Privacy Policy

1. Introduction

Leafworks Dynamics Private Limited (“Cravv”, “we”, “us”, or “our”), a company incorporated under the Companies Act, 2013, having Corporate Identification Number U28299KA2025PTC205908 and registered office in Bangalore, Karnataka, India, operates the Tara cooking companion device (“Device”) and the associated mobile application (the “App”), together with related websites, services, and software (collectively, the “Services”).

This Privacy Policy describes how we collect, use, store, share, and protect your information when you use the Services. By creating an account, installing the App, pairing the Device, or otherwise using the Services, you agree to the practices described in this Policy.

This Policy is published in compliance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and the privacy and data handling requirements of the Apple App Store and Google Play Store.

2. Scope and Applicability

This Policy applies to all users of the Services worldwide. It governs:

• Personal information collected through the App and the Device, including voice input, camera-derived data, and thermal sensor data;
• Account, billing, and support interactions with Cravv;
• Information collected from our websites, marketing channels, and customer communications; and
• Information processed by third-party service providers acting on our behalf.

Where local law provides greater protection than this Policy, that law will prevail to the extent of any conflict.

3. Information We Collect

We collect the categories of information described below. We collect only what is necessary to operate, secure, and improve the Services.

3.1 Information You Provide

• Account information: name, email address, phone number, password, and country of residence.
• Profile and preference information: dietary preferences, cuisine preferences, allergens, household size, and skill level.
• Payment information: billing name, billing address, and payment method details (processed by our payment processors; we do not store full card numbers).
• Communications: messages, support tickets, survey responses, and feedback you submit to us.

3.2 Information Generated by the Device and App During Cooking

• Voice input: audio captured when you address Tara using its wake word or activation control. Audio may be processed locally on the Device or sent to our servers (or third-party speech providers acting on our behalf) for recognition and response.
• Camera-derived data: the Device’s downward-facing camera captures images of the cooking surface and pan contents in order to identify ingredients, monitor cooking progress, and provide guidance. Where technically feasible, image analysis is performed on the Device, and only derived signals (such as ingredient labels, doneness scores, or event flags) are transmitted to our servers. We do not stream raw video to our servers for routine cooking operation.
• Thermal sensor data: temperature readings from the cooking surface and contents, used to provide real-time guidance and safety alerts.
• Cooking session data: recipes selected, steps completed, timings, outcomes, ratings, and notes.
• Device telemetry: firmware version, hardware identifiers, error logs, connectivity status, and diagnostic data.

3.3 Information Collected Automatically

• App usage data: screens viewed, features used, session length, and crash reports.
• Technical data: IP address, device model, operating system version, mobile network information, and approximate location derived from IP.
• Cookies and similar technologies: used on our websites and within in-app web views for authentication, preferences, and analytics.

3.4 Information from Third Parties

• Authentication providers: if you sign in using Apple, Google, or another identity provider, we receive basic profile information from that provider.
• Analytics and crash reporting providers: aggregated and pseudonymous usage data.
• Marketing and referral partners: information you choose to share through promotions or referrals.

3.5 Sensitive Information

Voice recordings and images of your kitchen are sensitive by nature. We process them strictly to deliver the Services, with the minimisation, storage, and access controls described in Sections 5 and 8. We do not use voice or image data for advertising. We do not sell voice or image data to any third party.

3.6 Children

The Services are intended for users aged 18 and above. We do not knowingly collect personal information from children under 13 (or under the equivalent minimum age in your jurisdiction, such as 16 under GDPR or as notified under the DPDP Act). If you believe a child has provided us with personal information, contact us at the address in Section 14 and we will delete it.

4. How We Use Your Information

We use the information described above for the following purposes:

• Service delivery: to register your account, authenticate you, pair and operate the Device, deliver real-time cooking guidance, recognise ingredients, monitor temperature, manage timers, and respond to voice commands.
• Personalisation: to suggest recipes, adapt guidance to your skill level, and remember preferences and dietary restrictions.
• Safety: to detect unsafe cooking conditions (overheating, unattended heat, ignition risk) and surface alerts.
• Product improvement: to debug, improve recognition models, fix issues, and develop new features. Where we use voice or image data for model improvement, we use only de-identified or aggregated data, and we provide an opt-out as described in Section 7.
• Communications: to send transactional messages (order confirmations, shipping updates, security alerts) and, with your consent where required, marketing communications.
• Customer support: to respond to your requests and resolve issues.
• Legal and compliance: to comply with applicable laws, enforce our Terms, prevent fraud and abuse, and respond to lawful requests from public authorities.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• Performance of a contract: to provide the Services you have requested.
• Legitimate interests: to secure the Services, improve product performance, and prevent fraud, balanced against your rights and freedoms.
• Consent: for marketing communications and, where required, for use of voice and image data for model improvement. You may withdraw consent at any time.
• Legal obligation: to comply with laws, regulatory requirements, and lawful requests.

6. How We Share Your Information

We do not sell your personal information. We share information only as described below:

6.1 Service Providers

We share information with vendors who process data on our behalf, including cloud infrastructure providers, speech recognition and synthesis providers, analytics providers, payment processors, customer support tools, and shipping and logistics partners. These vendors are bound by contract to use information only to perform services for us.

6.2 Affiliates and Successors

We may share information with our affiliates, or with a successor entity in connection with a merger, acquisition, financing, reorganisation, sale of assets, or bankruptcy. In any such transaction, your information will continue to be protected under this Policy or a successor policy substantially similar to it.

6.3 Legal and Safety

We may disclose information if we reasonably believe it is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms; to protect the rights, property, or safety of Cravv, our users, or others; or to detect, prevent, or address fraud, security, or technical issues.

6.4 With Your Direction

We share information with other parties when you direct us to do so, for example when you connect a third-party integration or share content from the App.

7. Your Choices and Controls

• Microphone and camera: you can disable the Device’s microphone and camera using the physical controls on the Device. When disabled, voice and image-based features will not function.
• Voice and image data for product improvement: you can opt out in the App’s privacy settings. Opting out does not affect operation of the Services.
• Marketing communications: you can unsubscribe via the link in any marketing email or by updating your preferences in the App.
• Account deletion: you can delete your account from within the App or by contacting us. We will delete or de-identify your personal information within the timelines set out in Section 9, subject to legal retention requirements.
• App permissions: you can manage location, notifications, microphone, and camera permissions for the App through your phone’s operating system settings.

8. How We Protect Your Information

We use administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit using TLS, and encryption at rest for sensitive datastores;
• Role-based access controls and the principle of least privilege for employees and contractors;
• Network segmentation, monitoring, and intrusion detection;
• Regular vulnerability assessments and security reviews; and
• Vendor security due diligence and contractual data protection obligations.

No system is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

9. Data Retention

We retain personal information only for as long as necessary for the purposes set out in this Policy, unless a longer retention period is required by law. Typical retention periods are:

• Account data: for the life of your account, plus up to 90 days after deletion for backup and recovery purposes.
• Voice recordings sent to our servers: retained for up to 30 days for quality and debugging, then deleted or de-identified, unless you have opted into longer retention for model improvement.
• Image-derived signals: retained for the duration of the cooking session and for diagnostic windows of up to 90 days.
• Cooking session metadata: retained for the life of your account so that you can revisit your cooking history.
• Transaction records: retained for the periods required by tax, accounting, and consumer protection laws (typically 7 years in India).
• Support and communications: retained for up to 3 years after closure of the matter, unless a longer period is required.

10. International Data Transfers

Cravv is headquartered in India and operates globally. Your information may be processed in, and transferred to, India, the United States, the European Economic Area, and other jurisdictions in which we or our service providers operate.

Where we transfer personal information out of the EEA, the UK, or Switzerland, we use approved transfer mechanisms such as the European Commission’s Standard Contractual Clauses, the UK Addendum, or other lawful safeguards. Where required under the DPDP Act, transfers will comply with rules notified by the Central Government.

11. Your Rights

Subject to applicable law, you have the following rights:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Erasure: request deletion of your personal information, subject to legal retention requirements.
• Restriction or objection: ask us to restrict processing or object to processing based on legitimate interests.
• Portability: receive your information in a structured, machine-readable format.
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting prior lawful processing.
• Nominate (DPDP Act): nominate another individual to exercise your rights in case of death or incapacity.
• Lodge a complaint: with the Data Protection Board of India, your local supervisory authority in the EEA/UK/Switzerland, or another competent regulator.

To exercise these rights, contact us using the details in Section 14. We will respond within the timeframes required by applicable law.

11.1 California Residents

If you are a California resident, the CCPA/CPRA gives you the rights described above and additionally the rights to know the categories of personal information collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom the information is shared. You also have the right not to receive discriminatory treatment for exercising your rights. We do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.

12. Third-Party Services and App Stores

The App is distributed through the Apple App Store and Google Play Store. Your download and use of the App is also subject to Apple’s and Google’s respective privacy policies and platform terms. Information collected by Apple or Google directly through their platforms is not governed by this Policy.

The App may link to or integrate with third-party services. Those services are governed by their own privacy policies. We are not responsible for the privacy practices of third parties.

13. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you through the App, by email, or by another reasonable means before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the revised Policy.

14. Contact Us

If you have questions, requests, or complaints about this Policy or our handling of your information, contact us:

We will acknowledge your grievance within the timelines prescribed by applicable law and respond to it within 30 days, or such shorter period as may be required.

This document is a template prepared for review and should be finalised in consultation with qualified legal counsel before publication.