Privacy Policy

Cualify Technologies LLP is the Data Fiduciary for personal data we collect about you (our Customer) and our Data Processor role applies to personal data of your end-recipients processed through the Services. Our registered office is in Mumbai, Maharashtra, India.

Our Data Protection Officer is contactable at dpo@cualify.in for any privacy concern, DPDP rights request, or grievance.

When you use Cualify as a Customer, we collect:

• Account data — name, work email, phone, organisation name, billing address, GSTIN, PAN where required for tax invoicing
• Authentication data — login session tokens (via Clerk), MFA factors
• Usage data — campaigns, call records, transcripts, recordings, credits debited, dashboard interactions
• Telemetry — IP address, device and browser type, error logs, pages viewed in your browser (linked to a pseudonymous cookie identifier; see section 10), and product milestones our servers record against your account, such as creating an agent or completing a payment

When your AI agent makes a call to an end-recipient, we process on your behalf:

• Phone number and any contact metadata you provided
• Voice recording and transcript of the call
• Captured consent (the disclosure played in the first five seconds, plus the recipient's response)
• Call outcome, intent labels, and sentiment indicators

We process Customer personal data on the lawful basis of performance of contract (running your account, delivering the Services). We process end-recipient personal data on the lawful basis of consent — captured and stored by you, the Data Fiduciary. You represent that valid consent has been collected before any number is dialed through Cualify.

• Postgres database (account, billing, ledger, campaigns) — Mumbai (ap-south-1)
• Voice recordings + transcripts — Mumbai object storage, AES-256 at rest
• Email transactional logs (Resend) — EU region; only delivery metadata, not call content
• Product analytics (PostHog) — EU region; pseudonymous identifiers, plus your account email once you sign in
• Website analytics (Google Analytics, Google LLC) — Google's servers, including outside India; pseudonymous identifiers only, advertising features off
• Backup snapshots — Mumbai region only, retained for 30 days

No call content, contact lists, or recordings leave Indian soil.

We share data only with the sub-processors listed at /legal/sub-processors. Each sub-processor is bound by contract to the same protection standards as this Policy. We do not sell personal data, ever.

Under the DPDP Act 2023, you have the right to:

• Access — confirm whether we hold your personal data and obtain a copy
• Correction — fix inaccurate data
• Erasure — request deletion when the data is no longer necessary
• Withdraw consent — stop processing where consent is the basis
• Grievance redressal — escalate to the DPO if a request is not handled correctly
• Nominate — designate another person to exercise your rights in case of incapacity

Submit any of the above through the in-app DSR inbox (Settings → Privacy) or by emailing dpo@cualify.in. We respond within 30 days. If you are dissatisfied with our response, you may complain to the Data Protection Board of India.

• Recordings — default 90 days, configurable per plan up to 1 year (Scale)
• Transcripts — same window as recordings, plus 30 days for redacted backup copies
• Account data — for the lifetime of the account, plus 7 years for tax compliance under Indian law
• Telemetry and error logs — 90 days, then aggregated

• Encryption at rest — AES-256 (Postgres, recordings, transcripts)
• Encryption in transit — TLS 1.3 on every connection
• Multi-tenant isolation — Postgres Row-Level Security with org-scoped predicates verified by automated tests
• Access controls — SSO + MFA mandatory for all staff; role-based access to production data; quarterly access reviews
• Audit trail — all admin actions logged immutably; reviewed monthly
• Penetration testing — annual third-party pentest once revenue exceeds ₹10 lakh MRR

Essential cookies keep you signed in (Clerk) and protect the Services. They are needed for the site to work and cannot be switched off.

Analytics cookies, which you can decline:

• PostHog (product analytics, EU-hosted) — a cookie holding a random identifier, shared across cualify.in and app.cualify.in so a visit and a later sign-up count as one person. Once you sign in we link it to your account.
• Google Analytics (Google LLC) — the _ga cookies, holding a random client identifier, used to measure traffic sources and page views. Google signals and advertising features are off, and Google's advertising storage and personalisation consent signals are always set to denied.
• cualify_ft — a first-party cookie recording how you first reached us (campaign tags, the referring site's name and the landing page, never full URLs), kept for up to 90 days and attached to your workspace if you sign up.

Analytics is on unless you decline it in the cookie banner or later under Cookie settings in the site footer; a cualify_consent cookie remembers your choice for six months. We treat a browser's Global Privacy Control signal as a decline. Declining stops both tools in your browser and deletes their cookies. It does not stop the product milestones our servers record against your account (section 2), which describe your use of the Services rather than your browsing. We do not use advertising cookies.

Cualify is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have, contact the DPO and we will erase it.

We update this Policy when laws, sub-processors, or material practices change. Material updates are emailed at least 30 days before the effective date. Earlier versions are available from the Data Protection Officer on request.

Email: dpo@cualify.in. Postal mail: Data Protection Officer, Cualify Technologies LLP, Mumbai, Maharashtra, India. We acknowledge within 48 hours and respond within 30 days.