Privacy Policy

Vaanik is a platform that lets businesses build and run AI agents that answer and place phone calls, reply on chat and messaging channels, and take actions in connected business tools. This policy is written to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules under both, and, where they apply to you, other data protection laws such as the GDPR.

1. Who we are and when this policy applies

“Vaanik”, “we”, “us” and “our” mean DeepNudge Labs, the operator of the Vaanik platform, website and related services (together, the “Platform”). Our role depends on whose data it is:

• Customers, workspace users and website visitors. For data about you as an account holder, team member, prospective customer or visitor, we decide why and how it is used. We are the Data Fiduciary (or “controller”) and this policy applies in full.
• People who interact with our customers’ agents. When a business uses Vaanik to call you, answer your call or message you, that business decides what its agent does with your data. The business is the Data Fiduciary, and we process your data on its behalf as a Data Processor under our Data Processing Agreement. That business’s privacy notice governs your data, so direct requests to it first. Section 8 explains how we can help.

2. Personal data we collect

2.1 Account and workspace data

When you sign up, are invited to a workspace, or manage an account, we collect your name, work email address, phone number, company name, role and permissions, and your password (stored only in hashed form). If you sign in with Google, we receive your name, email address and profile picture from Google.

2.2 Billing data

We collect billing contact details, billing address, GSTIN where provided, credit purchases, invoices and payment status. You enter card, UPI and bank details directly with our payment processor. We do not receive or store full card numbers.

2.3 Conversation and customer data

On behalf of our customers, the Platform processes:

• Call data: phone numbers, call times and duration, call recordings and transcripts
• Message data: chat, WhatsApp and Instagram messages exchanged with an agent
• Contact records: names, phone numbers, email addresses, lead details, and other information a customer imports or an agent captures during a conversation
• Outcomes: summaries, extracted details and follow-up actions generated from conversations
• Knowledge and workflow content: documents, instructions and records that customers upload or connect for their agents to use

Our customers decide what this data includes, and are responsible for collecting only what they need.

2.4 Website data

When you request a demo or a callback, we collect your name, phone number, email address and company. If you ask for a live demo call, an AI agent will call the number you provide. If you use the demo chat, we process the messages you send. We also use analytics to understand how visitors use our website. See our Cookie Policy.

2.5 Technical and usage data

We collect IP addresses, browser and device information, activity logs and records of Platform usage. We use this data to operate, secure, meter and bill the Platform.

2.6 Communications with us

We keep the emails, support requests and feedback you send us, and our replies.

3. How we use personal data

Where we rely on your consent, you can withdraw it at any time by emailing [email protected]. Withdrawal does not affect processing that has already taken place, but we may no longer be able to provide the service that depended on it.

4. How we use AI, and what we don’t do

Agents on the Platform use AI to understand speech, generate replies, speak and summarise conversations. To do this, conversation content is processed by the AI and speech services described in section 6.

• No model training. We do not use customer data, conversations or recordings to train or fine-tune AI models, and our providers’ terms don’t let them train on it either.
• No selling or advertising. We do not sell personal data, and we do not use it for advertising or advertising profiles.
• Limited human access. Our staff access conversation content only when a customer asks us to investigate an issue, when it is needed for security or abuse investigations, or when the law requires it.
• AI can make mistakes. Transcripts, summaries and replies generated by AI may contain errors, and should be reviewed before being relied on for important decisions.

Our customers are responsible for telling the people their agents contact that they are speaking with an automated agent and that calls may be recorded, wherever the law requires it.

5. Connected accounts

5.1 Google user data

Customers can connect Google accounts to the Platform. We access only what each connection requires: basic profile information for Google Sign-In, calendars and events so agents can check availability and manage appointments, and only the spreadsheets a customer selects so agents can read and update them.

Vaanik’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you have connected. We do not sell it or use it for advertising, and we do not use it to develop, improve or train generalised AI or machine learning models. We do not let people read it unless you ask us to, it is needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations. You can disconnect a Google account in your workspace, or revoke access at myaccount.google.com/permissions, at any time.

5.2 WhatsApp, Instagram and Facebook

When a customer connects a WhatsApp Business, Instagram or Facebook account, we receive the messages, comments and lead details sent to that account. We use them only so the customer’s agents can respond and follow up. To have this data deleted, disconnect the account in your workspace and email [email protected] asking us to delete the data received from it. We will confirm when it has been deleted.

