Privacy Policy

1. Who we are, and who is responsible for what

Dialora AI ("we") runs AI agents that answer and place phone calls, and chat on a website widget and on WhatsApp, for businesses. Each business has its own workspace.

This notice is written for India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025, notified on 13 November 2025. The Rules bring their obligations into force in phases over 18 months. This page describes what the service does today.

We hold two kinds of personal data, and our role is different for each.

• Your account with us. If you sign up, or a colleague adds you to a workspace, we decide why and how your account data is used. For that data we are the Data Fiduciary.
• The people a workspace contacts. A workspace brings in its own leads and customers, and calls or messages them. The workspace decides why and how that data is used, so it is the Data Fiduciary. We are its Data Processor: we act on its instructions, keep the data secure, and delete it when told to.

2. What we collect

About account holders and their team members

• Name, email address and password. The password is stored as a one-way hash. If you sign in with Google, we receive your name and email from Google instead.
• If you turn on two-step sign-in: the key your authenticator app shares with us, stored encrypted, and your recovery codes, stored as one-way hashes. If you ask for a password reset link, the time you asked.
• Your role in the workspace, and the workspace's settings.
• The plan bought, the amount, the date and the payment gateway's reference. Card and bank details are entered on the gateway's own checkout and do not reach our servers.
• Usage: calling minutes and similar counts, kept for billing and plan limits.
• Keys for services the workspace connects, such as Twilio or a model provider. These are encrypted at rest and shown masked.
• Server logs of requests and errors.

About a workspace's customers, processed for that workspace

• Contact records the workspace imports or the agent captures: name, phone number, email and any other fields the workspace adds.
• Calls: time, duration, outcome, the recording if the workspace has recording switched on, the transcript, and the AI summary and analysis of the call.
• Chats on the website widget and on WhatsApp, and answers to any survey the workspace runs in them.
• Appointments and callback requests.
• Consent records, do-not-call entries, and the record of each decision to dial or not to dial.
• Whether a person agreed to receive WhatsApp updates from the workspace, how and in what words, and which broadcasts they were sent.
• Photos, documents and voice notes a person sends on WhatsApp. Voice notes are transcribed. The files themselves are not copied to our servers: they stay with WhatsApp and are fetched only when a team member opens one.

3. Why we use it

• To run the service for the workspace: place and answer calls, hold chats, book appointments, and show the workspace its own records.
• To bill for plans and measure usage against plan limits.
• To keep accounts secure and to investigate misuse.
• To answer support and data requests.
• To meet legal duties, including honouring do-not-call requests.

We do not sell personal data. We do not use it for advertising. We do not train models on call or chat content. The providers listed in section 6 handle data under their own terms.

4. AI disclosure on calls

Every call an agent makes or answers opens with a spoken statement that the caller is an automated AI assistant. If recording is on, it also says the call may be recorded. The statement is available in 11 languages: English, Hindi, Gujarati, Marathi, Tamil, Telugu, Bengali, Kannada, Malayalam, Punjabi and Urdu. It is added unless the workspace's own opening line already says so, and there is no setting that removes it.

If you do not want to be called again, say so on the call, reply STOP on WhatsApp, or use the opt-out on the link the business sent you. Your number goes on that workspace's do-not-call list. An opt-out you made yourself is checked before every dial, and no workspace setting switches that check off. Only a workspace admin can take it off the list, with a written reason that is kept on record.

5. How long data is kept

• Recordings, transcripts and chats. Each workspace sets its own period for each, from 7 to 3,650 days, or chooses to keep them until it deletes them. Keeping them is the default. The setting is applied every six hours.
• Erasure on request. A workspace can erase everything it holds about one person. Three things stay, because the request or the law needs them: the number stays on the do-not-call list so the person is not called again; the call's duration and outcome stay for billing, no longer linked to the person; and the record of compliance decisions stays with the number replaced by a keyed code.
• Legal hold. A workspace can place a hold on a contact, with a reason. A held contact is not erased or purged until the hold is lifted.
• Account data. Kept while the account is open. To close an account, write to the contact in section 7.
• Backups. We take backups of the database. They are not yet on a deletion schedule, so data erased from the live service can remain in older backups. We are bringing backups under a retention schedule and will state the period here once it is in force.
• Server logs. Some log lines contain phone numbers, and logs are not yet deleted on a fixed schedule. We are masking the numbers and adding one.

6. Services that data passes through

These are the services the software calls. Which of them see a given person's data depends on what the workspace has connected. Where we could not confirm a provider's processing location, the table says it may be outside India.

A workspace that uses its own SIP trunk sends calls through its own carrier instead of Twilio. A workspace can also send events to its own systems by webhook; those systems are the workspace's responsibility.

7. Your rights under the DPDP Act

You can ask to:

• know what personal data is held about you and get a copy of it;
• have it corrected or brought up to date;
• have it erased;
• withdraw a consent you gave;
• name another person to act for you;
• have a complaint dealt with.

Requests for access, correction, updating or erasure are answered within 90 days.

If a business called or messaged you through Dialora AI, contact that business first. It holds your data and decides what to do with it, and the workspace has the tools to find, export and erase your records. We help it respond. If you do not know which business it was, write to us with the number that contacted you and the date, and we will try to identify the workspace and pass your request to it.

If you hold an account with us, write to the contact below.

If you are not satisfied with the answer, the DPDP Act lets you take the complaint to the Data Protection Board of India.

8. How we protect data

• Keys and secrets a workspace stores with us are encrypted at rest and shown masked.
• Passwords are stored as one-way hashes.
• Access inside a workspace is by role. Exporting or erasing a person's data needs the admin role.
• Sign-in sessions can be revoked.
• Any account can require a code from an authenticator app after the password.
• Webhooks we send are signed so the receiver can check they came from us.
• Each export, erasure, legal hold, retention change and purge is written to the workspace's compliance log.
• The site is served over HTTPS with a content security policy.

We hold no SOC 2, ISO 27001 or similar certificate. No system is free of risk. If a personal data breach affects your data, we will tell the affected workspaces and, as the DPDP Act requires, the affected people and the Data Protection Board.

9. Cookies and browser storage

This site sets no advertising or analytics cookies, so there is no cookie banner. When you sign in, your session token and a few display preferences are kept in your browser's local storage. The token is removed when you sign out. A payment gateway may set its own cookies on its own checkout.

10. Children

Dialora AI is a service for businesses. We do not knowingly open accounts for anyone under 18, and the service is not meant for contacting children. If you believe a child's data has reached us, write to the contact in section 7.

11. If you are outside India

Laws such as the GDPR in the EU and UK, or the CCPA in California, may give you further rights. Send the request to the same contact. A workspace that calls people in another country remains responsible for that country's consent and calling rules.

12. Changes to this notice

When we change this notice we change the date at the top of the page. This version is an engineering draft that describes what the software does. It has not yet been reviewed by counsel, and the wording may change after that review.