DPDP Act Compliance

Voiceyfy answers phone calls on behalf of Indian businesses, which means we handle personal data belonging to their customers. This page explains how we do that under the Digital Personal Data Protection Act, 2023.

Who plays which role

When you use Voiceyfy to answer your business calls, you are the Data Fiduciary for your customers' data. Voiceyfy acts as a Data Processor: we process call audio, transcripts, names, phone numbers and booking details on your instructions and for no other purpose. Your callers are Data Principals and hold the rights set out below.

For the account information you give us directly, such as your business name, billing contact and login details, Voiceyfy is the Data Fiduciary.

Where your data lives

Call recordings, transcripts, contact records and booking history for Indian accounts are stored in data centres located in India. Backups stay in India as well. Data is encrypted in transit using TLS and at rest using AES-256.

Some subprocessors used for speech recognition and language modelling may process content outside India. Where that happens, transfers are limited to what the service requires, covered by contractual safeguards, and never used to train third-party models on your data. A current list of subprocessors is available on request from Email usmoc.aidniyfyeciov@aidni.

Consent and call notice

Recording a call requires the caller to know it is happening. Every Voiceyfy account can enable a spoken notice at the start of a call stating that the conversation is handled by an AI assistant and may be recorded for quality and record keeping. We strongly recommend leaving this on, and it is enabled by default on new accounts.

For outbound calling and WhatsApp messaging, consent is your responsibility as the business initiating contact. Voiceyfy enforces do-not-disturb list checks and honours opt-out requests automatically, but you must have a lawful basis for contacting the person in the first place.

Rights of the people we hold data about

Under the DPDP Act, a Data Principal may ask for:

• Confirmation of whether their personal data is being processed
• A summary of that data and of the processing activities
• Correction of inaccurate or incomplete data
• Erasure of data that is no longer needed
• The identity of anyone the data has been shared with
• Nomination of another person to exercise these rights on their behalf

If a caller contacts Voiceyfy directly with one of these requests, we will forward it to the business whose number they called, because that business decides what happens to the data. If you are a Voiceyfy account holder and need help acting on a request, our team will retrieve, correct or delete the records for you.

How long we keep things

• Call recordings and transcripts: retained for the period you configure, up to 12 months by default, then deleted
• Contact and booking records: retained for as long as your account is active
• Account and billing records: retained for eight years after account closure, as required by Indian tax law
• Everything else: deleted within 90 days of account closure

You can shorten the retention window or delete specific records at any time from your dashboard, and you can export your data before you leave.

Security measures

• Encryption in transit and at rest
• Role-based access control, with staff access limited to what their job requires
• Audit logging of access to call recordings and customer records
• Regular vulnerability scanning and third-party penetration testing
• Documented incident response process

If something goes wrong

In the event of a personal data breach, we notify affected account holders and the Data Protection Board of India as the Act requires, without undue delay, with the facts we have at the time and what we are doing about it.

Getting in touch

Questions about this page, requests to exercise your rights, or requests for our subprocessor list and data processing agreement can go to Email usmoc.aidniyfyeciov@aidni. If you are not satisfied with our response, our Grievance Officer is the next step, and you may also approach the Data Protection Board of India.