KOVA Privacy Policy

KOVA is the internal operations platform built for and used by Three Zee Agro Tech (TZAT), an agricultural machinery dealership. This Privacy Policy describes what information KOVA collects, how that information is used, and the third-party integrations KOVA relies on to operate. KOVA is not offered as a public service; access to KOVA requires an account provisioned by a Three Zee Agro Tech administrator.

1. What information KOVA may collect

KOVA stores only the operational information that TZAT staff enter or generate while running the business. This includes:

• Staff accounts — name, email address, role, and a securely hashed password for KOVA login.
• Customer records — name, contact number(s), address, village, block, district, state, and other agricultural-dealership fields entered by TZAT staff.
• Sales, service, subsidy, machine, follow-up and product records — the business documents TZAT staff create for their own dealership operations.
• Interaction and timeline records — notes, call outcomes and status changes recorded by TZAT staff during customer engagement.
• Backup metadata — timestamps and file identifiers for the database backups KOVA creates.

KOVA does not collect information from visitors who are not signed in. KOVA does not use tracking cookies for advertising and does not sell information to third parties.

2. How information is used

The information stored in KOVA is used solely to run the day-to-day operations of Three Zee Agro Tech: managing customers and inventory, generating invoices, tracking service jobs, running subsidy workflows, scheduling follow-ups, and sending operational communication (for example, service reminders) to customers who have provided contact details for that purpose. Aggregate dashboards (revenue, top customers, pending payments) are computed from this same data and shown only to signed-in staff with the appropriate role.

3. Data storage and security

KOVA data is stored in a managed MongoDB database dedicated to Three Zee Agro Tech. Access is protected by authenticated sessions with role-based permissions; passwords are stored as one-way hashes. Deleted records are soft-deleted and remain recoverable only by administrators via the Trash view. Every write operation is scoped to the signed-in user identity and is subject to KOVA's permission matrix.

4. Third-party services and integrations

KOVA integrates with a small number of external services in order to operate:

• Google Drive — for storing encrypted database backups. See section 5 below for the exact scope KOVA requests.
• Twilio — for sending SMS and WhatsApp follow-up reminders to customers who have provided a mobile number, only when a TZAT staff member explicitly triggers the message.
• Product analytics (PostHog) — used only to help TZAT understand which internal screens their own staff use. No customer records are transmitted to this service.

KOVA does not share the information it stores with any third party other than the operational services listed above, and only to the minimum extent required for those services to function.

5. Google Drive access for KOVA backups

KOVA uses Google OAuth 2.0 to obtain permission from the Three Zee Agro Tech administrator to upload database backup files to that administrator's own Google Drive. This is an opt-in configuration — KOVA will not connect to Google Drive unless the administrator explicitly runs the one-time OAuth bootstrap and provides the resulting credentials to KOVA.

The Google Drive scope KOVA requests is:

This is Google's per-file, non-sensitive scope. Under this scope KOVA can only see and manage the files and folders it has itself created — specifically the KOVA/Backups/ folder tree that KOVA generates for its own backup archives. KOVA cannot see, list, download or modify any other file already present in the administrator's Google Drive, and cannot access other Google Workspace data (Gmail, Calendar, Contacts, Photos, etc.).

The credentials KOVA receives from Google (a client identifier and a refresh token belonging to the administrator) are stored only in KOVA's server-side environment configuration and are never displayed, logged, or transmitted anywhere other than to Google's own OAuth endpoints for the purpose of refreshing short-lived access tokens.

6. User control and revocation of Google access

The Three Zee Agro Tech administrator can revoke KOVA's access to their Google Drive at any time, and control is entirely in their hands:

• Visit https://myaccount.google.com/permissions and remove "KOVA" from the list of connected apps. Backups will stop uploading to Drive immediately; already-uploaded files remain in the administrator's Drive and are unaffected.
• Alternatively, an administrator can remove the KOVA OAuth secrets from KOVA's server configuration. On the next KOVA restart, Drive uploads will simply be skipped.
• In either case, KOVA continues to create local backup files even when Google Drive access is not configured.

7. Data retention

KOVA retains operational records for as long as they are useful to running the Three Zee Agro Tech dealership. Individual records can be soft-deleted by an authorised staff member and are then permanently removable from the Trash view by an administrator. Backup archives stored in Google Drive follow the retention policy configured by the TZAT administrator; older backups can be deleted directly from that administrator's Google Drive at any time.

8. Contact information

For any question about this Privacy Policy, about how KOVA handles information, or to request removal of specific records:

9. Changes to this Privacy Policy

This Privacy Policy may be updated when KOVA introduces new integrations or changes how information is used. The "Last updated" date at the top of this page will always reflect the most recent revision.