Privacy Policy

Cualify Technologies LLP is the Data Fiduciary for personal data we collect about you (our Customer) and our Data Processor role applies to personal data of your end-recipients processed through the Services. Our registered office is in Mumbai, Maharashtra, India.

Our Data Protection Officer is contactable at [email protected] for any privacy concern, DPDP rights request, or grievance.

When you use Cualify as a Customer, we collect:

• Account data — name, work email, phone, organisation name, billing address, GSTIN, PAN where required for tax invoicing
• Authentication data — login session tokens (via Clerk), MFA factors
• Usage data — campaigns, call records, transcripts, recordings, credits debited, dashboard interactions
• Telemetry — IP address, device type, error logs, product analytics events (cookieless)

When your AI agent makes a call to an end-recipient, we process on your behalf:

• Phone number and any contact metadata you provided
• Voice recording and transcript of the call
• Captured consent (the disclosure played in the first five seconds, plus the recipient's response)
• Call outcome, intent labels, and sentiment indicators

We process Customer personal data on the lawful basis of performance of contract (running your account, delivering the Services). We process end-recipient personal data on the lawful basis of consent — captured and stored by you, the Data Fiduciary. You represent that valid consent has been collected before any number is dialed through Cualify.

• Postgres database (account, billing, ledger, campaigns) — Mumbai (ap-south-1)
• Voice recordings + transcripts — Mumbai object storage, AES-256 at rest
• Email transactional logs (Resend) — EU region; only delivery metadata, not call content
• Product analytics (PostHog) — EU region; cookieless, no PII
• Backup snapshots — Mumbai region only, retained for 30 days

No call content, contact lists, or recordings leave Indian soil.

We share data only with the sub-processors listed at /security#sub-processors. Each sub-processor is bound by contract to the same protection standards as this Policy. We do not sell personal data, ever.

Under the DPDP Act 2023, you have the right to:

• Access — confirm whether we hold your personal data and obtain a copy
• Correction — fix inaccurate data
• Erasure — request deletion when the data is no longer necessary
• Withdraw consent — stop processing where consent is the basis
• Grievance redressal — escalate to the DPO if a request is not handled correctly
• Nominate — designate another person to exercise your rights in case of incapacity

Submit any of the above through the in-app DSR inbox (Settings → Privacy) or by emailing [email protected]. We respond within 30 days. If you are dissatisfied with our response, you may complain to the Data Protection Board of India.

• Recordings — default 90 days, configurable per plan up to 1 year (Scale)
• Transcripts — same window as recordings, plus 30 days for redacted backup copies
• Account data — for the lifetime of the account, plus 7 years for tax compliance under Indian law
• Telemetry and error logs — 90 days, then aggregated

• Encryption at rest — AES-256 (Postgres, recordings, transcripts)
• Encryption in transit — TLS 1.3 on every connection
• Multi-tenant isolation — Postgres Row-Level Security with org-scoped predicates verified by automated tests
• Access controls — SSO + MFA mandatory for all staff; role-based access to production data; quarterly access reviews
• Audit trail — all admin actions logged immutably; reviewed monthly
• Penetration testing — annual third-party pentest once revenue exceeds ₹10 lakh MRR

We use only essential cookies for authentication and security. We do not use advertising or third-party tracking cookies. Product analytics is cookieless via fingerprint hashing with a daily salt.

Cualify is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have, contact the DPO and we will erase it.

We update this Policy when laws, sub-processors, or material practices change. Material updates are emailed at least 30 days before the effective date. Earlier versions are available at /legal/privacy/archive on request.

Email: [email protected]. Postal mail: Data Protection Officer, Cualify Technologies LLP, Mumbai, Maharashtra, India. We acknowledge within 48 hours and respond within 30 days.