Privacy Policy

We collect the following categories of personal data:

• Account data — name, email address, phone number, organization details, and authentication credentials.
• Call recordings & transcripts — audio of voice agent calls and their machine-generated transcripts, where recording is enabled for your workspace.
• Usage data — feature usage, request metadata, credit consumption, device and browser information, and diagnostic logs.
• Billing data — billing address, GST identifier, and transaction records (payment card details are handled by our payment processor, not stored by us).

We process personal data only for clearly defined purposes:

• To provide, operate, and maintain the platform and your AI voice agents.
• To process speech, generate responses, and synthesize voice through our AI provider.
• To bill you accurately, issue GST-compliant invoices, and prevent fraud or abuse.
• To improve reliability, debug issues, and secure the service.
• To communicate service notices and respond to support requests.

We do not sell your personal data, and we do not use your call recordings or transcripts to train third-party foundation models.

Under the DPDP Act, we process personal data on the basis of your consent or for certain legitimate uses permitted by law (such as fulfilling a service you requested or complying with a legal obligation).

Where we rely on consent, we ask for it through a clear, affirmative action, and you may withdraw it at any time. Withdrawing consent does not affect processing already carried out, and may limit your ability to use parts of the service. Where you provide personal data of third parties (for example, contacts your agent will call), you confirm you have a lawful basis to do so.

When recording is enabled for a workspace, we capture call audio and transcripts to let you review, audit, and improve your agents. Recordings are stored privately and accessed through short-lived signed URLs.

• Default retention: 28 days. After this window, recordings and their transcripts are purged.
• Retention is configurable per workspace — you can shorten it, extend it, or disable recording entirely.
• Account and billing records are retained for as long as your account is active and for any period required by law (for example, tax and accounting obligations) thereafter.

We rely on a small set of trusted sub-processors to deliver the service. Each is bound by contractual data-protection obligations:

• Google (Gemini) — Speech-to-text, language understanding, text-to-speech, and live voice for all AI agent interactions.
• Razorpay — Payment processing, subscriptions, and GST invoicing for Indian customers.
• Cloudinary — Storage and delivery of audio assets, generated media, and recordings.
• Neon — Managed PostgreSQL database hosting for account, configuration, and usage data.

The DPDP Act gives you the following rights over your personal data:

• Right to access — Request a summary of the personal data we process about you and how it is used.
• Right to correction — Ask us to correct inaccurate or incomplete personal data, or to complete data that is incomplete.
• Right to erasure — Request deletion of your personal data where it is no longer needed for the purpose it was collected.
• Right to grievance redressal — Raise a complaint with our grievance officer and receive a timely response.
• Right to nominate — Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, contact us at contact@vanieai.com. We will verify your identity before acting on a request.

We apply industry-standard safeguards, including encryption of stored data at rest using AES-256-GCM and encryption in transit using TLS. Access to personal data is restricted on a need-to-know basis and logged. No method of transmission or storage is perfectly secure, but we work continuously to protect your data and will notify you and the Data Protection Board of any breach as required by the DPDP Act.

We use a minimal set of cookies and similar technologies that are strictly necessary to keep you signed in, secure your session, and remember basic preferences. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings; disabling essential cookies may prevent you from signing in.

The service is not directed to children. In line with the DPDP Act, we do not knowingly process the personal data of a child (under 18 years of age) without verifiable consent from a parent or lawful guardian. If you believe a child has provided us personal data, please contact us and we will delete it.

We may update this policy as our service, the law, or our sub-processors change. When we make a material change, we will update the version and effective date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.

For privacy questions, to exercise your rights, or to reach our grievance officer, email contact@vanieai.com.

See also our Terms of Service.