Privacy Policy

Effective May 2026. Applies to the closed-beta release of Dialcore.

1. Who is the data fiduciary

Dialcore ("we") is the data fiduciary for your account information under India's Digital Personal Data Protection Act, 2023 (DPDPA). When your AI agents handle calls or messages with third parties, you are the data fiduciary for that conversation and we are a data processor acting on your behalf.

2. What we collect

For your account:

• Email address and (if you sign in with Google) basic profile.
• Phone numbers you register with the platform, agent prompts, and billing details (handled by Stripe — we never store full card numbers).
• Usage logs: call counts, durations, errors, IP, browser.

For calls and messages your agents handle:

• The phone numbers of both parties.
• Audio recordings of the call (stored encrypted at rest).
• Transcripts and AI-generated summaries, topics, and sentiment scores.
• The text of WhatsApp / SMS messages routed through the platform.

3. Why we collect it

• To run the service: route calls, generate transcripts, bill you.
• To improve reliability: debug failures, monitor latency.
• To detect abuse: spam, fraud, harassment, regulatory violations.
• We do notuse your call content to train shared AI models. AI inference happens on a per-call basis through our model providers (listed in §5).

4. How we tell the other party

Every call begins with a short verbal disclosure that the call is being recorded and assisted by an AI. You should obtain any additional consent that your jurisdiction or industry requires (for example: healthcare, lending, or insurance).

5. Third-party processors

We use a small set of vetted processors:

• Supabase (Singapore) — auth, database, file storage.
• OpenAI (United States) — LLM completions, no retention beyond the request when using the API.
• Cartesia (United States) — text-to-speech.
• Oriserve / self-hosted Whisper — speech-to-text; we run the Hindi-Hinglish model on our own hardware.
• Stripe (Ireland / United States) — payments.
• Sentry — error monitoring, PII off by default.

Cross-border transfers are governed by standard contractual clauses or the processor's equivalent. India does not currently restrict transfers to most countries, but we will update this notice if the Government of India designates restricted jurisdictions under the DPDPA.

6. How long we keep it

• Call recordings & transcripts: 90 days by default during the beta. You can delete an individual call at any time from the dashboard.
• Account information: until you delete the account.
• Billing records: 8 years, as required under Indian tax law.
• Logs used for debugging: 30 days.

7. Your rights under DPDPA

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data, subject to the retention rules above (we keep billing records as required by law).
• Nominate another person to exercise these rights on your behalf.
• Withdraw consent — although doing so will usually mean we can no longer provide the service.
• File a grievance with the Data Protection Board of India if you are not satisfied with our response.

Most of these can be exercised from your account settings. If you need help, email our Grievance Officer (§9).

8. Security

Account passwords are hashed by Supabase. Call audio is encrypted at rest. API access uses TLS. Internal endpoints (the "LAN-only" ones) are firewalled and not exposed to the public internet. We review access controls regularly and log admin actions.

9. Grievance Officer

As required by Indian law, our designated grievance officer for privacy questions is:

Punit Narang
Email: privacy@dialcore.app
Response time: 30 days.

10. Children

Dialcore is not directed at children under 18. If we learn we have collected personal data of a minor without proper consent we will delete it.

11. Changes

We will update this policy as the product evolves. Material changes will be announced by email and in-app at least 14 days before they take effect.

See also our Terms of Service. This policy is a starting point and not a substitute for legal advice.