1. Who is responsible
Chaitoj Conversync Private Limited, F. No. 201, House-II, B-3, Magnum Commercial Centre, Karam Pura, West Delhi, New Delhi 110015, India, operates Echo and this website.
Our role depends on whose data it is:
- For website visitors and customers, we decide why and how data is processed. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary; under laws such as the GDPR we are the controller.
- For people an Echo agent calls or messages, the business that configured the agent decides why and how. That business is the Data Fiduciary (controller). We act as its Data Processor, on its instructions, and section 4 explains what that means for you.
2. Visitors to this website
2.1 Get a call from Echo
When you ask Echo to call you, we collect:
- Your mobile number, the language you pick, your name and company, and the fact that you ticked the consent box, with the exact wording you saw and the time.
- A WhatsApp verification code. We send a one-time code to the number on WhatsApp and ask you to type it back. We store only a keyed hash of the code, never the code itself, together with the number, the time, and the number of attempts. The address your request came from is used to limit how often codes can be requested.
- How you found us: campaign tags in the address you arrived on (such as utm_source), the page that referred you, and the path you landed on. These are kept in your browser (section 12) and sent with the form.
- The call itself. The call is placed by an AI agent and is recorded, transcribed and scored, in the same way as every call on the Echo platform. We keep the recording, transcript and extracted fields.
Why: to verify that the number is yours, to place the call you asked for, to show you how Echo works, and to follow up with you about Echo. Basis: your consent, which you give by ticking the box and entering the code, and which you can withdraw at any time (section 10).
2.2 Book a demo
We collect your name, work email, company, the use cases you tick and any note you add, so we can contact you to arrange a demo and discuss Echo. Basis: your request, and our legitimate interest in responding to it.
2.3 Create an agent now (Ask Echo)
What you type in the "Ask Echo" window stays in your browser until you choose "Continue to Echo" or "Sign in". It is then passed to the Echo app in the web address so the assistant there can start from it. Nothing is sent to us before that, and the website itself never calls an AI model.
2.4 Browsing
Our web server records standard access logs: your IP address, browser type, the pages requested and the time, which we use for security and to keep the site running. Fonts are loaded from a third-party font service, which sees your IP address when it serves them. This website does not use advertising trackers. If we enable analytics, section 12 describes it, and you can decline it there.
3. Customers and users of the Echo app
If you create or use an Echo account for your business, we collect:
- Account data: name, work email, password (stored only as a hash), your firm's name and settings, your role, and the team members you invite.
- Billing data: credit purchases, invoices, GSTIN if you give it, and payment confirmations. Card and UPI details go directly to our payment provider; we never see or store them.
- Configuration: the agents, scripts, knowledge-base files, contact lists, consent records, suppression lists and integration credentials you upload. Credentials are stored encrypted. Much of this is your End-Customers' data, covered by section 4.
- Usage and security data: sign-ins, sessions and devices, API-key use, actions taken in the app, and an append-only audit trail of compliance decisions, so you and we can see who did what.
- Assistant conversations: what you type to the Echo assistant and files you give it to draft agents, pruned on a rolling schedule.
- Support and communications: emails and messages you exchange with us, and the emails we send you about your account, usage, balance and alerts.
- Error reports: if the app hits an error, a report that can include your account email and the page in use is sent to our error-monitoring provider so we can fix it.
Why: to provide and secure the Service, bill you, support you, tell you about changes that affect your account, prevent abuse, and meet legal obligations such as tax record-keeping. Basis: performance of our contract with your business, our legitimate interests in security and improvement, and legal obligation for tax and accounting records.
We send marketing about Echo only where you have agreed to receive it or where you are an existing customer and the law allows it, and every such message has a way to opt out.
4. People an Echo agent calls
If you received a call or WhatsApp message from an Echo agent, a business that uses Echo (our "customer") chose to contact you. That business decided to call you, provided your number and details, wrote the script, and is responsible for having a lawful basis, such as your consent or an existing relationship with you. Under the DPDP Act it is the Data Fiduciary; we process your data as its Data Processor, on its instructions.
4.1 What is processed
- Your phone number and the details the business gave us about you, such as your name, language, the product or account the call concerns, and amounts or dates it wants discussed.
- The call audio, a transcript of it, the fields the agent extracted (for example a date you promised, a preference you stated, or an answer you gave), a score and a summary.
- The outcome of the call, which may be written to the business's CRM or systems at its instruction.
- Whether a call to you was allowed or blocked by consent, do-not-disturb and calling-hour rules, kept in an audit trail.
4.2 What we do with it
We process it only to run the call or message the business configured, to produce the transcript, fields and scores it asked for, to deliver results to the systems it connected, to keep the Service secure, and to produce aggregate statistics that identify no one. We do not use it for our own marketing, do not sell it, and do not use it to train our own models.
