Privacy Policy

We act as a Data Fiduciary when we determine the purposes and means of processing (for example, managing your account). We act as a Data Processor when we process Customer Data on a customer's documented instructions to provide the Service. This Policy describes both, and where a distinction matters, we say so. Our processing of personal data is intended to align with the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

2.1 Information you provide

• Account and business details: name, business email, phone number, company name, role, and billing information;
• Verification (KYC) data: identity and business-verification documents and identifiers required to enable telephony, messaging and higher usage limits;
• Content and configuration: prompts, knowledge bases, contacts, leads, templates and settings you create;
• Support and communications: messages, tickets and information you share with our team.

2.2 Information generated through use of the Service

• Conversation data: voice-call recordings and transcripts, WhatsApp, Instagram and Facebook messages and comments, web and email messages, and form submissions that AURA handles for you;
• CRM and lead data: contact records, lead scores, activity history and analytics;
• Usage, log and device data: IP address, device and browser information, timestamps, feature usage and diagnostics;
• Cookies and similar technologies (see Section 7).

2.3 Payment data

Payments are processed by third-party payment partners. We receive limited transaction details (such as status and amount) but do not store full card numbers.

We use personal data to:

• Provide, operate, secure, maintain and support the Service, and manage your account and billing;
• Route, deliver and process the calls, messages and conversations you configure;
• Apply AI processing to generate responses, summaries, intents, transcriptions and analytics (see Section 5);
• Detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
• Comply with legal, tax, regulatory and KYC obligations and respond to lawful requests;
• Send service and transactional communications, and, with your consent, product updates and marketing;
• Create aggregated or de-identified data that does not identify any individual, which we may use for any lawful business purpose including improving the Service.

We do not sell personal data.

Where required, we process personal data on the basis of your consent, the performance of our contract with you, our legitimate and lawful business interests, and compliance with legal obligations. Where processing relies on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out and may limit your ability to use parts of the Service. For Customer Data processed on a customer's behalf, the customer is responsible for establishing the lawful basis and obtaining any required consents from End Users.

AURA relies on proprietary and third-party artificial-intelligence models (including large-language, text-to-speech and speech-to-text models) to deliver its features. Conversation content may be processed by these models to generate transcripts, summaries, responses and analytics.

• AI outputs may be inaccurate or incomplete and should be reviewed before being relied upon;
• We do not use the content of customer conversations to train third-party foundation models for their general benefit, except where a feature expressly requires it or where data has been aggregated or de-identified;
• Automated processing may assist routing and prioritisation; you can request human review of decisions that significantly affect you.

We share personal data only as needed to run the Service and as described below. We require our partners to handle data responsibly and to process it only for the purposes we specify.

• Sub-processors and providers: telephony and calling (e.g. Exotel), messaging and social platforms (Meta / WhatsApp Business Platform, Instagram, Facebook), messaging gateways (e.g. Msg91), cloud hosting and storage (e.g. AWS, Google Cloud), email delivery, AI model providers, and analytics;
• Payment partners: to process transactions;
• Professional advisors: auditors, lawyers and accountants under confidentiality;
• Legal and safety: to comply with law, regulation, legal process or enforceable governmental request, and to protect the rights, safety and property of AV Design Works Pvt. Ltd., our users or the public;
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

A current list of key sub-processors is available on request. Where you connect Meta / WhatsApp, Instagram or Facebook, data is also handled under those platforms' terms and policies.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service and understand usage so we can improve it. Some are essential; others (such as analytics) are optional. You can manage non-essential cookies through your browser settings or any cookie controls we provide, though some features may not function without essential cookies.

We store data for our Indian customers on servers located in India. However, certain sub-processors and AI providers may process limited data outside India. Where personal data is transferred across borders, we take steps to ensure it is protected through appropriate contractual and security safeguards and in accordance with applicable law.

We retain personal data only as long as necessary for the purposes described in this Policy and to meet legal, tax and regulatory obligations:

• Conversation data is retained for the period you configure (12 months by default) and then deleted or de-identified;
• Account, billing and KYC records are retained for the duration of your account and for any period required by law (financial and tax records may be retained for several years);
• Backups are retained for a limited period and then overwritten;
• After termination, Customer Data may be exported for up to 30 days, after which it may be deleted in line with our retention practices unless retention is required by law.

You can ask us to delete data sooner, subject to our legal obligations. See also our Data Deletion page.

We use administrative, technical and organisational measures designed to protect personal data, including encryption in transit and at rest, access controls on a need-to-know basis, and continuous monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal-data breach that is likely to result in risk to affected individuals, we will take steps to address it and provide notifications required by applicable law.

Subject to applicable law and verification of your identity, you may:

• Request access to, and a copy of, the personal data we hold about you;
• Request correction or updating of inaccurate or incomplete data;
• Request erasure of your personal data;
• Withdraw consent where processing is based on consent;
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Raise a grievance with our Grievance Officer, and, where available, complain to the Data Protection Board of India or other competent authority.

To exercise any right, email info@saarvix.ai. If you are an End User of one of our customers, please direct your request to that business, which controls the relevant data; we will support them as their processor.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data of children (individuals under 18) as a Data Fiduciary without verifiable parental or guardian consent, and we do not knowingly carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child's data has been provided to us, contact us so we can take appropriate action.

The Service and our websites may link to or integrate with third-party sites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies.

We may update this Policy from time to time. If we make a material change, we will notify you by email or in-app notice before it takes effect. The "last updated" date indicates the latest revision.

For privacy questions, requests or grievances, contact our Grievance Officer:

We will acknowledge and address grievances within the timelines required by applicable law.