Privacy Policy

1. Introduction

KaiVox AI ("KaiVox AI", "we", "us", or "our") operates the KaiVox AI platform — an AI-powered business front desk SaaS available at kaivoxai.com and its subdomains.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. By accessing or using KaiVox AI, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Account Information

• Name, email address, phone number
• Business name, industry type, business address
• Profile photo (optional)
• Password (stored as a bcrypt hash — never in plain text)

2.2 Business Operational Data

• Services catalog (names, prices, durations)
• Staff profiles and working hours
• Appointment records (scheduled, completed, cancelled)
• Holiday calendars and business hours
• Knowledge base content you upload (FAQs, SOPs, pricing info)

2.3 Call Data

• Inbound and outbound call metadata (caller number, duration, timestamps)
• Call transcripts generated by AI transcription
• Sentiment analysis scores (positive / neutral / negative)
• Conversation quality scores and AI coaching notes

2.4 Your End-Customer Data

When your callers and customers interact with KaiVox AI, we store on your behalf:

• Names and phone numbers of your callers
• Appointment history and booking preferences
• SMS and WhatsApp message threads
• CRM notes and customer segments you assign

You are the data controller for your customers' data. We act as a data processor. You are responsible for ensuring you have a lawful basis to share your customers' data with us.

2.5 Payment Data

• Subscription plan and billing period
• Wallet balance and top-up history
• Invoice records

We do not store card numbers. All payment processing is handled by Stripe (global) or Razorpay (India), both of which are PCI DSS compliant. We only receive payment confirmation tokens.

2.6 Usage and Technical Data

• IP address and approximate location
• Browser type, device type, operating system
• Pages visited and features used (for product improvement)
• Error logs and API request logs
• Session tokens

2.7 Cookies

• Session cookies: Keep you logged in (essential)
• CSRF token cookies: Protect against cross-site request forgery (essential)
• Preference cookies: Store your UI preferences
• Analytics cookies: Help us understand usage patterns (future)

See our Cookie Policy for full details.

3. How We Use Your Information

• Providing the platform: Running your AI front desk, routing calls, scheduling appointments, sending notifications
• AI processing: Transcribing calls, analysing sentiment, generating AI responses via OpenAI GPT-4o
• Notifications: Sending appointment reminders via SMS and WhatsApp to your customers
• Billing and payments: Processing subscriptions, wallet top-ups, and generating invoices
• Platform security: Detecting fraud, abuse, and unauthorized access
• Product improvement: Understanding which features are used to improve the platform
• Support: Responding to your support requests and resolving issues
• Legal compliance: Complying with applicable laws and responding to lawful requests

Legal basis (for GDPR purposes): We process your data on the basis of (a) contract performance — to deliver the service you subscribed to; (b) legitimate interests — to improve our platform and prevent abuse; and (c) legal obligation — to comply with applicable laws.

4. Third-Party Service Providers

We share data with the following providers solely to deliver our service. Each is bound by their own data processing agreements and privacy policies:

We do not sell your data to any third parties. We do not share your data for advertising purposes.

5. Call Recording & AI Processing

KaiVox AI may record and transcribe calls handled by the AI receptionist. These recordings and transcripts are used to:

• Provide you with call logs and analytics in your dashboard
• Train and improve the AI conversation quality (in aggregate, anonymised form)
• Investigate disputes or support issues if raised

Tenant responsibility: As a KaiVox AI subscriber, you are responsible for informing your callers that calls may be recorded and processed by AI, in accordance with the laws of your jurisdiction (e.g. the Indian Telegraph Act, TRAI regulations, or applicable state wiretapping laws in your country). KaiVox AI provides the technical infrastructure; compliance with call recording consent laws is your responsibility.

6. Data Retention

• Account data: Retained while your account is active, plus 90 days after account deletion or cancellation (to allow reactivation)
• Call logs and transcripts: Rolling 12-month window; older records are automatically purged
• Appointment records: Retained for 3 years to support business continuity
• Payment and billing records: 7 years (required by Indian accounting and tax laws)
• Audit logs: 12 months rolling (owner can purge earlier via the security dashboard)

After account deletion, all personal data is permanently deleted within 90 days, except where retention is required by law.

7. Your Rights (GDPR / Indian IT Act / DPDP Act)

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access: Request a copy of your personal data we hold
• Right to correct: Request correction of inaccurate or incomplete data
• Right to export: Export your data in machine-readable format (CSV export available in your dashboard under Settings → Security)
• Right to delete: Request deletion of your personal data (subject to legal retention requirements)
• Right to object: Object to processing of your data for certain purposes
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at: legal@kaivoxai.com. We will respond within 30 days.

8. Data Security

• HTTPS encryption: All data in transit is encrypted using TLS 1.2+
• Database security: Access controls, parameterised queries, no raw SQL injection surfaces
• Password hashing: All passwords hashed with bcrypt
• Security headers: HSTS, X-Frame-Options, CSP, and other HTTP security headers applied
• Audit logs: All sensitive actions (login, data export, settings changes) are logged
• Access control: Role-based access — staff cannot access owner-level billing or security data

Despite our efforts, no internet-based service can guarantee 100% security. In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of it, as required by GDPR and applicable law.

9. Children's Privacy

KaiVox AI is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at legal@kaivoxai.com and we will delete it promptly.

10. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 (DPDP Act), and any applicable rules thereunder. Disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of courts in India.

11. Contact Us

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email (to the address on your account) and update the "Last updated" date at the top of this page.

Continued use of KaiVox AI after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

This policy was last updated: May 2026