4.3 Your rights
Because the business decides why you were called, requests about access, correction, deletion, or stopping calls are best made to that business, which can act on them directly in Echo, including by adding your number to its suppression list. If you do not know who called you, or the business does not respond, write to our Grievance Officer (section 11) with the number that was called and the approximate time. We will identify the business, pass your request to it, and help it respond.
You can say "stop calling me" or words to that effect on the call itself; agents are built to recognise that and the business is required by our Terms to honour it.
5. How AI is used on calls
An Echo agent is software, not a person. During a call, your speech is converted to text by a speech-recognition service, a language model decides what the agent should say next based on the conversation so far and the script and knowledge the business provided, and a speech-synthesis service turns that into a voice. Each of these steps is carried out by a provider in one of the categories listed in section 6, chosen by the business from the options Echo offers, and the audio or text needed for that step is sent to that provider and returned.
- Agents are designed to say they are an automated assistant if asked, and must not claim to be human.
- Extracted fields and summaries are machine-generated and can be wrong. The business, not the agent, is responsible for decisions it takes on them.
- We do not use call content to train our own models.
- Echo does not make legally significant decisions about you by itself. Where a business uses call outcomes to take a decision about you, that is its decision under its own rules.
7. Where data is stored and transferred
Echo's servers, database and recording storage are hosted in a cloud provider's Mumbai region, in India. Some sub-processors in section 6, in particular speech and language-model providers and the messaging platform, process data outside India for the moments needed to perform their step. Where data leaves India, we rely on the provider's contractual commitments to protect it and on the transfer rules of the DPDP Act and, where it applies, the GDPR. If the Indian government restricts transfers to a country, we will stop using providers in that country for the affected data.
8. How long we keep data
- Demo call details, recordings and transcripts (section 2.1): for as long as we are in conversation with you about Echo, and in any event until you ask us to delete them (section 10). We review and delete demo data that no longer serves that purpose.
- Verification codes: the hashed code and attempt count are kept only as long as needed to limit abuse, then deleted.
- Demo booking details: while we are in contact about a demo and for a reasonable period afterwards, unless you ask us to delete them sooner.
- Customer account and configuration data: while the account is open. After the account closes, the customer may export its data for 90 days; we then delete it, except what tax and accounting law requires us to keep (such as invoices, generally eight years) and backups that expire on their own schedule.
- End-Customer call content: for as long as the customer that configured the agent keeps it in its account. The customer sets its own retention within what its sector rules require, and can delete recordings and transcripts at any time. Content is deleted with the account as above.
- Audit trails of compliance decisions: for the life of the account, because they exist to evidence that rules were followed.
- Access and error logs, assistant conversations and diagnostic traces: pruned on rolling schedules measured in days or months, not years.
9. How we protect data
- Encryption in transit (TLS) for the website, the app, the API and traffic between our systems. Recordings are kept in access-controlled object storage; nothing is served without a signed, expiring link.
- Integration credentials and API keys are stored encrypted, and passwords only as salted hashes. Verification codes are stored only as keyed hashes.
- Every customer's data is scoped to its own account; roles limit what each user and API key can do; sessions expire and can be revoked everywhere at once.
- An append-only audit trail of every allow and block decision on calls.
- Rate limits on sign-in, password reset, verification codes and public endpoints.
- Access to production is restricted to staff who need it, and logged.
No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify the affected customers without undue delay and the Data Protection Board of India and affected individuals where the DPDP Act requires it.
10. Your rights
Depending on where you are, you can ask us to:
- Access the personal data we hold about you and a summary of how it is processed.
- Correct or complete it.
- Erase it, where we no longer need it for the purpose it was collected for or are not required to keep it.
- Withdraw consent at any time, where processing relies on it, with effect for the future. For the demo call, that means we stop following up and delete the demo data.
- Nominate another person to exercise these rights for you if you die or become incapacitated, as the DPDP Act provides.
- Object to processing, restrict it, or receive your data in a portable form, where the law that applies to you provides these rights.
- Raise a grievance with our Grievance Officer (section 11), and, if you are not satisfied with the response, complain to the Data Protection Board of India or the supervisory authority where you live.
To make a request, write to privacy@comsync.in from the email or with the phone number the data relates to, so we can verify it is you. We respond within the time the law requires and in any case within 30 days. If your request concerns a call made for one of our customers, section 4.3 explains how we route it.
11. Grievance Officer
In accordance with the Information Technology Act, 2000 and the rules under it, and the DPDP Act, the contact details of our Grievance Officer are:
13. Children
Echo and this website are for businesses and their adult representatives. We do not knowingly collect personal data from anyone under 18. Customers may not configure agents to call people they know to be under 18 without the verifiable consent of a parent or guardian as the DPDP Act requires. If you believe a child's data has reached us, write to the Grievance Officer and we will delete it.
14. Changes to this policy
We will update this policy when our practices or the law change. Each version carries a date and version number at the top. For material changes we will notify customers by email or in the app at least 30 days before they take effect, and update the sub-processor list in section 6 whenever a provider is added or removed. Earlier versions are available on request.