1.Where we stand
We are an Indian company and we host the application, databases, and file storage on Oracle Cloud Infrastructure in India. We act as a data fiduciary for our own website, billing, and account data, and as a data processor for the personal data our customers put into their workspaces.
We do not hold a telecom authorisation to carry public telephone traffic ourselves. Calls to and from the public telephone network travel over licensed carrier partners. If you use Callfora in India with Indian numbers, the carrier or authorised operator that supplies the numbers is responsible for the regulated telecom service.
2.Data protection
| Law | What it requires | How it is handled |
|---|---|---|
| Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Notice and consent (or another listed lawful use), purpose limitation, security safeguards, breach notice to the Data Protection Board and affected people, grievance redress within 90 days, and rights to access, correction, erasure, and nomination. The Rules were notified on 13 November 2025: consent-manager rules apply from 13 November 2026 and most remaining duties from 13 May 2027. | We publish a grievance process, run security safeguards, and give customers tools to export and delete data. Our DPA sets processor duties. We are preparing for the May 2027 duties ahead of time. |
| Information Technology Act, 2000 and the SPDI Rules, 2011 | Reasonable security practices for sensitive personal data; a published privacy policy; a Grievance Officer. | See our Privacy policy and Privacy requests and grievances page. |
| Cross-border transfers (DPDP Act s.16) | Transfers abroad are allowed unless the Government restricts a country, and stricter sectoral rules still apply (for example RBI and IRDAI data localisation). | Customer data is stored in India. Subprocessors outside India are listed on our Subprocessors page. |
3.Telecom rules
The Telecommunications Act, 2023 replaced the older licensing regime with authorisations. Cloud EPABX, hosted telephony, and similar enterprise communication services are treated as regulated services when they connect to the public telephone network, so they must be delivered through an authorised operator. Internet-to-internet calling and messaging inside the app is generally outside that requirement. Rules published in 2026 also create a cloud-hosted telecommunication network authorisation for infrastructure providers.
Commercial calls and SMS are governed by the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR) and their amendments, including the Third Amendment of September 2026. Senders must register on the operators' DLT platforms, register sender IDs and message templates, record consent, scrub against the Do Not Disturb registry, and declare automated (A2P) calling in advance. Traffic that skips these steps is treated as unsolicited commercial communication and can be blocked.
4.Call recording
Indian law does not forbid a party to a call from recording it, but recordings are personal data. Tell people that the call is recorded and why, keep recordings only as long as needed, and keep them secure. Interception of other people's calls by anyone but the State is unlawful.
5.AI agents
There is no general AI statute in India. The IT Rules and MeitY advisories on synthetic and deceptive content apply, and the DPDP Act applies to the personal data AI agents process. Our AI agents terms require customers to tell callers they are speaking with an AI and to offer a human option.
6.Your responsibilities
- Use only operators and numbers that are authorised for the service you offer.
- Register on the DLT platform before sending commercial SMS or making promotional calls.
- Give a clear notice and collect consent where the DPDP Act requires it, and keep consent records.
- Follow sector rules (banking, insurance, health) on data location and retention.
This page is a general summary of how Callfora approaches the law in this region. It is not legal advice, laws change, and your obligations depend on your own facts. Ask your counsel before relying on it.
Need help with this document?
Choose the route that matches your question. These links do not replace the terms above.