Privacy Policy

Transparency, security, and strict data governance governing how AvulAi collects, processes, and protects your business information.

Effective Date: October 1, 2026

AvulAi provides custom business automation solutions. We operate on a data-minimization philosophy: customer workflow payloads and voice data are processed in transient memory, encrypted end-to-end, and retained only according to explicit customer-defined policies.

1. Overview & Data Controller

AvulAi ("AvulAi", "we", "us", or "our") provides business operations automation, voice telephony agents, and AI workflow integration services to clients globally. This Privacy Policy explains how we collect, store, process, and protect personal and enterprise data when you visit our website (avulai.com) or utilize our automation infrastructure.

For website visitors, AvulAi acts as a Data Controller. For automation workflows, webhook processing, and client CRM integrations, AvulAi acts strictly as a Data Processor under our Master Subscription Agreement and Data Processing Addendum (DPA).

2. Information We Collect

2.1 Information You Provide to Us

  • Contact & Discovery Requests: Name, business email, phone number, company name, monthly operational bottlenecks, and workflow requirements submitted via our audit request forms.
  • Billing & Account Information: Company legal entity, billing contact, transaction metadata (payment processing handled securely via tier-1 PCI-DSS compliant providers; AvulAi does not store raw credit card numbers).
  • Configuration Metadata: API keys, webhook URLs, and endpoint routing credentials supplied to connect your enterprise tools (Salesforce, HubSpot, Slack, WhatsApp, Zendesk).

2.2 Information Processed via Automations

  • Webhook & Event Payloads: Inbound inquiries, customer support tickets, leads, or purchase events forwarded to AvulAi for NLP parsing and routing.
  • System Logs: Timestamps, response latencies, execution status, and delivery receipts generated during automated workflow execution.

3. Voice Calls, Telephony & Audio Processing

When clients deploy AvulAi autonomous voice agents or call booking pipelines:

  • Voice Stream Processing: Caller audio is streamed securely over encrypted WebRTC / SIP trunks to our low-latency neural speech models for speech-to-text (STT) parsing.
  • Transcripts & Summaries: Structured conversational transcripts, intent classifications, and action items are synthesized and synced directly into your connected CRM or database.
  • Consent Disclosures: In accordance with telecommunications regulations (including TCPA and TRAI), clients are required to configure an automated voice disclosure notifying callers that the interaction uses an AI assistant and may be recorded.
  • Audio Storage: By default, raw audio packets are purged immediately after synthesis unless client explicitly enables compliance call recording storage.

4. Purpose & Legal Basis for Processing

We process information pursuant to the following legal grounds under GDPR Article 6 and the India Digital Personal Data Protection (DPDP) Act 2023:

  • Performance of Contract: To build, deploy, execute, and monitor your requested automation workflows and fulfill SLA uptime obligations.
  • Legitimate Interests: To detect security threats, prevent abuse, optimize routing latency, and improve workflow reliability.
  • Consent: Where you provide consent for marketing communications, consultations, or non-essential cookies. Consent can be revoked at any time.
  • Legal Compliance: To comply with applicable tax, financial, and regulatory reporting mandates.

5. Data Retention & Customer-Controlled Purging

We do not hoard your data. Our retention schedules reflect strict proportionality:

  • Transient Memory Processing: Standard API and webhook payloads are processed in RAM and discarded immediately upon successful execution.
  • Execution & Audit Logs: Operational execution records (status codes, execution duration) are retained for 30 days to facilitate debugging, after which they are automatically purged.
  • Voice Call Records: Audio and transcript retention is customer-configurable (default 7 days, 30 days, or instantaneous purge upon CRM sync).
  • Audit Inquiries & Leads: Contact form submissions are retained for the duration of the commercial relationship or until an erasure request is received.

6. Security & Infrastructure Governance

Security is core to everything we engineer:

  • Encryption: AES-256 bit encryption at rest for any persistent databases, and TLS 1.3 encryption in transit for all web and API traffic.
  • Infrastructure: Hosted in SOC 2 Type II and ISO 27001 certified cloud environments (Amazon Web Services and Google Cloud Platform).
  • Access Control: Strict Principle of Least Privilege (PoLP), multi-factor authentication (MFA) required across all internal administration tooling, and automated credential rotation.

7. Cookies & Tracking Technologies

We utilize cookies to ensure site functionality, remember user preferences, and analyze website traffic. We distinguish between:

  • Essential Cookies: Strictly necessary for navigation, security, and session management. Cannot be disabled.
  • Analytical / Performance Cookies: Aggregated, anonymized telemetry (via Google Analytics 4) to understand how visitors engage with our documentation and solution pages.

You can adjust your cookie choices at any time via the cookie banner on our site or by configuring your browser settings to reject non-essential cookies.

8. Your Legal Rights (GDPR, DPDP Act 2023, CCPA)

Depending on your jurisdiction, you possess the following enforceable data protection rights:

  • Right to Access: Request confirmation of whether we process your personal data and obtain a machine-readable copy.
  • Right to Rectification: Request correction of inaccurate or incomplete personal information.
  • Right to Erasure ("Right to be Forgotten"): Request immediate deletion of your personal data where retention is no longer necessary.
  • Right to Data Portability: Obtain your data in a structured, commonly used, and machine-readable format.
  • Right to Object or Restrict Processing: Object to processing based on legitimate interests or request restrictions during ongoing disputes.
  • Right to Withdraw Consent: Revoke consent previously granted at any time without affecting lawful processing prior to revocation.

To exercise any of these rights, email us at privacy@avulai.com. We respond to all verified requests within 30 days.

9. Subprocessors & International Transfers

To deliver high-availability automations, we utilize vetted third-party service providers (cloud hosting, database management, and telephony infrastructure). All subprocessors undergo rigorous security review and are bound by Data Processing Agreements incorporating EU Standard Contractual Clauses (SCCs) to ensure cross-border transfer compliance.

10. Contact Our Data Protection Team

For questions, privacy grievances, or to request a signed Data Processing Addendum (DPA), please contact:

AvulAi Data Governance & Privacy Office
Email: privacy@avulai.com
Enterprise Inquiries: legal@avulai.com