Draft — to be reviewed by counsel before use
Legal
Privacy notice
How Kaltline collects and uses personal data about the people who use it, and the rights you have under India’s Digital Personal Data Protection Act, 2023.
1. Who we are
Kaltline is provided by [Legal entity name] (“Kaltline”, “we”). For the personal data described in this notice we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
- Company
- [Legal entity name], CIN [CIN]
- Registered office
- [Registered address]
- Grievance officer
- [Grievance officer name], [grievance email], [phone], [registered address]
2. What this notice covers
This notice covers the people who sign in to Kaltline (administrators and staff of our business customers), billing contacts, people who contact us, and visitors to this website.
When a business uses Kaltline to talk to its own customers, that business decides why and how those conversations are processed. It is the Data Fiduciary and we are its Data Processor under our data processing agreement. If you are that business’s customer, please contact the business directly; we will pass on any request we receive.
3. The personal data we process and why
| Personal data | Purpose | Basis |
|---|---|---|
| Name, email address, password (stored only as a salted hash), company and role | Creating your account, signing you in and keeping the workspace secure | Your consent, and data you provide for this purpose (s.7(a)) |
| Company name, billing contact, address, GSTIN and payment records | Billing, tax invoices and accounts | Contract and legal obligations under tax law (s.7) |
| Sign-in times, IP address, browser details and actions taken in the workspace | Security, preventing misuse and investigating incidents | Reasonable security safeguards required by the DPDP Rules (Rule 6) |
| Messages you send us and our replies | Answering questions and support requests | Data you provide for this purpose (s.7(a)) |
Kaltline sets only strictly necessary cookies, such as kaltline_session when you sign in. We do not use advertising or analytics cookies.
4. Consent and withdrawing it
Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, by writing to the grievance officer or through [link to account settings]. Withdrawal does not affect processing that happened before it. If you withdraw consent we need to run your account, we will close the account and tell you what that means first.
5. Your rights
- Access: a summary of the personal data we hold about you, what we do with it, and who we have shared it with (s.11).
- Correction and erasure: to correct, complete, update or erase your personal data (s.12).
- Grievance redressal: to have a complaint about our handling of your data answered (s.13).
- Nomination: to nominate someone to act for you on death or incapacity (s.14).
To make a request, write to the grievance officer from the email address on your account and give your workspace address so we can identify you. We reply within [number] days, and in any case within 90 days (Rule 14).
If you are not satisfied with our answer, you may complain to the Data Protection Board of India at [Board’s published complaint link].
6. Who we share personal data with
We use the service providers below to run Kaltline, under contracts that require them to protect the data. We do not sell personal data.
| Sub-processor | What it does | Where |
|---|---|---|
| Vercel Inc. | Application hosting and server functions | Singapore (sin1) |
| Neon (managed PostgreSQL) | Database for workspace records | To be confirmed |
| Meta Platforms | WhatsApp Business messaging, when a company connects WhatsApp | To be confirmed |
| Twilio Inc. | SMS, voice and WhatsApp delivery, when a company connects it | To be confirmed |
| Sarvam AI and ElevenLabs | Voice agent calls and speech, when a company connects them | To be confirmed |
| OpenAI and Anthropic | Conversation analysis and drafting, when a company enables it | To be confirmed |
7. Where your data is processed
Kaltline’s server functions run in Singapore. The database region is [database region, to be confirmed]. The DPDP Act allows transfers outside India except to countries the Government restricts (s.16); we will not transfer personal data to such a country.
8. How long we keep it
- Account data: while your account is open, then deleted within [period].
- Security and processing logs: at least one year, as the DPDP Rules require (Rules 6 and 8).
- Billing and tax records: for the period tax law requires [counsel to confirm the GST retention period].
9. Security and breaches
Our security page describes the safeguards in place today. If a personal data breach affects you, we will tell you without delay through your account or email: what happened, the likely consequences, what we have done and what you can do. We will also report it to the Data Protection Board of India, with a detailed report within 72 hours (Rule 7).
10. Children
Kaltline is a service for businesses. Accounts are for adults acting for a business; we do not knowingly create accounts for anyone under 18.
11. Language and changes
You can read this notice in English, and in [Hindi and other languages] at [link]. We will tell account holders about material changes before they take effect.