Korufu is operated by a limited liability partnership registered in India. This policy explains what personal data we collect when you use the Korufu website and services, why we collect it, and the choices you have.
Korufu ("we", "us", "our") is the data fiduciary responsible for personal data processed through Korufu. We are registered under the Limited Liability Partnership Act, 2008 and operate from India.
This policy applies to the Korufu website, the private beta of the Korufu platform, and any communication you have with us about them.
We collect only what we need to run the service and respond to you.
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, work email, company, role | You, when you request access or write to us |
| Account data | Login credentials, workspace settings, team membership | You, when you join the beta |
| Research inputs | Study briefs, questions, documents and datasets you upload to build or run simulations | You and your organisation |
| Usage data | Pages viewed, features used, approximate location from IP, device and browser type | Collected automatically |
| Correspondence | Emails, support requests, feedback | You |
Research inputs may contain personal data about your customers or respondents. Where they do, you remain responsible for having a lawful basis to share that data with us, and we process it only on your instructions as described in Section 4.
We rely on your consent where the law requires it, and otherwise on the legitimate use of data needed to provide a service you have asked for. We do not sell personal data, and we do not use your research inputs to train models made available to other customers.
When your organisation uploads research, survey responses or customer data to build a market model, your organisation is the data fiduciary for that data and we act as a data processor on its behalf. We:
Synthetic respondents generated by Korufu are statistical constructs. They are not real individuals and no simulation output is intended to identify a real person.
We share personal data only with:
Some of our service providers are located outside India. Where personal data is transferred across borders we take steps required under applicable law to protect it, including contractual safeguards.
The Korufu website uses only the cookies and local storage strictly necessary for it to work and, where enabled, privacy-respecting analytics to understand aggregate traffic. The platform uses cookies to keep you signed in and remember your preferences. You can control cookies through your browser settings; disabling essential cookies may stop parts of the service from working.
We keep personal data only for as long as needed for the purposes above. Account data is kept while your account is active and for a short period afterwards to allow reactivation. Research inputs are kept for the term of your agreement unless you delete them sooner. Correspondence is kept for as long as reasonably needed to handle your request and any follow-up. We may retain some data longer where the law requires it, for example for tax or dispute purposes.
We use administrative, technical and physical safeguards appropriate to the sensitivity of the data we hold, including encryption in transit and at rest, access controls and logging. No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.
Under the Digital Personal Data Protection Act, 2023 and other applicable laws, you may have the right to:
If you are in the European Economic Area, the United Kingdom or another jurisdiction with its own data protection law, you may have additional rights, including the right to object to or restrict processing and to data portability. To exercise any right, write to the contact in Section 1. We will respond within the time required by applicable law.
In line with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, we have designated a grievance officer to address concerns about personal data.
We aim to acknowledge grievances promptly and resolve them within the timelines required by law.
Korufu is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy from time to time. When we do, we will change the "last updated" date above and, for material changes, notify account holders by email or through the product. Continued use of Korufu after a change takes effect means you accept the updated policy.
Questions about this policy can be sent to the contact details in Section 1. See also our Terms of Use.