1.Our approach
Vedatra Scalable Stacks Private Limited is registered in Bengaluru, Karnataka, India. We design the service so that customers can meet the rules that apply to them: recording notices and consent tools, organisation-level data isolation, role-based access, audit logs, data export and deletion, signed webhooks, and records that support consent and opt-out handling.
We list the laws we track on the regional pages. Listing a law is not a claim of certification or an assurance that using the service makes you compliant. Compliance depends on how a customer configures and uses the service, who they contact, and where.
3.Where the service is available
Phone numbers and carrier services are currently provided for the United States. Customers elsewhere can use app-to-app calling, messaging, meetings, and the web and mobile apps, and can request phone service in another country through a licensed local carrier. We tell you before purchase if we cannot support a country.
4.Certifications and assurance
We do not currently hold third-party certifications such as SOC 2 or ISO 27001. We answer security questionnaires, provide a countersigned DPA on request, and describe our controls on the Trust page. We will publish certifications here only after they are issued.
5.Region-by-region matrix
Select a region for the details. The table below is a short summary and does not replace the regional page.
| Region | Data protection | Call recording | Messaging | Outbound calling | AI agents |
|---|---|---|---|---|---|
| India | DPDP Act 2023 and Rules 2025; IT Act 2000 and SPDI Rules | No general bar on a party recording; notice and consent expected under the DPDP Act | TRAI TCCCPR 2018 (as amended): DLT registration, templates, DND scrubbing | TRAI DLT and A2P call declaration; PSTN access only through authorised operators | No AI-specific statute; MeitY advisories and IT Rules apply to synthetic content |
| United States | CCPA/CPRA and other state privacy laws; sector laws (HIPAA, GLBA, COPPA) | Federal one-party consent; about a dozen states require every party's consent | TCPA, CTIA guidelines, 10DLC and toll-free registration, state mini-TCPAs | TCPA, Telemarketing Sales Rule, STIR/SHAKEN, National Do Not Call Registry | AI voices count as artificial voice under the TCPA; some states regulate AI disclosure |
| European Economic Area and Switzerland | GDPR; Swiss FADP; national laws | ePrivacy Directive and national law; a lawful basis and clear notice; consent is often needed | ePrivacy Directive: consent for electronic marketing, with a soft opt-in for existing customers in many states | National rules; many states require prior consent or register opt-outs for telemarketing | EU AI Act Article 50 (from 2 August 2026): people must be told they are talking to AI |
| United Kingdom | UK GDPR; Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 | Lawful Business Practice Regulations 2000 allow recording for listed business purposes with notice | PECR: consent for marketing texts, with a soft opt-in; fines now at UK GDPR levels | PECR and the TPS/CTPS registers; Ofcom rules on caller ID | No single AI statute; ICO guidance and UK GDPR automated decision rules |
| Canada | PIPEDA; Quebec Law 25; Alberta and British Columbia PIPA | One-party consent under the Criminal Code; privacy law still requires notice | CASL: express or implied consent, sender identification, and a working unsubscribe | CRTC Unsolicited Telecommunications Rules and the National Do Not Call List | No federal AI statute in force; Quebec requires notice of automated decisions |
| Australia and New Zealand | Australia: Privacy Act 1988 and APPs. New Zealand: Privacy Act 2020 | Australia: recording a private call needs consent or knowledge of the parties. New Zealand: one-party consent | Spam Act 2003 (AU) and Unsolicited Electronic Messages Act 2007 (NZ): consent and unsubscribe | Do Not Call Register Act 2006 (AU); telemarketing standards | No AI-specific statute; privacy law transparency rules for automated decisions are phasing in (AU) |
| Asia-Pacific | PDPA (SG, MY, TH); APPI (JP); PIPA (KR); PDPO (HK); PDP Law (ID); Data Privacy Act (PH) | Consent or notice expected; employee monitoring needs a stated purpose | Opt-in or do-not-call registers in many markets (for example Singapore DNC Registry) | Do-not-call registers and sender ID rules; carrier licensing varies | Voluntary frameworks (Singapore Model AI Governance Framework); Korea AI Basic Act |
| Middle East | UAE PDPL (Federal Decree-Law 45/2021); Saudi PDPL; Qatar PDPPL; Bahrain PDPL | Disclose and obtain consent; recording without it can be an offence | Sender ID registration and opt-in rules apply | VoIP must be delivered by licensed operators (UAE: TDRA licensees) | No AI-specific statute; data protection law applies |
| Latin America | Brazil LGPD; Mexico LFPDPPP; Argentina Law 25.326; Colombia Law 1581; Chile Law 21.719 | Generally lawful for a participant; privacy law still requires notice and a stated purpose | Opt-in and do-not-contact registers in several countries (for example Brazil's state registers) | Telemarketing rules and registers vary by country | Brazil's AI bill under discussion; LGPD automated-decision rights apply |
| Africa | South Africa POPIA; Nigeria NDPA 2023; Kenya DPA 2019; Egypt PDPL 151/2020 | South Africa allows recording with a party's consent; privacy laws require notice | Opt-in required; South Africa has a national opt-out register | Telemarketing opt-out registers and licensing for voice services | No AI-specific statute; data protection law applies |
Need help with this document?
Choose the route that matches your question. These links do not replace the terms above.