1. Introduction & Scope
This Privacy Policy explains the practices of Callnet ("Callnet", "we", "us", or "our"), co-developed by Posterior AI (posterior.xyz) and BYOB Studio (byob.studio), regarding the collection, processing, storage, and protection of information when you use our AI telephony platform, APIs, and associated web services.
This policy applies to business tenants who register for Callnet accounts, as well as callers whose communications are handled by Callnet AI phone agents on behalf of our business tenants.
2. Information We Collect
We collect information in the following categories:
- Account & Profile Information: Name, business email, company name, GSTIN, business registration details, and KYC identification documents required under Indian telecom regulations.
- Telephony Metadata: Originating caller phone number, destination number, call duration, timestamp, carrier call UUID, call disposition status (e.g. completed, busy, no-answer), and network latency telemetry.
- Voice Audio Streams & Recordings: In-flight 8kHz PCM/L16 bi-directional audio packets streamed between callers and our voice engine during active phone calls, and resulting audio recordings (if enabled by tenant configuration).
- Transcripts & AI Generated Summaries: Turn-by-turn text transcripts generated by automated speech recognition (ASR) and Gemini Live, key bullet points, customer sentiment analysis, and action items.
- Billing & Payment Data: Transaction references, wallet top-up amounts, and credit balances. Payment card and net banking details are processed directly by our RBI-compliant payment gateway partners (Razorpay / Dodo Payments); Callnet does not store raw credit card numbers.
3. How We Process Voice & Telephony Data
Voice data is processed through our high-performance, edge-distributed architecture:
- Real-Time Audio Ingestion: Incoming audio frames from telecommunication carriers (via Plivo) are received over secure WebSockets on Cloudflare Workers edge nodes.
- AI Reasoning & Voice Generation: Audio is bridged to Google Gemini Live API models to produce real-time conversational responses in Hindi, English, and Hinglish.
- Transcription & Disposition: As speech is exchanged, turn-by-turn dialogue is accumulated. Upon call completion, the conversation is summarized into structured takeaways.
- Notification Delivery: If configured by the tenant, call summaries and action items are dispatched via secure webhooks or Telegram Bot alerts.
We do NOT utilize private customer call recordings, transcripts, or personal data to train publicly accessible machine learning models or foundation models. Processing is strictly limited to real-time session inference and tenant-directed features.
4. Compliance with Indian DPDP Act 2023 & DoT Rules
Callnet complies with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Information Technology Act, 2000.
- Role Distinction: In relation to customer voice data, the Tenant acts as the Data Fiduciary and Callnet acts as the Data Processor.
- Caller Consent: Tenants are obligated to provide explicit call recording disclosures at the inception of each phone call. Callers have the right to request call disconnection if they do not consent to automated AI recording.
- Purpose Limitation: Personal data is processed exclusively for the purpose of executing the requested telephony service and generating business call records.
5. Storage, Encryption & Security Safeguards
We implement enterprise-grade security measures to safeguard data:
- In-Transit Encryption: All WebSocket voice streams, API endpoints, and dashboard sessions enforce TLS 1.3 with modern cipher suites.
- At-Rest Encryption: Database records in Cloudflare D1 (including call logs, transcripts, and tenant configurations) are encrypted at rest using AES-256 standards.
- Access Control: Administrative access follows strict least-privilege principles, multi-factor authentication (MFA), and audit logging.
- Tenant Isolation: Every database query is strictly parameterized and scoped by unique
tenant_idboundaries.
6. Third-Party Service Providers & Sub-processors
Callnet integrates with trusted enterprise infrastructure providers to deliver reliable telecom and AI services:
| Provider | Purpose | Location |
|---|---|---|
| Plivo Inc. | Carrier telecom interconnection, +91 number routing, PSTN bridging | India / Global |
| Google Cloud (Gemini) | Real-time conversational speech-to-speech AI inference | Global / Secure Cloud |
| Cloudflare, Inc. | Edge compute (Workers), WebSocket proxy, encrypted D1 database | India & Global Anycast |
| Razorpay / Dodo Payments | RBI-compliant payment gateway & wallet top-up processing | India / Global |
7. Data Retention & Automatic Purging
Call metadata and transcripts are maintained for the duration of your active tenant account to provide reporting in your dashboard. Tenants may at any time:
- Export their historical call logs and transcripts in standard JSON/CSV formats.
- Request bulk deletion of call recordings and transcripts.
- Upon account closure, all associated tenant call transcripts and audio records are permanently purged within thirty (30) days, except where retention is legally mandated by Indian telecom authorities.
8. Your Rights & Caller Inquiries
Under applicable data protection laws, individuals whose personal data is processed by Callnet have rights including:
- Right to access summaries of personal data being processed.
- Right to correction and erasure of inaccurate personal data.
- Right to grievance redressal through our designated Grievance Officer.
Callers seeking to exercise rights regarding a specific call placed to or by a Callnet tenant may contact the relevant business directly or reach our privacy team for assistance.
9. Grievance Officer & Privacy Inquiries
In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are provided below: