How we handle personal data, and which of two roles we are in.

This notice covers two very different situations, and almost every question about our handling of personal data is answered by working out which one you are in.

We use the terms Data Fiduciary, Data Processor and Data Principal as they are defined in India's Digital Personal Data Protection Act, 2023.

We keep this deliberately short, because we collect little.

• What you give us. Your name, work email, phone number, company and role when you request a call, book a demo, or write to us. Your CV and application details if you apply for a role.
• What your browser sends. IP address, device and browser type, pages viewed, referring source and approximate location derived from IP, through our analytics.
• The demo call itself. If you ask our AI to call you, that call is recorded and transcribed so we can show you what happened on it and improve the product. Demo-call audio may be recorded, with notice and consent given at the start of the call, and is retained only as long as needed for follow-up and then deleted.

We do not buy personal data to market to you, and we do not sell yours. If a message from us appears unsolicited, it came from publicly available business contact information, and every message carries a route to stop.

If you received a call from an AI agent about a loan, a policy, a bill or an account, we ran that call as a service provider to the company you hold that relationship with. We did not choose to call you and we do not decide what happens with the outcome.

Your rights are exercised with that company, not with us. Ask them for their privacy notice and their grievance officer. If you tell us instead, we will pass your request to them promptly and confirm that we have done so, but they are the party that must act on it.

What we do on their instruction is bounded: we process only the data they provide or the call generates, only for the purpose in their contract, under the controls set out in our data processing terms. We do not use their customers' data to build products for anyone else.

You can withdraw consent at any time. Where consent was the only basis, we stop and delete, except where we must keep a record to evidence the withdrawal itself.

Recording is central to what we sell, so we are explicit about it. Every conversation our platform runs is recorded, transcribed and scored. That is the point: it is what lets a client audit the whole book rather than a five per cent sample.

• For calls run for a client, the recording belongs to that client's programme and is held under their contract and instructions.
• For a demo call you requested from this site, the recording exists so we can show you the transcript and improve the product.
• Recordings are encrypted at rest and in transit, and access is limited to the people who need it for the programme they work on.

Retention periods: website enquiry data is kept for 12 months; demo-call recordings are kept only as long as needed for follow-up and then deleted; analytics data is kept for 1 month; job applications are kept for 1 month; and client programme data is kept per the client contract.

The principle we hold to, whatever the periods say: we keep website enquiry data only while a commercial conversation is genuinely live or legally required, and we delete rather than archive by default.

We use a small number of sub-processors to run the business and deliver the service, including for hosting, telephony and speech services. They act on our instructions, under contract, and none of them may use your data for their own purposes.

The specifics are covered in each client's MSA or DPA, and a current list of our sub-processors is available on request. We notify you of changes to that list.

We do not disclose personal data to anyone else except where the law requires it, and where that happens we will tell you unless we are prohibited from doing so.

Data is held in India. Client conversation data is stored in-region, encrypted, access-controlled and kept logically separated per client so it is never mixed across accounts.

No client data is stored or processed outside India.

• Access. A summary of the personal data we hold about you and what we do with it.
• Correction and completion. Have inaccurate or incomplete data corrected.
• Erasure. Have data deleted where we no longer need it and no law requires us to keep it.
• Withdrawal of consent. At any time, as easily as you gave it.
• Grievance redressal. Raise a complaint with our grievance officer and get a response.
• Nomination. Nominate someone to exercise these rights if you are unable to.

Write to our grievance officer, Maaz Ansari (maaz@oriserve.com), at our correspondence office, 4th Floor, C-15, Sector-3, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301. Our registered office is 15 F, Bapurao Jagtap Marg, Jacob Circle, Mumbai, Maharashtra 400011. We will acknowledge a data-rights request within 7 days and respond substantively within 30 days. If we cannot resolve your complaint, you may escalate to the Data Protection Board of India.

Analytics on this site is consent-gated: no non-essential analytics or cookies run until you accept them via the cookie banner, and you can decline or change your choice at any time.

Our position, whatever the final mechanism: analytics that tells us which pages help a buyer is worth having, and nothing on this site needs to follow you around the internet to achieve it.

We hold ISO 27001:2022 certification for our information security management system, with SOC 2 and ISO 42001 on the roadmap. Data is encrypted in transit and at rest, access is role-based and logged, and changes to production are controlled and reviewable.

The trust centre carries the detail security teams usually ask for. Our ISO 27001:2022 certificate is IC-IS-2505161, issued by INTERCERT and valid to 2028.

This website and our services are built for business use and are not directed at children. We do not knowingly collect personal data of children through this site. Where our platform calls a customer of a client, the client is responsible for who is on their calling list.

When we change this notice we will update the version and date at the top. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you to re-read the page.