Privacy policy

This policy explains what personal data SyncTalk collects, why, where it is kept, who can see it, how long it stays, and what you can ask us to do with it. It is written under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and it uses those laws’ words where they matter.

1. Who this covers, and which role we play

Two different groups of people are described here, and the law treats them differently.

• Account holders and their teams — the business that signs up for SyncTalk, the people it adds as users, and anyone who contacts us through this website. For this data SyncTalk is the Data Fiduciary: we decide why and how it is processed, and we are answerable to you for it.
• Callers, contacts and message recipients — the customers of that business whose calls, WhatsApp messages and SMS pass through the account. They have no agreement with us. For this data the business is the Data Fiduciary and SyncTalk is its Data Processor: we process it only on the business’s instructions, for the business’s purposes, and we return or delete it when the business tells us to. Requests from these individuals are handled by the business; if one reaches us directly we pass it to the business and help it respond.

2. What we collect

When a business signs up. The name, work email address and phone number of the people who use the account; the business’s legal name, GSTIN, address and the documents Indian telecom rules require before a phone number can be issued — typically the GST certificate, proof of incorporation, address proof and the authorised signatory’s identity document. The identity document is sensitive personal data under the 2011 Rules and is handled as described in section 6.

From every call. The calling and called numbers, when the call started and ended, how long it lasted, which team member it was routed to and what happened at each step of the journey, its cost, and connection-quality measurements. Where recording is on, the audio of answered calls.

From WhatsApp and SMS. The numbers on each end, the message content, delivery status and timestamps, and the templates used. WhatsApp traffic passes through Meta’s WhatsApp Business Platform and is also subject to Meta’s terms.

From the voice AI agent, only if the business turns it on. The agent has to understand speech to work, so while it is handling a call the audio is converted to text, answered by a language model, and turned back into speech. The transcript of the agent’s part of the call and a short summary per caller are kept in the business’s workspace so the agent can recognise a returning caller. Calls handled by a person are not transcribed.

From the business’s contacts. Names, phone numbers, tags, locations and notes the business enters about the people who contact it.

From this website. If you use the contact form or the stack builder: your name, business name, work email, role, GSTIN, phone number, the capabilities you selected, your message, and any campaign parameters on the address you arrived through. We also keep the time the form was opened and submitted, which is how we tell a person from a bot.

Automatically. Server logs with the IP address, browser and pages requested, kept for security and to meet the log-retention direction issued by CERT-In (section 7). This website sets no advertising or analytics cookies and loads no third-party trackers.

3. What we do not do

• We do not sell, rent or share personal data with advertisers or data brokers.
• We do not use call, message or transcript content to train any model, ours or a provider’s.
• We do not transcribe or analyse calls handled by people. Only the AI agent’s own calls are transcribed, and only when the business has switched the agent on.
• We do not process data about children knowingly. The service is for registered businesses and their staff.
• We do not read a business’s workspace for our own purposes. Staff access is limited to support and is logged (section 5).

4. Why we process it, and on what basis

Under the DPDP Act every purpose needs a lawful basis. Ours are:

• To provide the service you asked for — routing calls and messages, showing you what happened on each one, running the automations you configure. Basis: the account holder’s consent, given at sign-up, and the contract between us.
• To issue and keep an Indian phone number — the verification documents are required by the Department of Telecommunications and the carrier before a number can be allotted. Basis: a legal obligation.
• To bill you and keep accounts — usage, invoices and GST records. Basis: the contract, and the record-keeping obligations of tax law.
• To keep the service secure — access logs, security monitoring, and the incident reporting the law requires. Basis: legal obligation and our legitimate use in protecting the service and its users.
• To reply when you contact us. Basis: you volunteered the data for that purpose.

We use personal data for no purpose other than the one it was collected for. If we ever need to use it for something new, we will ask first.

5. Who can see it

Every business has its own workspace. Separation is enforced inside the database itself — the rules that decide what a signed-in person may read are checked by the database on every query, not only by the application in front of it. One business cannot read another’s records, and a fault in a screen cannot return the wrong workspace’s data.

Within a business, access follows the role the business assigns: an agent sees their own calls, a manager sees the team’s, an owner sees everything including billing.

