Privacy Policy
Draft — last edited 14 September 2026
This is a starting draft, not legal advice. It describes what this codebase
actually stores and who it shares data with, so a reviewing lawyer has an accurate
starting point — but it has not been reviewed against DPDP, GDPR, or any other
specific privacy law, and should be before you rely on it.
1. What we store
For each company workspace, the Service stores:
- Account data — email address, a bcrypt hash of your password (never the password itself), and your workspace name
- Connected credentials — your Twilio and AI provider keys, encrypted at rest (Fernet) and never displayed back to you in full once saved
- Contacts — phone numbers and any other columns you upload in a CSV (name, order details, etc.)
- Call records — the phone number called, call duration, an AI-generated summary and outcome classification, and the full conversation transcript
- Configuration — your agents, campaigns, FAQs, and settings
2. Who we share it with
Data is shared only with the third-party services you have configured, to make the
Service work:
- Twilio — placing and receiving calls. Twilio processes the audio of each call.
- Your chosen AI provider (Groq, OpenAI, or your own Ollama server) — receives the conversation transcript to generate replies and classify outcomes. If you use Ollama on your own server, this data never leaves your infrastructure.
- Brevo — sends account emails (verification, password reset, team invites), only if configured.
- Razorpay — processes plan payments, only if configured.
We do not sell contact lists, call transcripts, or account data to third parties.
3. Multi-tenancy and data isolation
Every record is scoped to your company workspace. The application enforces this on
every request — one workspace's data is never returned in another workspace's
queries, invoices, exports, or dashboards.
4. How long we keep data
Call records, contacts, and configuration are kept for as long as your account
exists. Deleting your account from Settings permanently removes every record tied
to your company — agents, campaigns, contacts, calls, transcripts, invoices, and
stored credentials — with no recovery period. This action cannot be undone.
5. Team members
When you invite a team member, they can see the same company data you can — calls,
contacts, campaigns, and billing history for your workspace. Only the workspace
owner can change the subscription plan, remove members, or delete the account.
6. Security measures
- Third-party API keys (Twilio, Groq, OpenAI) are encrypted at rest and only decrypted server-side when placing a call
- Passwords are hashed with bcrypt, never stored or logged in plain text
- Sessions are signed cookies; login and password-reset links expire
- Incoming Twilio webhooks are verified against Twilio's signature before being acted on
7. Your rights
You can view and correct your account data from Settings at any time. You can
export your call history as a CSV from Call History. You can permanently delete
your account and all associated data from Settings.
8. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.
9. Contact
Questions about this policy can be sent to the contact address on your account.