Data Processing Agreement

Controller (a Data Fiduciary under the Indian Digital Personal Data Protection Act, 2023) means the entity that determines the purposes and means of processing Personal Data (you, the customer).

Processor (a Data Processor under the DPDP Act) means the entity that processes Personal Data on behalf of the Controller (KaiVox AI).

Data Principal means the individual the Personal Data relates to, such as your caller or customer.

Personal Data means any information relating to an identified or identifiable natural person.

Processing means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.

KaiVox AI processes Personal Data on your behalf as follows:

• Call recordings and transcripts — voice data from inbound and outbound calls
• Customer data — names, phone numbers, email addresses, appointment history
• Appointment data — booking details, staff assignments, service records
• Message data — SMS and email communication records

KaiVox AI shall process Personal Data only on your documented instructions and for the purposes set out in this DPA. We will not process Personal Data for any other purpose without your prior written consent, unless required by applicable law.

KaiVox AI uses the following sub-processors to provide the service:

You are responsible for: giving your callers and customers a clear notice of what is collected and why; obtaining their consent (or relying on another lawful ground); telling callers that calls are recorded and handled by an AI (Voice Settings → AI disclosure); obtaining verifiable parental consent before we process a child's data; and answering requests from your customers. KaiVox will assist as set out in clauses 7 and 8.

Transfers outside India: some sub-processors (in particular our AI language and speech providers) may process data outside India. We transfer data only to countries the Government of India has not restricted, and only as needed to deliver the service.

KaiVox AI implements the following technical and organisational security measures:

• Encryption in transit using TLS 1.3 for all data transmissions
• Encryption at rest for all database content and backups
• Role-based access controls (RBAC) — principle of least privilege
• Full audit logging of all access, changes, and exports
• Security HTTP headers (HSTS, X-Frame-Options, CSP, X-XSS-Protection)
• Multi-tenant data isolation — no cross-tenant data access possible

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, KaiVox AI will notify you without undue delay and within 72 hours of becoming aware of the breach. The notification will include: the nature of the breach, categories of data affected, approximate number of individuals affected, likely consequences, and measures taken or proposed.

KaiVox AI will provide reasonable assistance to help you fulfill your obligations to respond to data subject requests, including rights of access, rectification, erasure, restriction, portability, and objection. All customer data can be exported in CSV format from Settings → Security. Individual records can be deleted from the customer dashboard at any time.

Upon termination of the agreement, KaiVox AI will, at your choice, delete or return all Personal Data within 30 days, unless retention is required by applicable law. Confirmation of deletion will be provided in writing upon request. Backups are purged on a rolling 30-day schedule after account closure.