Privacy policy

Two kinds of data

Account data is about the people who use Convo Intelligence: names, work emails, company details, roles, and how the product is used. We are responsible for it.

Customer content is what our customers send us to analyse: call recordings, transcripts, scores, extracted fields and the metadata that comes with them. Our customer — your employer, or the business you called — decides what is recorded and why. We process customer content only on their instructions, as their data processor under India's Digital Personal Data Protection Act, 2023. If you spoke on a recorded call and have a question about it, please contact that business first; we will help them respond.

What we collect and why

• To run accounts: name, work email, password (stored only as a one-way hash), company name, industry, team size and the workspace settings you choose.
• To provide the service: the recordings, links and call details you send, and the results we produce from them.
• To keep the service secure and working: sign-in events, IP addresses (for rate limiting and in the audit log), an audit log of administrative actions, and error logs.
• To answer enquiries: the details you enter in the demo or upgrade forms.

We don't sell personal data, show advertising, or use customer content to train AI models.

Who processes data for us

We use a small number of providers: Vercel (hosting and file storage), Supabase (database), OpenAI (transcription and analysis through their paid APIs, which do not train on API data), and, when email is switched on, Resend (transactional email). Some of these process data outside India. See the security page for detail.

How long we keep it

Recordings are deleted once processed unless the customer chooses to keep them for a set period. Transcripts and results are kept until the customer deletes them or their retention setting removes them automatically. Company details are deleted with the workspace. A person's login is kept while they belong to a workspace, or until they ask us to delete it, except where we must keep records by law.

Your rights

You can access and correct your account details in the product, and ask us to delete your account. For customer content, contact the business that recorded the call; they control it and we act on their instructions. Under the DPDP Act you may also raise a grievance with us at the address below, and, if unresolved, with the Data Protection Board of India.

Security

We use encryption in transit, encryption at rest for credentials, role-based access, rate limiting and audit logging. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify the affected customer without undue delay and as required by law.

Contact and grievances

Write to apg21605@gmail.com. We aim to respond within 7 days.