Privacy policy

1. Who we are

RowCall is built, owned and operated by Loopclub Internet Private Limited, New Delhi, India (“we”, “us”). This policy follows the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We play two different roles, depending on whose data it is:

• Data fiduciary for data about visitors to our website, people on our waitlist, and the people who use the RowCall app for their business. We decide why and how this data is used.
• Data processor for data about the shoppers our customers ask us to call. The business that runs the call (the merchant) is the data fiduciary. We handle that data only on their instructions, under our data processing terms. If you are a shopper and want to use your rights, contact the store that called you; we will help them respond.

We act as an independent data fiduciary, not as a merchant’s processor, for the limited shopper data we need for our own legal duties and to protect our service: call records, the numbers used, the consent and opt-out records needed to answer telecom operators and TRAI, security and fraud logs, and reports of unwanted calls. We use that data only for those purposes and keep it only as long as those duties require.

2. What we collect

When you join the waitlist

• your work email, company name, company size and the use cases you pick;
• the campaign tags in the link you followed (UTM source, medium, campaign, content and term) and the page that referred you;
• the country your request came from, as reported by our hosting network. We don’t store your IP address.

When you use the RowCall app

• your name, email address and password (stored only as a one-way hash), or your Google account ID if you sign in with Google;
• the orgs you belong to, your role, and the invites you send or receive;
• sign-in sessions (device type, browser and IP address) and an audit log of changes you make, so you and your org can see who did what;
• technical logs of requests and errors, used to keep the service running and secure;
• the connections you set up: Slack, when you add it for alerts, and partner platforms you authorise to use RowCall for you.

When you verify your business or pay us

• your business’s legal name, type, registration number, PAN, GSTIN and address, and your store’s website and support contacts;
• your representative’s name, role, email and phone;
• the time, IP address and version when you accepted our terms;
• your billing details, top-ups and invoices.

Payments are made on Razorpay. We receive the payment status and reference, never your card or UPI details. We check PAN and GST details against government records.

When a merchant asks us to call a shopper

• the shopper’s phone number, name and preferred language;
• the order or checkout details the merchant sends for the call, and the shopper’s consent record;
• the call recording, its transcript, and the answers and outcome taken from it;
• call details such as time, duration, status and the actions taken during the call;
• any request the shopper makes not to be called again.

RowCall never asks shoppers for card numbers, one-time passwords, PINs or banking passwords. Payments happen through a secure link outside the call.

3. Why we use it

We don’t sell personal data. We don’t use shoppers’ recordings, transcripts or other data to train or improve AI models.

4. How long we keep it

• We keep personal data only as long as needed for the purpose we collected it for, or as long as the law requires.
• Waitlist entries are kept until you are invited or ask us to remove you.
• Account data is kept while your account exists; audit logs are kept with the org they belong to.
• Recordings, transcripts and answers are kept until the merchant deletes them, or for 30 days after the merchant’s agreement with us ends, and then deleted.
• Call logs and consent and opt-out records are kept for at least one year, and longer where TRAI rules, the DPDP Rules or CERT-In directions require.
• Business profile, billing and invoice records are kept as long as tax and company laws require.

5. Who else sees it

We share personal data only with service providers we need to run RowCall, each bound by contract to protect it:

• server hosting, database hosting and file storage in India (Bengaluru);
• our website hosting and content delivery network;
• licensed telephony carriers that connect calls;
• speech-to-text and voice (text-to-speech) providers;
• AI language model providers that follow each call’s script;
• payment processing (Razorpay), for top-ups;
• email delivery, for sign-in, invite, account and alert emails;
• workplace messaging (Slack), for alerts to our team about signups and approvals, and to your Slack workspace when you connect it.

Org owners can ask us for the list of named providers. We also share data with the merchant whose call it is, with partner platforms the merchant authorises, and with authorities when the law requires it.

6. Where it is stored

We store our databases, transcripts, recordings and backups in India (Bengaluru). To place and understand a call, we send call audio and text to telephony, speech and AI providers, some of which process it outside India, including in the United States. Those providers handle it under their own terms and data processing agreements. Speech and AI providers may keep it for a limited time, for example up to 30 days for abuse monitoring, and we turn off any use of it to train their models wherever the provider lets us. Telephony carriers keep call records for as long as telecom law and their terms require. We will not transfer personal data to any country the Government of India restricts under section 16 of the DPDP Act.

7. How we protect it

• encryption in transit (HTTPS/TLS) and at rest;
• access limited by role, with an audit log of changes;
• passwords stored only as hashes; sign-in links and tokens that expire and work once;
• separation of each org’s data, including orgs connected through the same partner platform;
• security practices in line with the IT Act and the reasonable security practices rules.

If a breach affects data we control, we will inform the Data Protection Board of India, CERT-In and the people affected as the law requires. If it affects shoppers’ data we process for a merchant, we will inform the merchant at once and help them inform their shoppers and the Board.

8. Your rights

Under the DPDP Act, you can ask us to:

• give you a summary of the personal data we hold about you and how we use it;
• correct, complete or update it;
• erase it, unless we must keep it by law;
• withdraw consent you gave us, as easily as you gave it;
• nominate someone to use these rights for you if you die or become unable to;
• resolve a grievance about how we handle your data.

Contact us at privacy@rowcall.ai to use these rights. We may need to confirm who you are first. Shoppers called on behalf of a store should contact that store; we act on its instructions and help it respond.

To stop RowCall calls, say so during any call. The opt-out applies to every flow of that store at once.

9. Children

RowCall is a service for businesses and is not directed at children. Merchants may not call anyone they know or should know is under 18 unless they have verifiable consent from a parent or guardian, as the DPDP Act requires. If you believe we hold a child’s data for our own purposes, contact us and we will delete it.

10. Cookies and analytics

Our website uses cookieless analytics from our hosting provider to count visits; it doesn’t track you across sites. The RowCall app uses only the cookies it needs to keep you signed in and to protect your account. We don’t use advertising cookies, so there is no cookie banner.

11. Grievance Officer

Our Grievance Officer is Harshul Jain, Loopclub Internet Private Limited, WeWork Eldeco Centre, Block A, Shivalik Colony, Malviya Nagar, New Delhi, Delhi 110017, India. Contact them at grievance@rowcall.ai. We acknowledge every grievance within 48 hours and resolve it within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters, we will tell account holders by email before it applies.