Outside the business, personal data reaches exactly these parties:

• The telecom carrier that connects calls and delivers SMS. It must have the numbers on each end to do so.
• Meta, for WhatsApp, which carries the messages on its own platform under its own terms.
• Our hosting and database provider, which stores the data on our behalf under contract.
• Speech-recognition, speech-synthesis and language-model providers, and only for calls handled by the voice AI agent, only while the call is in progress, and only when the business has enabled the agent. Some of these providers operate outside India.
• Government authorities, where the law requires it and only to the extent it requires. Where we are permitted to, we will tell the affected business.
• SyncTalk staff, only to investigate a problem you have raised or a security event. Every such access is written to an audit log that cannot be edited by the person making the access.

Each of these parties is bound by a written contract that limits what it may do with the data to what we have instructed. A current list of the providers we use is available to any account holder on request.

6. Where it is stored, and transfers outside India

The database and stored files, including call recordings and verification documents, are hosted in the Singapore region of our cloud provider. The DPDP Act permits personal data to be transferred outside India except to countries the Central Government restricts by notification; Singapore is not so restricted at the date of this policy. If the Government restricts a location we use, we will move the affected data within the time the notification allows.

Verification documents are sensitive personal data. They are held in private storage that is not publicly addressable, reachable only through a link that expires shortly after it is issued, and only by the owner of the workspace and staff acting on a support request.

7. How long we keep it

• Call recordings — for the retention period the business sets in its settings (90 days unless changed). A job runs every night and deletes anything older. Deleted means deleted, not archived.
• AI agent transcripts and caller summaries — for as long as the business keeps the agent enabled, and removed with the workspace when the account closes.
• Call and message records, invoices — for the period tax and telecom law require us to keep them, which is currently the longer of the licence conditions and the eight-year period the Income Tax Act contemplates for accounts.
• Server and access logs — 180 days, as directed by CERT-In under section 70B of the IT Act.
• Accounts, contacts and settings — until the business closes the account, then deleted, other than what we must retain by law.
• Website enquiries — up to 24 months, or sooner if you ask.

Under the DPDP Act we must also erase personal data once its purpose is served or when consent is withdrawn, unless a law requires us to keep it. Where a law does, we keep only what that law names, and only for as long as it says.

8. Recording calls: the business’s responsibility

Recording of answered calls is on by default and the business can switch it off at any time. Telling callers that a call may be recorded, and obtaining any consent the law applicable to the business requires, is the business’s obligation as Data Fiduciary for its callers. The greeting is the place to say it, and the business controls the greeting.

9. Your rights

If you are an account holder or a member of a team, or you contacted us through this website, the DPDP Act gives you the right to:

• Access — a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Correction and completion — of anything that is inaccurate or out of date.
• Erasure — deletion of your data, unless a law requires us to keep it, in which case we will say which law and what it covers.
• Withdrawal of consent — at any time, as easily as it was given. Withdrawing consent for the data the service needs will mean closing the account.
• Grievance redressal — a response from us within the time the rules set, and if you are not satisfied, a complaint to the Data Protection Board of India.
• Nomination — of a person to exercise these rights for you if you die or are incapacitated.

Make a request through the contact page. We will confirm your identity, respond within 30 days, and if we cannot do all of what you asked, tell you plainly which part we cannot do and why.

If you are a caller, contact or message recipient of a business that uses SyncTalk, send your request to that business; it holds your data and decides what happens to it. If you send it to us we will forward it and assist, but we cannot act on it without the business’s instruction.

10. Grievance Officer

The 2011 Rules and the DPDP Act require us to publish the details of a person who answers questions and complaints about personal data.

The Grievance Officer’s name and email will be published here once our company registration completes. Until then, grievances sent through the contact page reach the same person and are handled on the same timeline: acknowledgement within 48 hours, a substantive reply within 30 days.

11. Security and breaches

The measures that protect this data — workspace isolation enforced in the database, an encrypted vault for carrier credentials, expiring links for recordings and documents, role-based access, and logged staff access — are described in full in our data security policy.

If a breach affects your personal data we will notify the Data Protection Board of India and each affected person as the DPDP Act and its rules require, report the incident to CERT-In within the six hours its directions allow, and tell you what happened, what was affected and what we are doing about it — without waiting to have a tidy story.

12. Changes

If we change this policy materially we will email account holders before the change takes effect and give a reasonable time to object or close the account. The date at the top is always the date of the current version.