Data Processing Agreement

Pending legal review. This is a draft written from what the software does. It has not been reviewed by a lawyer and is not yet offered as binding terms. Each point still open is marked like this one. To receive a copy to sign once it is final, or to send us your own DPA, write to privacy@aicall.vitrano.in.

1. Who this agreement is between

This agreement is between the business that holds a Dialora AI workspace ("you") and us, the operator of Dialora AI ("we"). It forms part of our Terms of Service and covers the personal data we process for you when we run the service.

You decide why and how that data is used, so you are the controller (under India's DPDP Act, the Data Fiduciary; in Singapore, the organisation). We process it on your behalf, so we are your processor (under the DPDP Act, the Data Processor; in Singapore, a data intermediary).

It does not cover the accounts of people who sign up with us. For that data we are the controller, and our privacy notice applies.

Pending legal review. Our contracting entity, its registered address, and how this agreement is accepted (online acceptance, or signature) are to be stated here.

2. What we process

Purpose. Running AI agents that answer and place phone calls, and chat on your website and on WhatsApp, for you; booking appointments; and showing you your own records.
Whose data. The people you call or who contact you: your leads, customers and callers, visitors who use your website chat, and people who message you on WhatsApp. Also your own team members who use the workspace.
What data. Contact details and any fields you add; call times, outcomes and, if you switch recording on, recordings; transcripts; AI summaries, sentiment and fields extracted from conversations; chats and survey answers; appointments and callback requests; consent, opt-in and do-not-call records; and photos, documents and voice notes sent on WhatsApp.
Sensitive data. The service is not designed to collect health, financial-account or other special-category data. A caller may still say such things on a call, and it will then be in the transcript and any recording.
How long. For as long as you use the service, and then as described in section 9.

3. We act only on your instructions

Your instructions are this agreement, our Terms, and what you set up in your workspace: agents, campaigns, connected services and settings. We process your data only for that, unless a law we are subject to requires otherwise, in which case we tell you first unless that law forbids it. If we think an instruction breaks a data-protection law, we tell you.

We do not sell your data, use it for advertising, or train models on your calls or chats.

Reference: GDPR Art. 28(3)(a).

4. Who at our end can see your data

Platform staff open a workspace through a read-only support view. Opening one is written to our admin audit log, with who opened it and when.
The few people who administer our servers can reach the database directly. That access is not logged record by record.

Pending legal review. Written confidentiality undertakings for everyone with access, and a named list of who has server access, are to be confirmed before this clause is final (GDPR Art. 28(3)(b)).

5. How we protect it

The measures in place today are listed in Annex A below. We hold no SOC 2, ISO 27001 or similar certificate.

Reference: GDPR Art. 28(3)(c) and Art. 32.

6. Sub-processors

You authorise us to use the sub-processors on our sub-processor list. We bind each of them to data-protection terms that give your data the same protection as this agreement, and we remain responsible to you for what they do.

When we add or replace one, we update that list first. You may object to a change; if we cannot address the objection, you may stop using the affected part of the service or end your plan.

Services you connect with your own account, such as Twilio, Deepgram, ElevenLabs, a model provider or WhatsApp, run under your own agreement with that provider. We send data to them because you set them up, and we list them so you can see every place your data goes.

Pending legal review. How much notice we give before a new sub-processor starts, how you are told (there is no email alert yet), and what happens to fees if you leave over an objection, are open. The flow-down terms in our agreements with our own sub-processors have not yet been checked (GDPR Art. 28(2) and 28(4)).

7. Helping you answer people's requests

The workspace has the tools to answer access, correction and erasure requests yourself:

find everything held about one person, and download it;
edit a contact's record;
erase a person's records, including transcripts and recordings, keeping only their number on the do-not-call list, the call's duration and outcome for billing, and the compliance record with the number replaced by a keyed code;
place a legal hold, which stops a contact from being erased or purged until it is lifted;
set how long recordings, transcripts and chats are kept, applied every six hours;
add a number to the do-not-call list, which is checked before every call and message.

Exports and erasures need the admin role, and each one is written to the workspace's compliance log. If a request about your data reaches us directly, we pass it to you and do not answer it ourselves unless you ask us to.

Reference: GDPR Art. 28(3)(e).

8. If there is a breach

If we become aware of a personal data breach affecting your data, we tell you without undue delay. We tell you what happened, what data and roughly how many people are affected, the likely consequences, what we have done about it, and who to contact. If we do not have all of that at first, we send what we have and the rest as we learn it.

