Privacy policy

CallWhiz AI is a voice AI platform operated by Zingaro AI Private Limited, a company registered in India (“we”, “us”, “our”). Businesses use it to build AI agents that answer and place phone calls, and hold conversations on the web and on WhatsApp.

This policy explains what personal data we collect through our websites, the CallWhiz AI dashboard, our APIs and the agents that run on our platform, why we collect it, who we share it with, and the choices and rights you have. It is written to meet India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules, and, for users in the European Union and the United Kingdom, the GDPR.

• For our customers’ accounts (the people who sign up, build agents and pay us), we decide how the data is used. In the language of the law we are the data fiduciary or controller.
• For the people our customers’ agents talk to (callers, the contacts on a calling list, website and WhatsApp visitors), we process data on our customer’s behalf and on their instructions. The business that runs the agent is responsible for telling those people about the call, obtaining any consent the law requires (including for call recording and for calling them), and answering their requests. If you spoke to an agent on our platform, please contact that business first. We will help them respond.

• Account details: your name, email address, phone number, company name and sign-in details (including when you sign in with Google).
• Billing details: billing name and address, GST number if you give one, the plan and credits you buy, and payment references from our payment providers. We never receive or store your full card number, CVV, UPI PIN or net-banking password. See “Payments” below.
• What you put into the platform: agent prompts and settings, knowledge-base files, contact lists you upload, phone numbers you connect, and credentials for the tools you integrate (stored encrypted).
• Call and conversation data: call audio and recordings (when recording is switched on for an agent), transcripts, phone numbers, call times, duration and outcome, and chat messages. If an agent has conversation memory switched on, short notes from earlier calls with the same number.
• Usage and device data: IP address, browser and device type, pages visited, actions in the dashboard, error logs, and cookies (see “Cookies”).
• What you send us: support emails, demo and contact requests, and survey replies.

• To provide the service: run your agents, place and receive calls, turn speech into text, generate replies and speak them, store recordings and transcripts, and show you analytics.
• To bill you: take payments, keep your credit balance, issue invoices, and handle refunds.
• To keep the platform safe: prevent fraud, spam calling and abuse, and secure accounts.
• To support you and tell you about your account, such as low credits, failed payments and changes to the service.
• To improve the product, mainly from aggregated usage. Your call recordings and transcripts are used to deliver and improve your own agents, for example the call reviews and prompt suggestions in your dashboard.
• To send product news, which you can unsubscribe from at any time.
• To meet legal, tax and regulatory obligations and to resolve disputes.

We do not sell personal data, and we do not use your call recordings or transcripts to train general-purpose AI models.

We rely on your consent, on the performance of our contract with you, on our legitimate interest in running and securing the service, and on legal obligations. Where we rely on consent, you can withdraw it at any time.

We share personal data only with service providers that help us run the platform, under contracts that limit their use of it to providing their service to us:

• Hosting and storage: Google Cloud and Firebase, Amazon Web Services, Supabase.
• Calls and telephony: LiveKit, Twilio and licensed telecom carriers that connect the calls.
• Speech and language AI: Google (Gemini and speech services), OpenAI, Microsoft Azure, Deepgram, Soniox, Cartesia, ElevenLabs and Cerebras, used to recognise speech, generate replies and synthesise voices while a conversation happens.
• Payments: Razorpay (payments in India) and Dodo Payments (international payments).
• Website analytics and security: Google Analytics, Microsoft Clarity and Cloudflare.
• Email: Google Workspace.

We also share data with the tools you connect, such as a CRM, calendar or WhatsApp, when you instruct us to; when the law requires it or to protect our users, the public or our rights; and with a buyer or successor if our business is merged or sold, who must keep to this policy.

Payments are processed by Razorpay for customers in India and by Dodo Payments for customers elsewhere. Your card, UPI or bank details are entered on their secure checkout and handled under their PCI-DSS certified systems. We receive only what we need to run your account: whether the payment succeeded, the amount, a transaction reference, and for saved cards or subscriptions, the card network and last four digits.

Our main servers are in India (Mumbai). Some of the providers listed above process data in other countries, such as the United States, to deliver their part of the service. When data leaves India or your country, we use providers bound by contractual safeguards, and we comply with any restrictions the Government of India notifies under the Digital Personal Data Protection Act.

We keep account and platform data while your account is active. You can delete recordings, transcripts, contact lists and agents from your dashboard at any time. When you close your account, we delete or anonymise your personal data, except where the law requires us to keep it, for example invoices and payment records under Indian tax law, and backups, which are overwritten on a rolling basis.

Data is encrypted in transit. The credentials you give us for connected tools are encrypted at rest, access to production systems is restricted to the staff who need it, and webhooks are signed. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

You can ask us to give you a summary of your personal data, correct or update it, delete it, and withdraw a consent you gave. Under Indian law you can also raise a grievance with us and nominate a person to exercise these rights for you. In the EU and UK you can also object to or restrict processing, ask for a portable copy, and complain to your data protection authority.

Email [email protected] from the address on your account. We may need to verify your identity, and we respond within 30 days. Most account details can also be changed directly in your dashboard.

We use essential cookies to sign you in and keep the site working. Google Analytics sets its cookies only if you accept analytics cookies in the cookie banner. Microsoft Clarity records how our pages are used (clicks, scrolling and page layout, with what you type masked) so that we can find and fix problems. You can change your cookie choice at any time from the banner, and block or delete cookies in your browser settings.

CallWhiz AI is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

In line with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, you can write to our Grievance Officer about how we handle personal data:

We acknowledge a grievance within 48 hours and aim to resolve it within 30 days.

We may update this policy as the product or the law changes. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or in the dashboard before it takes effect.