Privacy Policy

1. Information We Collect

We collect only what is necessary to provide the Service:

• Account data — email address and name, used for authentication.
• Knowledge base content — documents (PDF, DOCX), URLs, and text you upload to train your agents.
• Conversation history — transcripts of messages and voice turns exchanged with your agents.
• Widget visitor data — name, email, page-visit history of users who interact with your embedded widget, where your agent is configured to collect it.
• Voice data — audio streams are processed in real time by our speech providers and are not stored as audio files; only the text transcript is retained.
• Usage data — agent usage metrics, conversation counts, billing events.
• Payment data — handled entirely by Razorpay; we never see or store full card numbers.
• Technical data — IP address, browser type, and timestamps, logged for security and abuse prevention.

2. How We Use Your Information

• Authenticate you and maintain your session.
• Operate, maintain, and improve the Service.
• Process payments and manage subscriptions.
• Send transactional and service-related emails (billing, security alerts).
• Provide customer support.
• Detect, prevent, and respond to fraud, abuse, or security incidents.
• Comply with legal obligations.

We do not sell your personal data. We do not use your knowledge-base content or conversation transcripts to train our own models or any third-party foundation model.

3. Legal Basis for Processing

Under the DPDP Act and GDPR (where it applies), we rely on the following grounds:

• Contract — to deliver the Service you signed up for.
• Consent — for optional features such as widget visitor data collection (obtained by your end-users via your widget UI).
• Legitimate interest — security, fraud prevention, product analytics (aggregated).
• Legal obligation — tax, accounting, and regulatory requirements.

4. Data Retention

• Account data — retained while your account is active.
• Knowledge base & conversation history — retained while the parent agent exists; deleted within 30 days of agent or account deletion.
• Widget visitor data — retained for up to 12 months or until you purge it from the dashboard.
• Billing & tax records — retained for 8 years as required by Indian tax law, even after account closure.
• Server logs — retained for up to 90 days for security monitoring.
• Backups — rolling 30-day backups; deleted data is purged from backups within 30 days.

5. Storage and Security

Data is stored in a managed PostgreSQL database hosted in India. We apply industry-standard controls: TLS 1.2+ in transit, encryption at rest, HTTP-only cookies, scoped database access, least-privilege IAM, and audit logging. Passwords are not stored — authentication is cookie-based following a verified email.

6. Third-Party Processors

We share data with the following sub-processors strictly to operate the Service:

• Sarvam AI — speech-to-text and text-to-speech (audio + transcripts).
• Google (Gemini) — LLM responses (conversation text + your system prompt).
• Cartesia — optional TTS provider, if selected for your agent.
• Razorpay — payment processing (name, email, payment instrument).
• ImageKit — static asset CDN (no personal data).
• Hosting provider — Vercel and a managed Postgres provider (data at rest).

Each sub-processor is contractually bound by data-protection terms consistent with this policy.

7. International Transfers

Some of our processors (e.g. Google, Cartesia) operate servers outside India. Where data is transferred internationally, we rely on the recipient's contractual data-protection commitments and, for EU users, Standard Contractual Clauses where required. You acknowledge these transfers by using the Service.

8. Cookies & Tracking

We use one HTTP-only session cookie (userId) with a 30-day lifetime to keep you signed in. We do not use advertising cookies, cross-site trackers, or third-party analytics pixels on our marketing pages. The embeddable widget may set a sessionStorage flag on your customer's device to remember whether the widget was open; this is cleared when the browser tab closes.

9. Your Rights

Subject to verification, you may request to:

• Access — obtain a copy of your personal data.
• Correct — update inaccurate or incomplete information.
• Delete — erase your account and associated data (billing records excepted, per Section 4).
• Withdraw consent — for any processing that relies on consent.
• Port — receive your data in a machine-readable format.
• Nominate — under the DPDP Act, nominate another individual to exercise rights on your behalf in case of incapacity or death.
• Lodge a complaint — with India's Data Protection Board or your local supervisory authority.

Most rights can be exercised directly from your dashboard settings. For anything else, email us (see Section 13). We respond within 30 days.

10. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Breach Notification

In the event of a personal-data breach likely to result in risk to you, we will notify affected users and the Data Protection Board of India without undue delay, consistent with our obligations under the DPDP Act.

12. Changes to This Policy

We may update this policy as the Service evolves. Material changes will be announced by email or an in-app notice at least 14 days before taking effect. The “Last updated” date at the top of this page always reflects the current version.

13. Grievance Officer & Contact

As required under the Information Technology Rules, 2011 and the DPDP Act, 2023:

For general support questions, email support@salesdok.com.