1.Who we are
Callfora is operated by Vedatra Scalable Stacks Private Limited, a company registered in Bengaluru, Karnataka, India. For privacy questions, requests, or grievances, contact support@callfora.com or use the Privacy requests and grievances page.
For data our customers put into the service (for example call records, messages, recordings, and contacts), the customer organization decides how it is used and we process it on the customer's behalf under our Terms and Data processing addendum. In that case we are the processor (or data processor) and the customer is the controller (or data fiduciary).
2.What we collect
| Category | Examples | Source |
|---|---|---|
| Website and contact | Name, work email, company, phone number if given, topic and message, page you sent it from, browser type, a one-way hash of your IP address for abuse prevention. | You, your browser |
| Account and billing | Name, email, phone number, company details, tax identifiers, billing contact. Payment card details are collected by our payment processor, not by us. | You, your organization |
| Service content | Calls and call detail records, voicemail, recordings, SMS and MMS, chat messages, meetings, contacts, calendar events, files, and AI agent conversations and transcripts, as configured by the customer. | Your organization and its users and contacts |
| Technical | IP address, device and browser information, log data, diagnostics, and push-notification tokens. | Your devices |
| Voice data | Audio of calls handled by AI agents or recorded by the customer, and transcripts made from it. | Callers and the customer |
3.How we use it, and our legal bases
To provide, maintain, and secure the service; to connect calls and deliver messages through telecom carriers; to reply to inquiries; to bill customers; to prevent fraud and abuse; to improve reliability; and to meet legal and regulatory obligations, including carrier registration and lawful requests.
| Purpose | Legal basis (GDPR/UK) | India (DPDP Act) |
|---|---|---|
| Providing the service to customers | Contract; for service content, we act on the customer's instructions | Customer's lawful use; our processor duties |
| Replying to website inquiries | Legitimate interests; steps before a contract | Consent given by sending the form |
| Billing and tax | Contract; legal obligation | Legitimate use for legal obligations |
| Security, abuse prevention, and troubleshooting | Legitimate interests | Legitimate use |
| Product communications to account users | Contract; legitimate interests | Consent or legitimate use |
We do not sell personal data, we do not use customer service data to build advertising profiles, and we do not use it to train our own AI models.
5.Where data is stored and international transfers
The service is hosted with Oracle Cloud Infrastructure in India. Some providers, such as telecom carriers, email delivery, payment processing, and AI processing, may process data in other countries, including the United States. Where the law requires it, we use safeguards such as the EU Standard Contractual Clauses, the UK Addendum, and contractual commitments from subprocessors.
6.How long we keep it
Website inquiries are kept for up to 24 months after our last contact with you. Customer service data is kept according to the customer's plan and settings, and deleted or returned after the customer account closes as described in the Data processing addendum and Data retention and deletion page. We keep billing records for as long as tax law requires.
7.Your rights
Depending on where you live, you can ask to access, correct, delete, or receive a copy of your personal data, withdraw consent, object to or restrict processing, and complain to a regulator. Send requests to support@callfora.com. If your data is held on behalf of one of our customers, we will pass your request to that customer. We aim to respond within 30 days, and within the shorter period your law sets.
| Region | Law | Rights and routes |
|---|---|---|
| India | Digital Personal Data Protection Act, 2023 and Rules, 2025 | Access, correction and erasure, grievance redress (we respond within the time the Rules require, no more than 90 days), and nomination. If unresolved, you can complain to the Data Protection Board of India. |
| EEA and Switzerland | GDPR and FADP | Access, rectification, erasure, restriction, portability, objection, and not to be subject to certain automated decisions. You can complain to your supervisory authority. |
| United Kingdom | UK GDPR and Data Protection Act 2018 | Same rights as the GDPR. You can complain to the Information Commissioner's Office. |
| United States | California and other state privacy laws | Know, access, delete, correct, and opt out of sale or sharing. We do not sell or share personal data for cross-context advertising. You will not be treated worse for using these rights. |
| Canada, Australia, Singapore, Brazil, others | PIPEDA and Quebec Law 25, Privacy Act 1988, PDPA, LGPD, and similar laws | Access, correction, and complaint rights under local law. Write to us and we will apply the law that fits your location. |
8.Automated decisions and AI
Our AI agents and insight features process voice and text to answer questions, route calls, and summarise conversations. They are configured by our customers. We do not use them to make decisions with legal or similarly significant effect about individuals without human review. See the AI agents terms.
9.Security
We use encryption in transit, encrypted storage for credentials and secrets, organization-level access controls, and audit logging. No system is perfectly secure; tell us about suspected issues through the Vulnerability disclosure page or the contact on our Trust page. If a personal data breach affects you, we will notify you and regulators as the law requires.
11.Children
The service is for businesses and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
12.Changes
We will post changes here and update the date above. For material changes we will notify customers by email or in the service.
Need help with this document?
Choose the route that matches your question. These links do not replace the terms above.