Deciding whether to tell a regulator or the people affected is yours as the controller, and we help you with it. The laws give you little time. Under the GDPR and the UK GDPR a controller has 72 hours to notify the regulator. Singapore gives an organisation three calendar days after it assesses a breach as notifiable. Malaysia's Commissioner asks for notice within 72 hours. India's DPDP Act requires the Data Protection Board and each affected person to be told, in the manner its Rules set. See the regional notices for the source of each.

Pending legal review. A fixed number of hours within which we will tell you is not yet set. To leave you time to meet the deadlines above it needs to be well under 72 hours; the figure is a decision for the business and counsel. The security-incident procedure behind it is not yet written down (GDPR Art. 28(3)(f) and Art. 33(2)).

9. When the agreement ends

Before you leave, you can download your data yourself:

all your leads, with their fields and outcomes, as a spreadsheet;
your full compliance log: every decision to call or not to call, every consent and opt-out;
everything held about any one person.

There is no button yet to delete a whole workspace. When you ask us in writing, we delete your workspace's data from the live service.

Copies remain in backups for a while. Backups on our application server are deleted after 14 days. The copy kept on our second server is not yet deleted on a schedule; we are fixing that, and until then, data deleted from the live service can stay in that copy.

Pending legal review. How many days we take to delete after a request, whether we confirm deletion in writing, what we keep because a law requires it (for example billing records), and a bulk export of calls, recordings and chats, are all open (GDPR Art. 28(3)(g)).

10. Showing that we comply

We give you the information you reasonably need to show that this agreement is being kept: this page, the security page, the sub-processor list, and written answers to your security questionnaire.

Pending legal review. Whether you, or an auditor you appoint, may inspect us, how often, on what notice and at whose cost, is open. We have no third-party audit report to offer instead (GDPR Art. 28(3)(h)).

11. Data leaving your country

Our servers are in Ahmedabad, India. If your business is outside India, using Dialora AI moves your customers' data to India. Services you connect yourself may move it elsewhere, mostly to the United States; the sub-processor list says where each one is.

From the EU or EEA. India has no adequacy decision from the European Commission, so a transfer needs safeguards. The usual one is the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914: Module Two between you as controller and us as processor, and Module Three between us and a sub-processor outside the EEA.
From the United Kingdom. The ICO's International Data Transfer Agreement, or its UK Addendum to the EU clauses.
From Singapore, Malaysia, the UAE or Australia. Each law has its own transfer rule. The regional notices set them out with their sources.

Pending legal review. Whether the EU clauses and the UK Addendum are built into this agreement or signed separately, how their annexes are completed, and the transfer impact assessment for India, are for counsel. Until that is settled, we do not state that a transfer to us is covered by any of them.

12. Requests from authorities

If a government body asks us for your data, we tell you, unless the law forbids it, so you can respond.

Pending legal review. Whether we commit to challenge such requests, and how this clause fits Indian law, is open.

13. Liability and which terms win

Pending legal review. Liability under this agreement, its relationship to the limits in our Terms, and which document wins if they conflict (the EU clauses must win where they apply), are for counsel.

Annex A. Security measures in place today

Access

Four workspace roles: owner, admin, supervisor and agent. Exporting or erasing a person's data needs admin or owner.
Passwords are stored as bcrypt hashes.
Two-step sign-in with an authenticator app on any account, which a workspace owner can require for everyone. Turning it on signs out every other session.
Sign-in sessions can be revoked.
API keys carry scopes, can expire, and record when they were last used. API keys are not held to two-step sign-in.
Platform staff see a workspace only through a read-only support view, and opening one is recorded in the admin audit log, as is every change made from the admin console.

Data

Keys and secrets for connected services are encrypted at rest with AES-256 and shown masked.
The site is served over HTTPS with a content security policy.
Webhooks we send are signed with HMAC-SHA256, so the receiver can check they came from us.
Requests to addresses a workspace types in (webhooks, CRM sync, n8n, website import) refuse private and internal network addresses.
A workspace set to private AI never sends a conversation to a hosted model; if the private model cannot answer, the request fails rather than falling back.
Retention periods for recordings, transcripts and chats are applied every six hours.
Every export, erasure, legal hold, retention change and purge is written to the workspace's compliance log.

Resilience

A nightly backup of the database, configuration and uploaded files, verified after it is taken, with a copy on a second server; a restore drill has been run against a real backup.

Not in place yet

The off-server backup copy is not deleted on a schedule.
Some server log lines contain phone numbers, and logs are not deleted on a fixed schedule.
No SOC 2, ISO 27001 or other certificate, and no third-party penetration test report.
We do not claim disk-level encryption of the database or the recordings.

Annex B. Sub-processors

The current list, with what each one does, what it sees and where it is, is on the sub-processor page.