that part of Kranzar, so that a short answer can be written. We do not send any record of your business: no prospect, lead, deal, contact, account, product, quotation, note, document, name, telephone number or email address, other than whatever the user chooses to type into the description. Please do not type personal details into it. The answer is marked as written by AI. We keep the description, the answers offered and whether they solved the problem with your business’s support records, so that our team can answer a support request raised from it and improve our written help. Requests made this way count towards your business’s AI allowance, and nothing is sent to OpenAI if the business admin has switched off AI features for the business.

Who at Zealvert can see your data. Kranzar is not end-to-end encrypted. Our support staff are technically able to open a business account, and we tell you plainly rather than claim otherwise. We do so only to answer a request for help from you, or where the law obliges us. Every time our support staff open a business in our support backend, it is recorded permanently and shown to you inside the application, under Settings, Business, "Access by Zealvert". Our support backend shows a business’s plan, billing and members; it does not show your leads, deals, contacts, accounts or documents, and opening it sends no notice. The record also lists everything else we do to a business, such as locking it or extending a trial. It cannot be edited or deleted by us. If you see an entry you did not ask for, write to consult@zealvert.com and we will account for it. If you would rather your records were unreadable even to us, our ZealCA application is built that way instead (Section 14).

Analytics. The signed-in application is not counted by any analytics service. The public pages of kranzar.com are counted with Cloudflare Web Analytics, which sets no cookie, and with Zealvert’s own counter, which sets no cookie and identifies nobody (Section 12).

Sub-processors for Kranzar - Cloudflare, Google, Resend and Razorpay - are listed in Section 6. We give 30 days' notice before adding a new one.

15. Zealvert Payslips Processor (desktop software)

This section applies only to our desktop software distributed through the Microsoft Store. It does not apply to ZealCA or Kranzar, which are hosted services and are covered above.

• 15.1 Local processing. The application runs entirely on your own computer. It reads only the files you choose (a payslip template and an employee data file) and writes the generated payslip files (.xlsx and .pdf) to a folder on your device. Your employee and payslip data is never transmitted to Zealvert Consulting or to any third party.
• 15.2 No tracking. The application contains no analytics, telemetry, advertising or tracking of any kind. It does not create user accounts and does not require you to sign in.
• 15.3 Purchases. The application is free to use. Optional paid upgrades are purchased through the Microsoft Store and handled entirely by Microsoft under the Microsoft Privacy Statement. We never receive your payment details. These upgrades are separate from, and unrelated to, ZealCA subscriptions.
• 15.4 Third-party software. To produce PDF copies of payslips, the application uses Microsoft Excel or LibreOffice if either is installed on your computer. This conversion also occurs locally on your device.
• 15.5 Support. For questions about our software, contact consult@zealvert.com.

16. Third-party links

Our website and our application may link to third-party websites. We are not responsible for their privacy practices. Read their policies before giving them anything.

17. Changes to this Policy

We may update this Policy. Where a change materially affects how we handle your personal data, we will tell you at least 30 days before it takes effect, so that you can object, withdraw consent, or stop using the service. Every version carries an effective date, and the current version is always on this page.

18. Legal and contact details

(Displayed as required by Rule 4(2) of the Consumer Protection (E-Commerce) Rules, 2020)

Legal name: Zealvert Consulting
Constitution and registration number: Sole proprietorship (proprietor: Nasir Islam), MSME/Udyam registered and GST-registered in India, UDYAM-UP-50-0094047
GSTIN: 09AATPI1884P2ZO
Principal geographic address of headquarters: 37 Mewa Nursery, Nishatganj, Lucknow 226007, Uttar Pradesh, India
Branch addresses: We operate from the above address only and have no branches.
Websites: https://zealvert.com | https://zealca.in | https://kranzar.com
Customer care - email: consult@zealvert.com | phone: +91 6393680341 | fax: not applicable
Grievance Officer - Nasir Islam, Founder & Head | consult@zealvert.com | +91 6393680341
Nodal Person of Contact - Nasir Islam, Founder & Head | consult@zealvert.com | +91 6393680341