Effective date: 10 September 2026 · Applies to naadham.ai, the Naadham customer console, APIs, and the Naadham AI voice/messaging services.
Naadham is operated by Vistraal Private Limited, a company incorporated in India ("Naadham", "we", "Vistraal"). Contact: [email protected]. Grievance Officer (India DPDP Act 2023 & IT Act 2000): reachable at [email protected], postal address as above — we acknowledge grievances within 24 hours and resolve within applicable statutory timelines.
| Data | Purpose | Legal basis |
|---|---|---|
| Demo call/chat content, mic audio during a browser demo | run the live demo you start | consent (you start it) |
| "Call me" form: name, phone, interest, consent record, IP | place the demo call you requested; abuse prevention | consent; legitimate interest (fraud/abuse) |
| Contact form: name, email, message | respond to you | legitimate interest / consent |
| Technical logs (IP, user-agent, timestamps), rate-limit counters | security, abuse prevention, debugging | legitimate interest |
| Data | Purpose | Legal basis |
|---|---|---|
| Account: work email, organisation name, hashed password, role | provide the service, authentication | contract |
| Configuration: agent persona, FAQs, schedules, directory, phone numbers, documents you upload | operate your AI receptionist | contract |
| Billing: plan, subscription term, minute balance, usage metering, payment references | billing and receipts (card data is held by our payment processors, never by us) | contract; legal obligation (tax) |
| KYC/verification documents and status | telecom-compliance and account verification | legal obligation / legitimate interest |
| Support communications | support | contract |
| Data | Purpose |
|---|---|
| Call audio (processed in real time), optional call recordings when enabled, transcripts, caller phone number and name, call metadata (time, duration, outcome, brief call summary) | answer the call, take bookings or service requests, and show transcripts/recordings/summaries to the customer |
| Booking / enquiry details: name, phone, service, preferred time, notes | create or request the appointment or enquiry the caller asked for |
| WhatsApp/SMS/web-chat messages with the customer's AI | respond on the customer's behalf |
| Consent and do-not-call records for outbound calls | lawful-calling enforcement (see §7) |
Sensitive or health information. Conversations may incidentally include health or other sensitive information a caller chooses to share. We process it solely to provide the service to the customer, apply strict access controls, and our AI is instructed and designed not to provide medical diagnosis or treatment advice. The customer remains the controller of caller/patient data.
We share data only with infrastructure, telephony and AI providers needed to run the Services — never for advertising, and we do not sell or "share" (as defined by the CCPA) personal information. We may change, add or replace those providers at any time as operationally required, without individual notice to users, except where mandatory law that cannot be waived requires otherwise. We may also disclose data when required by law or to protect rights, safety, or the integrity of the service, and in a merger, financing or acquisition (with continuity of this policy's protections to the extent required by law).
Application compute for production voice and the customer portal runs primarily in India (Google Cloud, asia-south1). Application database hosting may use managed Postgres (currently including Neon in Singapore) and certain AI/telephony providers may process data in the US, EU or other regions. For customers in the UK/EEA we offer the UK IDTA/Addendum and EU Standard Contractual Clauses (2021) as part of our Data Processing terms where those terms apply. Hosting and provider locations may change as we operate and expand the service.
| Data | Retention |
|---|---|
| Live call audio | processed in real time to operate the call |
| Call recordings (when enabled) | stored by the telephony carrier (e.g. FreJun for India) under that carrier's retention; Naadham stores an authenticated recording reference and proxies playback to the authorised customer account — we do not permanently re-host a second copy of the audio file |
| Transcripts, bookings, enquiries, contacts, QA scores, call summaries | for the life of the customer's account, or until the customer deletes them (self-service deletion tools are provided) |
| Consent records | up to 3 years after last activity (legal defence of lawful-calling) |
| Do-not-call entries | indefinitely as a suppression record (removing them would risk calling you again) |
| Account/billing records | as required by tax law (typically 7–8 years in India) |
| Website demo/lead data | up to 12 months |
| Security logs | up to 12 months |
Everyone: opt out of automated calls permanently at any time — tell the AI to stop calling, or use the do-not-call endpoint/form; the number is suppressed on every outbound path.
India (DPDP Act 2023): access, correction, erasure, grievance redressal, nomination. Contact the Grievance Officer (§1). EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection; complain to your supervisory authority (or the ICO in the UK). California (CCPA/CPRA): know, delete, correct, opt out of sale/sharing (we do not sell or share), non-discrimination. Other regions: we honor the strongest applicable rights in practice.
How: customers exercise rights in-product (export and deletion tools in the console) or by email; callers contact the business they called (the controller) — and we act on that customer's instruction, or forward your request to them if you contact us directly. We respond within 30 days (or shorter statutory periods). Identity verification is required for requests. We may refuse or limit requests that are manifestly unfounded, excessive, or that would compromise security, other people's rights, or records we must keep by law.
The website and console use no advertising or analytics cookies. We use: (a) localStorage for your sign-in session and interface preferences (functional, not shared); (b) Cloudflare Turnstile for bot protection on public forms (may set its own functional cookie under Cloudflare's policy); (c) our payment processors' scripts during checkout; (d) a first-party visit counter on public pages, which keeps a "seen before" flag in your browser's storage and sends us only the page path and referring site — we store hourly totals, never an identifier or IP address. Because we use no non-essential trackers, no cookie-consent banner is required; if that changes we will add one.
Per-tenant isolation enforced with database row-level security; passwords stored as salted PBKDF2 hashes; session tokens and API keys stored only as hashes; stored provider secrets encrypted at rest (Fernet/AES); TLS in transit; constant-time credential comparisons; role-based access (staff logins are read-only); rate-limiting and abuse guards on all public endpoints; infrastructure access limited to authorized operators. No method is 100% secure; we notify affected customers and authorities of personal-data breaches as required by law. For our Indian operations that means reporting covered cyber incidents to CERT-In within six hours of noticing them, as its 2022 directions require; where GDPR applies, the supervisory authority is notified within 72 hours; DPDP notifications follow the Data Protection Board's rules as they come into force.
Our services are B2B and not directed to children. A caller of a customer business may be a minor whose parent/guardian books on their behalf; the customer controls such data. We do not knowingly collect children's data for our own purposes.
We may change this Privacy Policy at any time, including without prior or individual notice to users. The current version is the one posted on this page with its effective date. It is your responsibility to review this page periodically. Continued access to or use of the Services after a revised Privacy Policy is posted constitutes acceptance of the updated policy. Where a mandatory law that cannot be waived requires a specific form of notice, we will comply with that law only to the minimum extent required.
Privacy requests: [email protected] · General: [email protected] · Grievance Officer (India): §1. EU/UK representatives will be listed here once appointed.