Privacy Policy

Last updated: May 15, 2026  ·  Effective immediately

This Privacy Policy applies to personal data processed by KAITALK ("KAI", "we", "us") in connection with our AI customer care service. This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

1. Data Fiduciary

Under the DPDP Act, KAITALK is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.

2. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, KAITALK has designated a Grievance Officer to address concerns and complaints from Data Principals (users).

3. Personal Data We Collect

• Account data: name, email address, business name, business phone number.
• Call data: caller phone number, city, country, AI-generated voice transcription, AI response text, call duration, timestamp.
• Payment data: subscription plan, billing history processed by Stripe (we do not store raw card data).
• Usage data: anonymous visitor identifier (with consent only), language preference, UTM campaign parameters.
• Contact form data: name, email, phone number, business name submitted via enquiry or demo request forms.

4. Purpose and Consent

Under the DPDP Act, we process personal data only for specific, clearly stated lawful purposes, and we obtain free, informed, specific, and unambiguous consent where required.

Purposes for which we process your data:

• Providing the KAI virtual customer care service (AI call handling).
• Creating and managing your account, including magic-link authentication.
• Processing payments and managing your subscription.
• Displaying call logs and analytics in your dashboard.
• Sending transactional communications (service alerts, billing notices).
• Basic usage analytics to improve the service (consent-based).
• Compliance with applicable laws and legal obligations.

We will not process your personal data for any purpose not listed above without obtaining fresh consent or establishing another lawful basis.

5. Consent Notice

Before or at the time of collecting personal data, we provide a clear notice describing:

• What personal data is being collected.
• The purpose for which it will be used.
• How and where it will be stored or transferred.
• Your rights as a Data Principal under the DPDP Act.
• How to withdraw consent and the consequences of doing so.

Consent for non-essential data (analytics, marketing) is collected through the cookie consent banner on your first visit. Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

6. Data Fiduciary Obligations

As a Data Fiduciary under the DPDP Act, KAITALK commits to:

• Purpose limitation: processing data only for stated, lawful purposes.
• Data minimisation: collecting only what is necessary for the stated purpose.
• Accuracy: taking reasonable steps to ensure data accuracy.
• Storage limitation: retaining data only as long as necessary for the purpose.
• Security safeguards: implementing appropriate technical and organisational measures to protect personal data from breach, loss, or unauthorised access.
• Breach notification: notifying the Data Protection Board of India and affected Data Principals in the event of a personal data breach, as required by the DPDP Act.

7. Call Recording and Voice Processing

Calls handled by KAI are processed by AI to generate automated responses. Voice transcriptions are generated automatically and stored for up to 24 months for service delivery, quality control, and dispute resolution.

Callers are informed at the beginning of each call. If you do not wish your voice to be processed, you may end the call at any time.

8. Cross-Border Data Transfers

KAITALK uses third-party service providers located outside India. These transfers are made in compliance with Section 16 of the DPDP Act, which permits transfer to countries notified by the Government of India, or subject to contractual clauses ensuring equivalent protection. Our key sub-processors are:

• Twilio Inc. (USA) — telephony infrastructure and call processing.
• OpenAI / Polsia AI Proxy (USA) — AI response generation.
• Stripe Inc. (USA) — payment processing.
• Render Services Inc. (USA) — application hosting.
• Neon Technologies — PostgreSQL database hosting.

We contractually require all sub-processors to maintain data protection standards equivalent to those required under the DPDP Act. We do not sell your personal data to any third party.

9. Retention Periods

• Call records and transcriptions: 24 months from the date of the call.
• Account data: for the duration of your account, plus 90 days after closure.
• Session tokens: 30 days, auto-expiring.
• Magic link tokens: 30 minutes, discarded after single use.
• Lead and form data: 24 months or until erasure is requested.

Data is securely deleted or irreversibly anonymised upon expiry of the retention period.

10. Security Measures

• HTTPS/TLS encryption for all data in transit.
• AES-256-GCM encryption for stored OAuth tokens and credentials.
• Session-based access controls with httpOnly cookies.
• HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).
• Isolated execution environments for AI processes (no access to production credentials).
• Continuous security monitoring and automated incident alerting.

12. Data Protection Board of India

The DPDP Act establishes the Data Protection Board of India as the adjudicatory body for data protection matters. Once fully operationalised, individuals may file complaints with the Board where grievances are not resolved by the Data Fiduciary. We will update this policy with the Board's contact details when officially published by the Government of India.

13. Children's Data

KAITALK is a business-to-business service intended exclusively for companies and professionals. We do not knowingly collect personal data of individuals under 18 years of age. If you believe a minor's data has been collected inadvertently, please contact our Grievance Officer for immediate deletion.

14. Cookies and Tracking

• kai_session (httpOnly, secure cookie): authentication session. Essential for service operation.
• kai_lang (localStorage): language preference. Non-essential.
• polsia_vid (localStorage): anonymous visitor ID for analytics. Non-essential, set only after explicit consent.

No Meta Pixel or third-party tracking scripts are loaded without your prior consent.

15. Changes to This Policy

We may update this policy periodically. Material changes will be notified to registered users by email or via a prominent notice on the website. The updated policy takes effect 15 days after publication.

16. Contact

• Grievance Officer: contact@kaitalk.online
• Data rights request form: /dsr