Last updated: 1 July 2026

This document is written in plain language for transparency. It is not legal advice, and it does not replace a signed agreement where one applies. If anything here conflicts with a contract we have signed with you, that contract governs.

1. Roles

For the contact and call data you bring to the Service, you are the controller (Data Fiduciary under India's Digital Personal Data Protection Act, 2023) and AcmaTel Communications is the processor (Data Processor). We process such data only on your documented instructions, including as configured through the platform.

2. Definitions

"Personal data", "processing", "controller" and "processor" have the meanings given under applicable data-protection law. "Sub-processor" means a third party we engage to process personal data. "Personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

3. Details of processing

Subject matter: providing the AI Call Studio calling platform.
Nature and purpose: hosting, placing and analysing calls, and the related storage and processing you instruct.
Duration: the term of your subscription and any configured retention period, then deletion or return.
Data subjects: the contacts you call and the users you invite.
Data types: names, phone numbers, call recordings, transcripts, outcomes, dispositions and scores, and any additional fields you add.

4. Our obligations as processor

Process personal data only on your documented instructions, including for transfers, unless required by law (in which case we will inform you where permitted).
Ensure people authorised to process the data are bound by confidentiality.
Implement appropriate technical and organisational security measures (Section 7).
Engage sub-processors only under Section 8.
Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations.
Delete or return personal data at the end of the engagement, as you choose (Section 11).
Make available information reasonably necessary to demonstrate compliance (Section 10).

5. Your obligations as controller

You warrant that you have a lawful basis and any required notice or consent to process the personal data you upload and to instruct the calls you place, and that your instructions comply with applicable law. You are responsible for the accuracy of the data you provide and for configuring retention, consent disclaimers and calling windows appropriately.

6. Confidentiality

We keep personal data confidential and limit access to personnel who need it to provide the Service, under binding confidentiality obligations.

7. Security measures

Encryption of data in transit and of sensitive fields and secrets at rest.
Redaction of secrets from logs, role-based least-privilege access, and per-tenant isolation.
Audit logging, monitoring, and regular review of access and controls.
India data residency by default, with a self-host option on Enterprise plans.

8. Sub-processors

You authorise us to engage vetted sub-processors for voice, telephony, cloud infrastructure, messaging and payments, under written terms that impose data-protection obligations consistent with this addendum. A current list is available on request. We give reasonable notice of any intended addition or replacement so you can object on reasonable data-protection grounds.

9. Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to help you meet your own notification obligations, and we will take reasonable steps to mitigate and remediate.

10. Audits

On reasonable prior notice and no more than once a year (unless required by a regulator or following a breach), we will make available information necessary to demonstrate compliance with this addendum, and allow for and contribute to audits, subject to confidentiality and to not compromising other customers' security.

11. Return and deletion

On termination, or on your written request, we will delete or return personal data and delete existing copies, except where retention is required by law, in which case we continue to protect it and process it only as required.

12. International transfers

Personal data is processed in-region in India by default. Where any transfer is necessary, we apply appropriate safeguards consistent with applicable law.

13. Liability and precedence

Each party's liability under this addendum is subject to the limitations in the Terms of Service. If there is a conflict between this addendum and the Terms on the processing of personal data, this addendum governs for that subject.

14. Requesting a signed copy

To execute a signed DPA, or for our current sub-processor list, contact legal@aicallstudio.com.

Questions about this document? Email legal@aicallstudio.com, or call us on +91 922 222 8989.

Data Processing Addendum