Data Processing Agreement

Draft version 2026-11-09 · pending review by a qualified lawyer before commercial launch

Roles

For the contact lists, calls, recordings and transcripts in your account, you are the controller (data fiduciary under India's DPDP Act) and Vaakto is your processor. For your own account details (users, billing) Vaakto is the controller, as described in the Privacy Policy.

What we process and why

Phone numbers, names and consent records you upload; call records; recordings; transcripts and AI analysis; opt-out entries. We process them only to provide the service you configure (placing and receiving calls, the AI agent, analytics) and on your documented instructions.

Sub-processors

Telephone carriers, speech and AI providers (Sarvam AI, Deepgram), Google (push notifications, calendar), Razorpay (payments) and email delivery. We use each only for its part of the service and will tell you before adding a new one.

Security

Encrypted connections, per-customer data separation, access controls, hashed passwords, and logged, reason-based staff access to customer recordings and transcripts.

Your rights and requests

We help you answer requests from the people you call (access, correction, deletion, objection to marketing, consent withdrawal), keep opt-outs on your do-not-call list, and delete your data when you close your account, except records the law requires us to keep (for example invoices).

Breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your data.

Retention

Recordings follow your plan's retention period; other data is kept while your account is active and deleted or returned on request when it ends.

Contact

Questions: support@vaakto.com. Related: Terms · Privacy · DPA · Acceptable use · AI calling policy.