Privacy Policy

How CallPilot collects, uses and protects personal data when businesses use the CallPilot app and its AI calling service.

1. Who we are and what this covers

CallPilot lets a business (the “owner”) set up an AI employee that phones the business’s leads, records and transcribes the conversation, scores interest and drafts follow-up messages for the owner to review. This policy covers the CallPilot Android app, its backend and the calls it places. It is written with the Digital Personal Data Protection Act, 2023 (DPDP Act) in mind.

For the owner’s own account, CallPilot is the Data Fiduciary. For the leads a business uploads and calls, the business decides why and whom to call, so the business is the Data Fiduciary and CallPilot processes that data on the business’s behalf.

2. Data we collect

• Owner account: name, email address and profile photo from Google Sign-In, or a mobile number if you sign in with an OTP; business name, category, contact numbers, address, offerings, pricing and the settings of your AI employee.
• Leads: the names, phone numbers, interests and notes of the people you add, type in, import from a file or pick from your phone’s contacts, plus their consent and do-not-call status.
• Phone contacts: only if you allow the contacts permission and only the contacts you choose to import. We do not upload your address book.
• Calls: call status, time and duration; audio recordings and transcripts of AI calls; AI-generated summaries, lead scores and suggested follow-ups.
• Microphone: when you use “talk to your AI employee” to test it, your voice is streamed to our speech provider for that live conversation. We do not use it for anything else.
• Knowledge you add: website addresses, documents and text you give the AI employee to learn from.
• Device and usage: a push-notification token, app version, minutes used, crash reports (device model, OS version and the error when the app crashes) and technical logs (IP address, request times, errors) that keep the service secure and working.

3. Why we use it

• To create and secure your account and sign you in.
• To place AI calls to your leads during allowed hours, transcribe and summarise them, score the lead and draft follow-ups.
• To notify you about hot leads, callbacks and follow-ups.
• To measure calling minutes against your plan and handle billing.
• To prevent abuse, honour opt-outs, keep the service reliable and meet legal obligations.

We do not sell personal data and do not use your leads’ data to market to them ourselves.

4. AI calls and recording

Calls are made by an AI voice agent, not a person, on behalf of the business named in the call, and the person called should be told at the start that they are speaking with an AI and that the call is recorded. Calls are recorded and transcribed so the owner can review them and so the lead can be scored. If a lead asks not to be called again, CallPilot marks the number as do-not-call for that business and stops calling it.

Stop all CallPilot calls: anyone can enter their phone number at /stop and no business using CallPilot will call that number again. We keep only a one-way hash of the number, not the number itself.

5. Who processes the data for us

• Cloudflare (hosting, database, file storage, queues and AI models) — our backend runs on Cloudflare.
• Sarvam AI — telephony, the AI voice agent, speech recognition and speech synthesis for calls and voice tests.
• Google Firebase — Google Sign-In, push notifications and crash reporting (Crashlytics).
• Our payment processor, if you buy a paid plan (we never see full card details).

These providers act on our instructions under their own security and privacy terms. Some of them may process data outside India; where they do, we rely on the safeguards the DPDP Act allows.

6. How long we keep it

• Call recordings, transcripts and AI summaries are deleted 180 days after the call; the call’s date, duration, status and score are kept for reporting.
• Account, lead and call data are kept while your account is active and deleted when you delete your account.
• Transcripts and recording links are encrypted at rest.
• Database backups are kept for up to 30 days and then overwritten, so deleted data disappears from backups within that time.
• Security and webhook logs are kept for up to 90 days.
• We may keep billing records for as long as tax law requires.

7. The owner’s responsibilities

If you use CallPilot to call people, you must have a lawful basis and, where needed, their consent to call them and to record the call; you must respect TRAI rules, the National Customer Preference Register (DND) and opt-outs; and you must tell them how to reach you about their data. See our Terms of Service.

8. Your rights

Under the DPDP Act you can ask to access, correct, update or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Owners can edit most data in the app and can delete their account at any time (see Delete your account). If you were called by a business using CallPilot, contact that business first; you can also write to us and we will pass your request on and help the business act on it.

9. Grievance Officer

Name: [to be appointed]
Email: founder@olitun.in

We aim to acknowledge grievances within 48 hours and resolve them within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

10. Children

CallPilot is a business tool for adults. We do not knowingly create accounts for anyone under 18.

11. Changes

We will update this page when our practices change and tell owners in the app about significant changes.