Legal
Privacy Policy
Template, needs legal review.
This document is a draft for counsel to review. Items marked [TO BE CONFIRMED] are not final and must be completed before this page is relied on.
Last updated: [TO BE CONFIRMED: effective date]Operated by: [TO BE CONFIRMED: legal entity name] ("IndiaCalling.ai", "we", "us"), [TO BE CONFIRMED: entity type and cin], registered office at [TO BE CONFIRMED: registered address]. IndiaCalling.ai is a product of AIBootstrapper ([TO BE CONFIRMED: relationship to legal entity]).
This policy explains how we handle personal data when you visit www.indiacalling.ai, book a demo, or use our AI voice-calling platform. It is written to align with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it.
1. Two different roles: fiduciary and processor
We act in two different capacities. Which one applies depends on whose data it is.
A. We are the Data Fiduciary for:
- Visitors to our website (usage data, cookies, forms).
- People who contact us or book a demo (name, company, phone, work email, monthly lead volume, notes).
- Our customers' account users (login details, billing and contact information, support history).
B. We are a Data Processor for the lead and call data our customers load into the platform. This includes lead lists, CRM data, phone numbers of prospects, call recordings, transcripts, call outcomes and qualification answers. Our customer (a real estate developer, broker or other business) decides why and how that data is used and is the Data Fiduciary. We process it only on the customer's documented instructions under our agreement with them ([TO BE CONFIRMED: dpa reference]).
If you are a person who received a call from an AI agent that we operate for a customer, the business that called you is your primary point of contact for exercising your rights. Please contact that business first. You can also write to us (section 11) and we will pass your request to the relevant customer and help them respond.
2. What we collect
Data you give us: name, company, phone number, work email, monthly lead range, free-text notes, and anything you share in a demo call.
Data collected automatically: pages viewed, device and browser type, approximate location, referring page, and interaction events such as clicks on "Book Demo". We use Google Analytics 4 for this. [TO BE CONFIRMED: any other trackers]
Data processed for customers (as processor): prospect phone numbers and names, lead source, enquiry details, voice recordings of calls, transcripts, language, sentiment and call outcome, and booked site-visit details.
We do not knowingly collect personal data of children (under 18) for our own purposes. Customers must not upload data of children for calling, except as permitted by law.
3. Why we use personal data and on what basis
| Purpose | Data | Basis under the DPDP Act |
|---|---|---|
| Respond to demo and pricing requests, schedule calls | Form and booking data | Consent given by submitting the form; legitimate use where you voluntarily provide data for a stated purpose |
| Provide, secure and support the platform | Account data, usage logs | Performance of our contract; consent |
| Website analytics and improvement | Cookie and device data | Consent (via cookie banner, [TO BE CONFIRMED: cookie banner tool]) |
| Billing, tax and legal compliance | Billing data | Legal obligation |
| Place calls, record and transcribe them for customers | Prospect and call data | Customer's instruction as Data Fiduciary; we act as processor |
We do not sell personal data.
4. Call recording and AI disclosure
Calls placed through our platform are recorded and transcribed so that customers can review outcomes, and so that quality and compliance can be audited. Our customers are responsible for giving call recipients notice and obtaining consent to recording. We configure the agent to announce at the start of the call that it is an AI assistant and that the call is recorded, where the customer enables this ([TO BE CONFIRMED: default disclosure script]). A recipient may ask the agent to stop recording or stop calling at any time, and the request is logged and passed to the customer.
5. Who we share data with
- Our customers, for data they own.
- Service providers (sub-processors) that help us run the service, under written contracts: cloud hosting ([TO BE CONFIRMED: hosting provider and region]), telephony and carrier partners ([TO BE CONFIRMED: telephony partners]), speech and language-model providers ([TO BE CONFIRMED: ai model providers]), analytics (Google Analytics 4), scheduling (Calendly), website hosting (Vercel). A current list is available on request at [TO BE CONFIRMED: subprocessor list url].
- Authorities, where required by law or a valid legal order.
- Successors, in a merger or sale, subject to this policy.
6. Transfers outside India
Some providers may process data outside India. Under the DPDP Act, transfers are permitted except to countries the Central Government restricts by notification. We will not transfer data to any restricted country. Customers who need India-only processing should ask us about [TO BE CONFIRMED: india residency option].
7. Retention
| Data | Retention |
|---|---|
| Demo and enquiry form data | [TO BE CONFIRMED: enquiry retention period] |
| Account and billing records | [TO BE CONFIRMED: billing retention period], or as required by tax and company law |
| Call recordings and transcripts (customer data) | [TO BE CONFIRMED: recording retention days] days by default, or as set by the customer; deleted or returned when the customer ends the contract ([TO BE CONFIRMED: post termination window]) |
| Web analytics data | [TO BE CONFIRMED: analytics retention period] |
We erase personal data when its purpose is served or consent is withdrawn, unless law requires us to keep it.
8. Your rights
Under the DPDP Act you have the right to: access a summary of personal data processed and the identities of those it is shared with; correct, complete or update it; have it erased; withdraw consent as easily as it was given; nominate another person to exercise your rights if you die or become incapacitated; and have your grievance redressed.
Where we are the Data Fiduciary, write to us (section 11). We aim to respond within [TO BE CONFIRMED: response days] days. Where we are the processor, we will forward your request to the customer who controls the data.
9. Security and breach response
We use access controls, encryption in transit [TO BE CONFIRMED: whether data is also encrypted at rest], audit logging and role-based access. If a personal data breach occurs, we notify affected customers without undue delay and cooperate with their obligations to inform the Data Protection Board of India and affected individuals as required by law. [TO BE CONFIRMED: breach sla hours]
10. Cookies
We use cookies and similar technologies for analytics. You can accept or reject non-essential cookies in the banner and change your choice at any time via [TO BE CONFIRMED: cookie settings link]. Blocking cookies does not stop you using the site.
11. Grievance Officer and contact
In line with the DPDP Act and the Information Technology Act, 2000, our Grievance Officer is:
Name: [TO BE CONFIRMED: grievance officer name]Designation: [TO BE CONFIRMED: grievance officer designation]Email: [TO BE CONFIRMED: grievance email]Address: [TO BE CONFIRMED: registered address]Response time: acknowledgement within [TO BE CONFIRMED: ack hours] hours, resolution within [TO BE CONFIRMED: resolution days] days.
If we do not resolve your complaint, you may approach the Data Protection Board of India as provided under the DPDP Act, once the Board is functional.
General privacy queries: [TO BE CONFIRMED: contact email (domain mailbox)].[TO BE CONFIRMED: data protection officer if significant data fiduciary]
12. Changes
We may update this policy. Material changes will be posted here with a new "Last updated" date and, where required, notified to you.
13. Governing law
This policy is governed by the laws of India. Subject to any rights you have under the DPDP Act, courts at [TO BE CONFIRMED: city], India have jurisdiction.