KoltrixPrivacy Policy
What we collect, why, who else sees it, how long we keep it, and what you can make us do about it.
Last updated
1. Who we are
Koltrix is operated by NVS Ventures, a sole proprietorship registered in India, in Bengaluru, India. For the personal data of the people who sign up for Koltrix, we are the controller (the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023).
For the contents of the mail in your workspace — which is mostly other people's personal data — you are the controller and we are your processor. That relationship is governed by our Data Processing Addendum.
2. What we collect
Account data
Your name, email address, a hashed password (or the identifier from the identity provider you signed in with), your workspace name and logo, and the domains and addresses you configure.
Email content
The messages sent to and from your workspace: headers, subjects, bodies and attachments. We store them because that is the product. They live in a PostgreSQL schema belonging to your workspace alone, with attachments in our object storage.
Usage and technical data
IP addresses of requests, browser and device information, timestamps, error reports, and counters we need to enforce plan limits (how much you have sent, stored and used AI for).
Payment data
We do not see or store your card. Dodo Payments processes payments as merchant of record and gives us the subscription status, the plan, and an invoice record.
Support correspondence
What you write to us, so we can answer it.
3. Why we process it, and on what basis
| What | Why | GDPR basis |
|---|---|---|
| Account and email data | To provide the service you asked for | Performance of a contract |
| Usage counters | To enforce plan limits and bill correctly | Performance of a contract |
| IP addresses, rate-limit records | Security, abuse prevention, spam control | Legitimate interests |
| Spam scoring and classification | To keep unwanted mail out of your inbox | Performance of a contract |
| AI summaries and drafts | A feature you switch on and can switch off | Performance of a contract; you may disable it |
| Product analytics on our website | To see which pages help people | Consent, where required |
| Service operation, diagnostics and improvement (aggregated, without message content) | To keep Koltrix reliable, fix faults and decide what to build | Legitimate interests |
| Account, usage and payment records | To enforce our terms, prevent fraud and abuse, and establish or defend legal claims | Legitimate interests; legal obligation |
| Invoicing and tax records | Because the law requires us to keep them | Legal obligation |
Under the DPDP Act our basis is your consent, or the “legitimate uses” the Act allows — principally providing a service you have voluntarily asked for.
4. AI features, stated plainly
When AI is enabled for your workspace, some of your email content leaves our servers. We would rather say this in bold than have you discover it later.
- Classification and spam scoring send the headers, the subject and a truncated body to OpenRouter (TypeSafe's Jev model).
- Summaries and drafts send the same to OpenRouter (Google Gemini and DeepSeek models).
- Attachments are never sent to an AI provider. Quoted history is stripped before a body is sent, and the body is truncated.
- We instruct each provider not to use your content to train models and, where a provider offers a no-training or no-retention option, we use it. We choose providers for their published data terms, but how a provider handles data is governed by its own terms, which we do not control.
- You can turn AI off for the entire workspace in settings. Sorting then uses our own spam engine and no message content leaves our infrastructure.
5. Who else sees your data
Only the service providers we need to run Koltrix, each listed with its purpose on our subprocessors page. We do not sell personal data, we do not share it for advertising, and we do not use the contents of your mail to market to you.
We will disclose data if we are legally required to, or where we reasonably believe it is necessary to comply with a court order or lawful request, to enforce our terms, to protect the security of the service or the rights, property or safety of Koltrix, our customers or others, or to investigate fraud or abuse. Where we are permitted to tell you first, we will.
If Koltrix or its business is sold, merged or transferred, your data may transfer to the successor, who will be bound by this policy or must give you notice of any change.
We may also use aggregated, de-identified information, which does not include message content and cannot reasonably identify you, to operate and improve the service.
6. Where your data lives
Our servers are operated by OVHcloud in Frankfurt, Germany (European Union). We are based in India, so our staff access data from India; where that is a transfer out of the EEA or the UK, it is made under the European Commission's standard contractual clauses, included in our Data Processing Addendum.
7. How long we keep it
- Email: for as long as your workspace exists, unless you delete it. Deleted mail sits in Trash for thirty days and is then removed.
- A workspace you delete: recoverable for 7 days, then deleted.
- A lapsed workspace: read-only after the 7-day trial or a failed renewal, then deleted 30 days later, after three warning emails.
- Invoices and tax records: as long as Indian tax law requires, currently eight years.
- Security and abuse logs: up to 12 months.
- Backups: where we keep backups, copies of deleted data can persist in them until they are overwritten in the normal cycle.
We may keep information for longer where we reasonably need it to comply with the law, resolve a dispute, enforce our agreements, or prevent fraud and abuse.
8. Your rights
Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send it to you in a portable form. The export tool in your workspace does the last one without asking us.
If the GDPR applies to you, you also have the right to restrict or object to processing, to withdraw consent at any time, and to complain to your national supervisory authority.
If the DPDP Act applies to you, you have the right to access, correction and erasure, the right to nominate someone to exercise your rights if you die or become incapacitated, and the right to a grievance redressal process — which starts by writing to the address below. If we do not resolve it, you may complain to the Data Protection Board of India.
Write to [email protected]. We answer within 30 days, usually much sooner. We may ask you to confirm who you are first. Where a request is manifestly unfounded or excessive, or repeated, the law lets us charge a reasonable fee or decline it, and we will say so. We can decline a request to the extent an exemption applies, for example where we must retain data by law or need it to defend a legal claim.
If your data is in a Koltrix workspace because someone emailed that workspace, we are the processor and they are the controller — we will pass your request to them and help them answer it.
9. Grievance officer
For the purposes of the DPDP Act and India's Information Technology rules, our grievance officer can be reached at [email protected], NVS Ventures, Bengaluru, India.
10. Children
Koltrix is not for children. We do not knowingly collect data from anyone under 18, and we will delete it if we find it.
11. Security
Each workspace gets its own database schema, sessions expire, API keys are stored hashed and scoped, traffic is encrypted, and mail leaves DKIM-signed. The detail — including what we do not have — is on our security page.
12. Cookies
See our cookie notice. This marketing site sets no advertising cookies and no third-party trackers.
13. Changes
We may update this policy. We will post the new version here with a new date and, for anything material, email the workspace owner at least 14 days before it takes effect. Continuing to use Koltrix after that date means you accept the updated policy. This policy forms part of our Terms of Service, including their limits on liability and their dispute-resolution terms, to the extent the law allows.
14. Contact
[email protected] for privacy, [email protected] for everything else.