5.3 Customer-supplied services

Some customers connect their own telephony, messaging or AI provider accounts. Data sent to those services is handled under the customer’s own agreement with each provider, not under our sub-processor arrangements. We store the credentials for these connections encrypted, and use them only to carry out the customer’s workflows.

6. Who we share personal data with

We share personal data with trusted service providers (“sub-processors”) who help us run the Platform, and only as needed for the purposes in section 3. Each is bound by a written agreement that requires confidentiality and appropriate security. They fall into these categories:

Customers can request our current sub-processor list at [email protected]. We may also disclose personal data:

• to the customer whose workspace the data belongs to, and to the users it authorises
• to courts, regulators, law enforcement or telecom authorities where the law requires it, or where needed to protect people, the Platform or our legal rights
• to a successor if our business is merged, reorganised or sold, who must continue to protect it in line with this policy

7. Where data is stored

The Platform’s primary infrastructure, including databases, file storage and call records, is hosted in India. Some AI and speech services process data outside India, mainly in the United States. The DPDP Act permits such transfers except to countries the Government of India restricts. We make them under contracts with appropriate safeguards, and will stop any transfer the law prohibits.

8. Your rights

Under the DPDP Act, and similar laws where they apply to you, you have the right to:

• get information about the personal data we process about you and who we have shared it with
• have inaccurate or incomplete data corrected, completed or updated
• have your data erased when it is no longer needed, unless the law requires us to keep it
• withdraw consent, and object to processing where the law allows
• nominate another person to exercise these rights if you die or become incapacitated
• have your grievances addressed by us, and then take them to the Data Protection Board of India

To exercise a right, email [email protected] from the address linked to your account, or give us enough detail to identify you. We may need to verify your identity. We will respond within 30 days.

If an agent called or messaged you: contact the business that runs the agent, because it controls your data. If you don’t know which business it was, email us with the phone number and date. We will pass your request on and help that business respond. To stop further calls, tell the agent or the business. Businesses using Vaanik must honour opt-out requests.

9. How long we keep data

• Account data is kept while the account is active, and deleted within 90 days after the workspace is closed.
• Conversations, recordings, transcripts and contacts are kept while the workspace is active, unless the customer deletes them sooner. They are deleted within 90 days after the workspace is closed.
• Invoices and payment records are kept for as long as tax and accounting laws require, generally up to eight years.
• Demo and callback requests are kept for up to 24 months after our last contact, unless you become a customer or ask us to delete them sooner.
• Security logs are kept for as long as needed to investigate incidents and meet legal obligations.

Deleted data may remain in encrypted backups for up to 30 more days before those backups are overwritten.

10. Security

We protect personal data with technical and organisational safeguards, including:

• encryption in transit and at rest
• encrypted storage of integration credentials and API keys
• logical separation of each workspace’s data
• role-based access controls, and restricted, logged administrative access for our staff
• confidentiality obligations for everyone with access to personal data

No system is completely secure. If a personal data breach affects you, we will notify the Data Protection Board of India and the affected people as the DPDP Act requires. Where we act for a customer, we will notify that customer under our Data Processing Agreement. To report a security concern, email [email protected].

11. Cookies and similar technologies

We use browser storage to keep you signed in, and analytics cookies to understand how our website is used. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details and how to opt out.

12. Children

The Platform is a business service for people aged 18 and over, and we do not knowingly collect children’s personal data. Customers must not use agents to target children, or process children’s data without the verifiable parental consent the DPDP Act requires. If you believe a child has given us personal data, email us and we will delete it.

13. Changes to this policy

We update this policy when our practices or legal obligations change, and revise the date at the top of this page. If a change is material, we will notify account holders by email or in the console before it takes effect.

14. Contact and Grievance Officer

For questions, requests or complaints about this policy or your personal data, contact our Grievance Officer. We acknowledge grievances within 72 hours and aim to resolve them within 30 days.

Grievance Officer, DeepNudge Labs (operating as Vaanik)
First Floor, Arti Group, C-88, Sector 65, Noida, Uttar Pradesh 201301, India
Email: [email protected] (subject: “Grievance Officer”)

If your grievance is not resolved, you may complain to the Data Protection Board of India.