Privacy policy

1. Who we are

Calls & Enquiries is run by Cyepro Solutions Pvt Ltd (“Cyepro”, “we”, “us”), #3,4,5,6 Survey No. 58/1, 1st Floor, The Regent Square, Gowlidoddy, Financial District, Gachibowli, Hyderabad, Telangana 500075. This policy covers the Calls & Enquiries app, the Cyepro control room, the Cyepro API, and the phone services we run for our clients: phone numbers, call routing, recording, the browser phone, office phone connections, masked calls and the AI receptionist.

Our website has its own policy at cyepro.com/privacy-policy.

2. Our two roles

For people who call one of our clients, and their customers. Our clients are businesses whose staff take and make calls. Each client decides why and how its callers’ and customers’ data is used, so the client is the Data Fiduciary under the Digital Personal Data Protection Act, 2023. Cyepro handles that data only on the client’s behalf and on its instructions, as its Data Processor. If you called one of our clients, please ask that business first about your data; we help them answer.

For our clients’ accounts. For the people who sign in to our app, and for the business, KYC and billing details of each client, Cyepro decides how the data is used and is the Data Fiduciary.

3. What we collect

About callers and customers (for our clients)

• Phone number, and a name if the caller or the business gives one.
• Call details: when, how long, which number and department, who answered, menu keys pressed, queue and transfers.
• Call recordings, unless the business switches recording off, and the text made from them.
• Details found in the conversation, such as the product or service asked about, and the enquiry, callback and notes made from it.
• Messages the business sends to the customer.
• For masked calls: both real numbers, kept only while the masked number is active.
• For the AI receptionist: the conversation, with long numbers such as card or ID numbers removed before it is stored.

About our clients’ staff

• Name, email address, mobile number, role, branch and department.
• Sign-in records, availability and breaks, and whether the browser phone is online.
• Calls they took or made, and the results used in reports.

About our clients’ businesses

• Business name, address, GSTIN and billing contacts.
• KYC details and documents needed to give out phone numbers in India: the business’s legal name, registration number, GSTIN, registered address and authorised signatory, the registration certificate (incorporation or Udyam) and GST certificate, and, when given, PAN, the signatory’s ID, address proof and a letter of authorisation.
• Wallet balance, payments, invoices and usage.

Technical data

• IP address, browser and device type, and logs, used to keep the service running and secure.

4. Why we use it

• To connect, route, queue, record and transfer calls, and to run the browser phone, office phone connections, masked calls and the AI receptionist.
• To turn calls into text and enquiries, suggest callbacks, and show the business its reports.
• To bill each client: usage, wallet, invoices and payments.
• To meet telecom rules in India, such as KYC for phone numbers and answering spam complaints, and other legal duties such as tax records.
• To keep the service secure, find faults and prevent misuse.
• To support our clients when they ask for help.

5. What we never do

• We do not sell personal data.
• We do not use callers’ or customers’ data for our own marketing or advertising.
• We do not use our clients’ data to train AI models.

6. Call recording and the AI receptionist

• Before recording starts, callers hear that the call is recorded and turned into notes. A business can let callers press 9 to turn recording off for their call: the call still reaches the team, but nothing is recorded or transcribed.
• Staff can pause the recording while a caller shares card or ID details; it resumes on its own after a few minutes.
• The AI receptionist says at the start that it is an automated assistant and that the conversation is turned into text. The caller can ask for a person at any time, or press 0.

7. Who we share it with

We share personal data only with the service providers below, and only what each needs to do its job for us:

• Our licensed telephony carrier, to give out phone numbers, connect and record calls, check KYC and handle spam complaints.
• Sarvam AI (India), to turn recordings and AI receptionist speech into text and to speak the AI receptionist’s replies.
• Anthropic (USA), the AI model that summarises calls and holds the AI receptionist’s conversation.
• Razorpay, to take payments. Card and bank details are entered on Razorpay’s page; we never see or store them.
• Supabase, our database and file storage, in Mumbai, India.
• Business software a client chooses to connect, such as its CRM, through the integrations and API it switches on.

We also share data with government or regulators, such as the telecom department or the police, when Indian law requires it.

8. Where it is stored

Our database and files are stored in Mumbai, India. Some providers above work outside India: the AI model provider is in the USA, and the telephony carrier may route or process calls outside India. We transfer data abroad only as Indian law allows.

9. How long we keep it

• Call recordings: 180 days. Call text and messages: 365 days. Each business can choose a shorter or longer period, from 7 days to 10 years. When a recording is deleted, the carrier’s copy is deleted too.
• Masked calls: the real phone numbers are removed when the masked number ends.
• KYC documents: while the client’s numbers are in use, and afterwards for as long as telecom rules require.
• Invoices, payments and other tax records: as long as Indian tax law requires, usually 8 years.
• Staff accounts: until the business removes the person, then only in records the law or our audit needs.

10. How we protect it

• All traffic is encrypted (HTTPS/TLS), and passwords for connected phone and business systems are stored encrypted.
• Everyone signs in, and each role sees only what it needs. Callers’ recordings and text are visible only to roles allowed to see them.
• Cyepro staff open a client’s account only for support, read-only by default and for a limited time, and every action is logged where the client can see it.
• Calls from the carrier and from connected systems are checked with signatures; API access needs a key the client creates and can revoke.

11. Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask:

• for a summary of your personal data and how it is used;
• to correct, complete or update it;
• to erase it, where it is no longer needed and the law does not require us to keep it;
• to withdraw consent you gave, for the future;
• to name someone who can use these rights for you if you die or cannot act;
• to have a complaint about your data handled.

If you called one of our clients, you can ask that business, or write to us at privacy@cyepro.com and we will pass your request to it and help it answer. If you are not satisfied with the reply, you can complain to the Data Protection Board of India.

12. If something goes wrong

If personal data is exposed, we tell the affected clients without delay and help them inform the people affected and the Data Protection Board of India, as the law requires.

13. Children

Our app is for businesses and their staff, who must be 18 or over. We do not knowingly collect children’s data. If a child calls a business, the call is handled like any other call; tell the business or write to privacy@cyepro.com to have it removed.

14. Cookies

The app uses only the cookies and browser storage it needs: to keep you signed in, protect your session and remember choices such as your branch. It uses no advertising or tracking cookies.

15. Changes to this policy

When we change this policy we update the date at the top and tell our clients about important changes in the app before they take effect.

16. Contact and grievance officer

For questions, requests or complaints about personal data, contact our Grievance Officer: