Data processing terms

1. Roles

For the personal data of the shoppers you ask us to call, you (the customer) are the data fiduciary and Loopclub Internet Private Limited is your data processor, as those terms are used in the Digital Personal Data Protection Act, 2023 (“DPDP Act”). If you authorise a partner platform to use RowCall for you, its requests are your instructions and these terms still apply to us.

We act as an independent data fiduciary, not your processor, for the limited shopper data we need for our own legal duties and to protect our service: call records, the numbers used, the consent and opt-out records needed to answer telecom operators and TRAI, security and fraud logs, and reports of unwanted calls. We use that data only for those purposes and keep it only as long as those duties require.

2. Processing details

3. Your instructions

We process shopper data only on your documented instructions. Your instructions are the flows you publish, the settings of your org, the calls you start in the app or through the API, and anything else you agree with us in writing. If we believe an instruction breaks the law, we will tell you and may decline to follow it.

4. Your commitments

• You have a lawful basis for every call you ask us to make, including the shopper’s consent where the DPDP Act or the rules of the Telecom Regulatory Authority of India require it, and you send us that consent record.
• You have given shoppers any notice the law requires about these calls, that they are automated, and that they are recorded and processed by our providers, including outside India.
• The data you send us is accurate and limited to what the call needs.
• Where a shopper is a child, you have verifiable consent from a parent or guardian before you send us their data.
• You follow our acceptable use policy and act on the opt-outs we pass to you.

5. Confidentiality

Everyone at Loopclub Internet Private Limited who can access shopper data is bound to keep it confidential and may access it only to run, secure or support the service, or to review your business for approval.

6. Security

We keep appropriate technical and organisational measures in place, including:

• encryption of data in transit and at rest;
• access limited by role, for your team and for ours, with an audit log of changes;
• separation of each org’s data, including orgs connected through the same partner platform;
• storage of our databases, transcripts, recordings and backups in India (Bengaluru), with speech and AI processing that may happen outside India (section 8);
• signed requests for actions and webhooks, and keys that you can rotate;
• monitoring and logging to detect misuse, with logs kept for at least one year.

7. Sub-processors

You authorise us to use sub-processors in these categories: hosting and storage in India; telephony; speech, voice and AI language models; payments (Razorpay); and email and messaging. We choose which provider in a category handles each call and may switch between providers in a category at any time. Org owners can ask us for the list of named providers.

Each sub-processor handles the data under a written contract or its published terms and data processing agreement, which limit its use of the data to providing its service to us. We turn off any use of shopper data to train a provider’s models wherever the provider lets us. We will email org owners at least 15 days before we add a new category of sub-processor, or a provider that processes shopper data in a new country. If you object on reasonable data protection grounds within that time, we will try to find a solution; if there is none, you may end the agreement. Unused credit is not refunded.

8. Transfers outside India

You agree that shopper data may be transferred to and processed by our sub-processors outside India, including in the United States, under the contracts and terms described in section 7. We will not transfer it to any country the Government of India restricts under section 16 of the DPDP Act.

9. Helping you meet your duties

• Requests from shoppers. If a shopper asks us to access, correct or erase their data, we pass the request to you and help you respond. We act on opt-outs during calls immediately.
• Erasure. We will erase shopper data, and have our sub-processors erase it, when you instruct us, including when a shopper withdraws consent, except what we must keep by law.
• Breaches. We will tell you about a personal data breach affecting your shoppers without delay and in any case within 24 hours of becoming aware of it, with what we know, and update you as we learn more, so you can inform the Data Protection Board of India and the people affected within the time the DPDP Rules require. We also report cyber incidents to CERT-In as Indian law requires.
• Records and questions. We will answer reasonable questions about how we process your data and share the information you need to show your own compliance.

10. Recordings and transcripts

Recordings and transcripts belong to you. They are kept until you delete them. We use them only to run the service for you, to investigate a problem you report, and to meet a legal duty, such as answering a regulator’s request about a complaint. We don’t use your shoppers’ recordings, transcripts or other data to train or improve AI models.

11. When the agreement ends

When the agreement ends, you can export your data for 30 days. After that we delete shopper data, unless the law requires us to keep some of it, such as call logs and consent and opt-out records, which we keep for at least one year. We keep only that part, protect it, and delete it when the duty ends.

12. Audits

Once a year, or after a breach, you may ask us to show that we meet these terms. We will first answer with documents and written replies. If that is not enough, you may audit on reasonable notice, during business hours, through an auditor bound by confidentiality, without access to other customers’ data.

13. Contact

Questions about how we process your shoppers’ data? Contact us at privacy@rowcall.ai.