What the DPDP Act requires
The Digital Personal Data Protection Act 2023 governs how Indian businesses collect, process, store, and share personal data — including phone numbers, voice recordings, and conversational transcripts. Outbound AI calling falls squarely within scope.
Key obligations for outbound callers:
- Lawful basis for processing — you need consent or a legitimate interest to call. Cualify enforces this through your contact list upload flow.
- Recorded consent — every call must open with a disclosure ("This call is recorded for quality and training"). Cualify's default playbooks include this line.
- DND respect — calls to numbers on TRAI's NCPR (National Customer Preference Register) are prohibited. Penalties up to ₹2L/incident.
- Data subject rights — customers can request to see their data, correct it, delete it, or take it to another provider. You must respond within 30 days.
- Data residency — sensitive personal data should be processed in India where feasible. Cualify hosts everything in Supabase Mumbai.
- Data Protection Officer (DPO) — required for "significant data fiduciaries" (large operators). SMBs need a designated grievance officer.
How Cualify helps
1. Calling-window enforcement
Every call dispatch passes through a TRAI compliance gate. Calls outside 09:00 – 21:00 IST are rejected before any provider is invoked, regardless of customer preference. Holidays and Sunday afternoons can be configured per-campaign.
2. DND and opt-out checks
Before a campaign dials a number, Cualify checks it against its DND list and against contacts in your org marked do-not-contact, and skips any match. Cualify does not yet receive a live NCPR feed, so this is not a full NCPR scrub — keep scrubbing your lists against NCPR as your DLT registration requires.
3. Consent disclosure on every call
All system playbook templates open with a recorded-consent line. When you write your own playbook prompt, Cualify reminds you to include one if you're missing it (the prompt validator checks before publishing).
4. Recording + transcript retention policy
By default, call recordings are retained for 90 days and transcripts for2 years. PII redaction (names, account numbers, OTPs) runs on every transcript automatically. You can request shorter retention for sensitive use cases — email privacy@cualify.in.
5. Customer data export + delete
End-customer rights (your customer asking you for their data): you can export everything Cualify has for a specific phone number from Settings → Compliance within seconds. Hard delete is also one-click — we wipe recordings, transcripts, and ledger entries within 30 days of the request.
6. Data residency in Mumbai
All customer data — contacts, recordings, transcripts, ledger entries — lives in Supabase's Mumbai region (AWS ap-south-1). Cross-border processing only happens for the LLM inference call itself (OpenAI), and we send only the agent prompt + utterance — never your contact list, never your CRM data.
What you (the customer) still own
Cualify is a data processor under DPDP terms. You're the data fiduciary. That means:
- You decide who to call (Cualify enforces compliance but doesn't pick numbers)
- You're responsible for upstream consent (where did the contact come from?)
- You respond to data subject requests (forwarded to you if they reach Cualify)
- You appoint your own grievance officer + post their contact on your website
Our DPA (Data Processing Agreement) covers the responsibility split formally — sign it on the dashboard once you're on a paid plan.
Sub-processors we use
Cualify's data path touches the following sub-processors:
- Exotel — Telephone carrier that places and receives calls on our numbers and streams their audio to our voice runtime.
- Fly.io — Hosts our voice runtime, which runs each conversation between the phone line and the speech and language models.
- Supabase — Managed Postgres database that stores the application's records, and the storage that holds call recordings.
- Vercel — Hosts the website, dashboard, API and background jobs, and stores the business-verification documents you upload.
- Inngest — Background job queue that dispatches campaigns, sets up calls and runs scheduled tasks.
- GitHub — Runs the nightly database backup and stores each backup for 30 days.
- OpenAI — Language model that writes the agent's replies during a call, and summarises the call afterwards.
- Sarvam AI — Speech-to-text and text-to-speech during calls, in Hindi, English and other Indian languages.
- Clerk — Sign-in, sessions, team invitations and organisation membership.
- Razorpay — Payments for plans and credit packs.
- Resend — Transactional email, contact-form messages and the newsletter.
- PostHog — Product analytics for the website and dashboard.
- Google Analytics (Google LLC) — Website analytics: where visitors come from and which pages they view.
- Sentry — Error monitoring.
- Pusher — Live updates in the dashboard.
- Setu — Checks your GSTIN against the GST registry during onboarding.
Full sub-processor list, with the data each one receives: /legal/sub-processors.
If a regulator audits you
From Settings → Compliance you can pull, within minutes:
- Every call placed in the last 7 years with metadata
- Consent disclosure verbatim text
- Recording retention status per call
- Data subject rights requests + how they were resolved
Common questions
Do I need DLT registration?
Yes, for SMS templates and for outbound calls under transactional / service categories. See our DLT handoff guide.
What if my customer says "stop calling me"?
Mark the contact do-not-contact (do_not_contact: true via the contacts API). Every future call skips that number, on every list and through the API. Record the request in your CRM for audit.
Are AI-generated voices "personal data"?
No — the synthesised voice itself isn't personal data (it's generated). But the underlying conversation transcript and recording IS — covered by retention + redaction policies above.