Dial — Privacy Policy
Version 2026-11 · Effective: [date of public beta]
This policy explains how Dial handles personal data, under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 as they come into force, and the Information Technology Act, 2000 and rules under it.
1. Who we are
The Data Fiduciary is [Legal entity name], [registered address], India ("Dial", "we"). Contact for anything in this policy: [privacy email].
[Data Protection Officer — needed only if Dial is notified as a Significant Data Fiduciary: [Name, email].]
2. Whose data this covers
- Users: people with a Dial account who place calls.
- People called: staff of businesses and anyone else who answers a Dial call, whose words appear in transcripts.
- People named in a brief: for example a family member whose appointment a user is booking.
3. What we collect
| Data | From | Notes |
|---|---|---|
| Account: name, email, sign-in identifiers, terms version accepted, preferences (language, how the agent introduces you) | you, via our sign-in provider | |
| Briefs: the number called, what the call is for, details you allow the agent to share, limits, answers you give during a call | you, usually via your AI assistant or the web app | may include personal data of other people (§6) |
| Transcripts of both sides of the call, call events (status, menu choices, hold time), summary and outcome | generated during the call | written text only |
| Wallet and payments: balance, ledger, top-up amounts, PayU transaction IDs and status | you, PayU | we never see or store card numbers, CVV or UPI PIN |
| Technical: IP address, device/browser data, API key usage, logs, connected AI clients | automatically | |
| Support and complaints | you, people called |
No audio recording. Dial does not record or store call audio. Audio is streamed in real time to our speech-recognition and voice providers to run the call and is not kept by us.
We do not ask for and you must not provide OTPs, card numbers, Aadhaar or PAN. If such data appears in a transcript we [mask recognisable patterns before storing].
4. Why we use it (purposes)
- To place your calls and give you the summary, outcome and transcript (performance of the service you request).
- To ask you questions during a call and notify you (email, web approval page).
- To charge your prepaid wallet, process top-ups and refunds, and keep accounts for tax.
- To keep the service safe and lawful: checking briefs before calls, blocking prohibited uses, rate limits, honouring "do not call me" requests, investigating complaints and abuse. Our operators may read transcripts of calls that are flagged or complained about.
- To fix faults and improve call quality (aggregated metrics; [and reviewed transcripts — decide]).
- To meet legal obligations and respond to lawful requests from authorities.
We rely on your consent, given when you accept these terms and this policy, for purposes 1–3 and 5, and on legitimate uses under section 7 of the DPDP Act for purposes 4 and 6 where they apply. You can withdraw consent at any time (§9); we will then stop placing calls for you and delete your data as described in §8. We do not sell personal data and do not use it for advertising.
5. Notice at the time of collection
The sign-up and terms page shows a short notice and links to this policy, in English and [Hindi; other languages of the Eighth Schedule on request], as the DPDP Rules require.
6. Data of people who are not our users
People called. When a business answers a Dial call, the agent states that it is an AI assistant calling on behalf of a named user. What the person says is transcribed and stored with the user's call so the user can see what was agreed. We use it only for that call, safety and complaints. A person called can:
- ask the agent, or write to [privacy email], that their number not be called again (we add it to a "never call" list for all users);
- ask us to delete or correct their words in a transcript, by giving the date, time and number called. We may keep what is needed to handle a complaint or a legal claim.
People named in a brief. Users must only share another person's details when they are entitled to (for example, with that person's permission) and only what the call needs.
7. Who we share it with (sub-processors)
We use these processors to run Dial. They act on our instructions under contracts that limit their use of the data.
| Processor | What for | Data | Location |
|---|---|---|---|
| Vobiz | telephone network: placing calls, call status | phone numbers, call audio in transit | India |
| Sarvam AI | speech recognition and voices for Indian languages | call audio in transit, text to be spoken | India |
| Google (Gemini API) | AI language model during calls; summaries, safety checks | brief, transcript text | [India / outside India — confirm region] |
| [Other speech/AI providers enabled by operators, e.g. Deepgram] | [as configured] | [audio/text in transit] | [location] |
| WorkOS | sign-in (AuthKit) | name, email, sign-in events | United States |
| PayU | payments | payment and transaction data, name, email, phone if provided | India |
| Google Cloud Platform | hosting, database, backups | all data in this policy | India (asia-south1, Mumbai) |
| [Email provider] | notification emails | name, email, message content | [location] |
We may also disclose data when the law requires it, to a court or authority with a lawful demand, or to protect people from harm. If the Dial business is transferred, data moves with it under this policy.
8. How long we keep it
- Call logs and transcripts are kept until you delete them (each call, or all of them, in the web app), or until you close your account. They have no automatic expiry, so you can look back at past calls.
- When you delete a call or your account, we delete the data from our live database [within 7 days]. Encrypted database backups are kept for 35 days and then deleted, so deleted data disappears from backups within that time.
- Wallet ledger and payment records are kept for 8 years as required by tax and accounting law, with call content removed.
- Server logs are kept for up to 30 days.
- If you are inactive for [3 years], we may contact you and then close the account (the DPDP Rules require erasure when the purpose is no longer served).
- We keep data for longer only when required by law or for a pending complaint or legal claim.
9. Your rights
Under the DPDP Act you can:
- Access: get a summary of your personal data and how we process it, and the identities of processors we shared it with (the web app shows your calls and transcripts; ask for the rest).
- Correction and completion: fix your account details; ask us to correct data that is wrong.
- Erasure: delete calls or your whole account in the web app, or ask us at [privacy email].
- Withdraw consent at any time, as easily as you gave it. This does not affect calls already placed.
- Nominate another person to exercise your rights if you die or become incapable: [how — form in the web app or email].
- Grievance redressal: complain to our Grievance Officer (§12), and if not satisfied, to the Data Protection Board of India.
We respond to requests within [the period set in the DPDP Rules, at most 90 days]. We may need to verify your identity. You must not file false or frivolous complaints or impersonate someone else when making a request.
10. Children
Dial is for adults (18+). We do not knowingly create accounts for children. If you believe a child has an account, write to [privacy email] and we will delete it.
11. Security and breaches
Data is encrypted in transit (TLS) and stored on Google Cloud in India. Provider credentials are encrypted at rest. Access is limited to authorised operators and logged. Backups go to a private bucket our server can write to but not read or delete. If a personal data breach happens, we will inform the Data Protection Board and affected users as the DPDP Act and Rules require, and CERT-In where required.
12. Grievance Officer
[Name], [designation], [Legal entity name], [address] · [email] · [phone] We acknowledge grievances within [48 hours] and resolve them within [the period required by law].
13. Transfers outside India
Most processing happens in India. Some processors (§7) process data outside India, such as sign-in in the United States and [AI model calls, depending on region]. The DPDP Act allows this except to countries the Government restricts by notification; we will stop using any such country if one is notified.
14. Changes
We will post changes here with a new version number and tell you in the web app or by email before they apply. Material changes may require you to accept the policy again.