ON – APP DATA: –

The On-App Data collected by ImpactCraft has 3 important elements.

• Internal Data: Internal Data means and includes the operating data such as business adoption data, financial data, survey data, conversation transcripts, error / bug databases / messages, tickets data etc. collected by us from within the Platform / Application being used by the Clients / Users.
• External Data: External Data means and includes the data collected by us through subscriptions to multiple Third-Party API services to gather certain public domain information like news, social media, press releases, website scans, investor reports etc.
• Communication Data: Communication Data means and includes the data collected by us through the conversations, correspondence, and communications between our Clients / Users and their Customers.

1. Internal Data:

On the Platform / Application, we receive certain operating data from Clients / Users. For example, on our platform, Clients / Users may enter / record information about their customers and their personnel (collectively “Stakeholders”) like Email addresses, phone number(s), date of birth etc. For example, you may share business adoption data, financial data, survey data, conversation transcripts, error / bug databases / messages, tickets data, any other data you decide to input / provide / supply us with etc. ImpactCraft is committed to maintaining the security, confidentiality and privacy of this data and we use commercially acceptable means to secure the same. We create a separate dedicated database for each of our Clients / Users (SaaS entity), to maintain security and privacy of their and their customer’s data.

• In case the Platform / Application / database is hosted on ImpactCraft systems, the data is securely stored in the database / drives hosted in commercial cloud environment (Microsoft / Amazon Web Services / Google / Pinecone etc.) dedicated for the particular Client / User in the ImpactCraft systems, with restricted access provided on ‘need to know basis’, with individuals at ImpactCraft who are bound by confidentiality and non-disclosure obligations under contracts. ImpactCraft does not use this data or share this data with third parties, affiliates or anyone outside ImpactCraft, except for availing / using API of third-party entities (for example, Large Language Model (LLM) providers such as OpenAI) for providing services to the Clients / Users. To maintain security of the databases, ImpactCraft uses technology like Docker or other similar technology, and the database port access is controlled and is accessible only to the application using it. ImpactCraft personnel do not have access to this data except system administrator who is bound by confidentiality and non-disclosure obligations under contracts.
• In case the Platform / Application / database is hosted on the Client’s systems / cloud servers / premises, where security and access to the database is controlled by the Client / User, the Client shall have complete responsibility and control for security of the database / Application. The security of the database / Application shall be as per Client’s systems, technology, and privacy policy. ImpactCraft will have a specific / restricted access to manage the Application / database and shall maintain the privacy and confidentiality of data through restricted access provided on ‘need to know basis’, to individuals at ImpactCraft who are bound by confidentiality and non-disclosure obligations under contracts. ImpactCraft does not share this data with third parties, affiliates or anyone outside ImpactCraft.

2. External Data:

We subscribe to multiple Third-Party API services to gather certain public domain information like news, social media, press releases, website scans, investor reports We protect data obtained from third parties according to the same security practices used for Internal Data described in this Policy, plus any additional restrictions imposed by the source of the data. We use Large Language Model (LLM) hosted services like OpenAI, or for Vector databases, third-party solutions like Pinecone are used.

3.Communication Data:

We use communication data from Client’s / User’s conversations with their customers, which is collected through the specific / restricted access granted to ImpactCraft by the Client / For example, email communication data. We are integrated with Microsoft and Google email along with Single Sign On (SSO), and we will also integrate with direct messaging platforms, call transcripts or similar platforms / technology, as may be required and authorized. In addition, to security practices used for Internal Data described in this Policy above, ImpactCraft also uses encryption technology to safeguard this data in storage. ImpactCraft understands that confidentiality and security of all communication data including any Personally Identifiable information is extremely critical. Therefore, only ImpactCraft can read this data through its software / program to provide insights to the Clients / Users, but no ImpactCraft personnel except the system administrator can read or access this data, and he is bound by the confidentiality obligations under contracts. Impact Craft provides two levels of security for such data: –

1. Databases are secure and access is provided only to administrators using the protocols outlined herein above.
2. All communication data including any PII information in the communication is encrypted and before being stored in the database. ImpactCraft administrators or any other human cannot read or interpret this data.
3. Our Platform / Application does not use any data obtained through Google Workspace APIs or Microsoft Office365 APIs for developing, improving, or training generalized AI or ML models. The data accessed through the APIs is used strictly for its intended purpose, such as Single Sign-On (SSO) authentication and analysing email messages as part of our core functionality to help our users to perform their job effectively.

Although we have implemented adequate technical, organizational, and security measures designed to reduce the risk of unauthorized disclosure or access, accidental destruction or loss of personal data/information, we cannot guarantee that the information will not be exposed as a result of unforeseeable unauthorized access / penetration of our systems / servers. While ImpactCraft takes all necessary and reasonable measures to protect the data provided by the Clients / Users and makes required arrangements for prevention of any breach of security, we also recommend our Clients / Users should be aware of potential risks and decide what data to share.