Privacy Policy

Everything you need to know about data protection and using callSaul.

Who we are and how to reach us

callSaul is a service of Trikuti AI Labs (OPC) Private Limited, registered office at 3rd Floor, 301, Ackruti Star, Central Road, Marol, Andheri East, Mumbai 400053, Maharashtra, India.

Questions about privacy: Rohit Batra, saul@callsaul.io.

Scope — and the two hats we wear

This notice covers the personal data callSaul handles as a controller: the account data of the businesses who sign up, and data from visitors to our website.

For the call data callSaul handles on a business customer's behalf — call audio, transcripts, caller details, campaign contact lists, and recordings a business uploads for analysis — callSaul acts only as a processor. The business is the controller and decides how that data is used; that relationship is governed by our Data Processing Addendum (DPA), not this notice.

If you are a caller who phoned a business that uses callSaul: you are not a callSaul user, and this website notice is not your notice. The notice to you is the spoken announcement at the start of the call ("this call may be recorded…"), given on the business's behalf. To make a request about your call, contact the business you called — see the "Your rights" clause.

If a business that uses callSaul called you (an outbound call): the business is responsible for the call and for having your consent to call you; callSaul places the call on its behalf. At the start of every outbound call you are told that you are speaking with an AI assistant, which business is calling, and a number you can call back on; the recording announcement follows. You can stop further calls at any time by saying so during the call or by pressing the opt-out key offered. An opt-out is applied immediately to the campaign that called you, and across all of that business's calls and messages within 24 hours. For any other request about the call, contact the business that called you — see the "Your rights" clause.

If your call was recorded by a business and later uploaded to callSaul for analysis (including if you are a member of that business's staff): the business decides what is uploaded and must have the consents the law requires for the recording and for its analysis. Contact that business about your data — see the "Your rights" clause.

What we collect

• Account data: name, business name, email, phone (for customers who sign up).
• Website & usage data: device and log data.
• Call data (processed for our customers): call audio and recordings, transcripts, the caller's or called person's phone number, and details a person provides during an inbound or outbound call (e.g., name, request, appointment information).
• Campaign data (processed for our customers): contact lists a business uploads for outbound campaigns (name, phone number, and campaign variables the business chooses), and opt-out and do-not-call suppression records.
• Uploaded recordings and analysis outputs (processed for our customers): call recordings a business uploads for analysis, and the transcripts, summaries, scores and coaching notes produced from them. These may include the voices and details of the business's own staff (agents) as well as the people they spoke with.
• No voiceprints. callSaul does not create or store voiceprints and does not use voice to identify people — on live calls or on uploaded recordings. Audio is used only for speech-to-text, text-to-speech, and transcription. Within a single recording, callSaul separates who is speaking; it does not match or recognise a speaker across different calls. Sentiment and tone scoring is derived from transcript text only; callSaul does not infer emotion from vocal characteristics.

Why we use it

To provide the service (answer calls, book appointments, capture and log leads for our customers; place outbound campaign calls on our customers' instructions; and analyse recordings our customers upload, producing transcripts, summaries, scores and coaching), to apply compliance controls to outbound calls (calling-hour limits and opt-out suppression), to operate and secure the platform, to support and communicate with customers, to bill, and to improve the service. Each purpose has a stated consent basis — see the India rider PP-IN.

Who we share it with (See Annexure A)

We share personal data with the sub-processors that help us run the service (telephony, speech, AI, hosting, storage, booking, and similar). The full, current list is in Annexure A — the Sub-processor List. We do not sell personal data.

International transfers

Personal data is stored in the EU (Supabase, Ireland; Qdrant, Frankfurt) and processed in the US (our servers and certain AI and telephony sub-processors) and, for Indian telephony, in India. Some sub-processors may process it in other regions, as shown in Annexure A. We apply appropriate safeguards for these transfers. For India, transfers are made only to countries not restricted under the DPDP framework.

How long we keep it (See Annexure B)

Retention periods are set out in Annexure B — the Retention Schedule. In summary: by default, call recordings are kept for 30 days and transcripts are kept for 90 days; uploaded recordings are kept for 30 days and analysis outputs for 90 days; opt-out and suppression records are kept until the person gives fresh consent; account data is kept for the life of the account; some data is kept longer where the law requires.

Your rights (See Annexure C)

Depending on where you live, you may have rights to access, correct, delete, or otherwise manage your personal data. How to exercise them is in Annexure C — Your Rights. Note: a request about a call handled for one of our customers is routed to that customer, who controls the data; callSaul assists.

You can stop outbound calls from a business that uses callSaul at any time (see the "Scope" clause). An opt-out is applied immediately to the campaign that called you, and across all of that business's calls and messages within 24 hours. In India, the business will not contact you again to seek consent for at least 90 days.

Cookies

callsaul.io currently uses no cookies or tracking beyond the strictly necessary technical resources needed to make the site work, so no consent banner is shown. If that changes, we will update our Cookie Policy and ask for your consent first. See the Cookie Policy for details.

Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and least-privilege access. (Customers can find more details in the DPA's security annexure)

Children

The service is intended for businesses and is not directed at children, and we do not knowingly collect children's personal data. India treats under-18s as children requiring additional protection — see the India rider PP-IN.

Changes to this notice

We may update this notice from time to time. We will post the updated version here with a new "last updated" date, and give additional notice of material changes.

Contact, grievance and complaints

Contact Rohit Batra, saul@callsaul.io with any privacy question or request. We acknowledge within 72 hours and aim to resolve within 30 days. Our published Grievance Officer and complaints routes are in the India rider PP-IN. USA state-specific complaint routes (including the relevant Attorney General) are in the US rider PP-US.

Annexures

Annexure A - The Subprocessor List

Annexure B - The Retention Schedule

Retention table

Deletion on account termination

On account closure, callSaul deletes recordings, transcripts, uploaded recordings, analysis outputs, contacts and knowledge-base data within 30 days, except data it must keep by law (for example invoices and tax records). Customers may request an export before deletion.

Deletion of derived data

When a recording is deleted on account termination, at the customer's request, or on withdrawal of consent, the data derived from it (transcripts, embeddings, summaries and scores) is deleted too, including copies held by our sub-processors, subject to the backup window below.

Advance notice before erasure

For India (DPDP), where required, callSaul or the customer gives the individual advance notice before scheduled erasure of their data. No equivalent advance-notice requirement applies in the US.

Backups and deletion lag

Deleted data may persist in encrypted backups for a limited window (maximum 7 days) before backups cycle out. During that window the data is not used, is access-restricted, and is overwritten as backups rotate.

Annexure C - Your rights and how to exercise them

Rights available

For users in the USA, depending on your state, you may have the right to know/access, delete, and correct your personal data; opt out of "sale," "sharing," and targeted advertising; and not be discriminated against for exercising these rights.

For Indian users, you have the right to access a summary of your personal data and how it's processed, to correction/completion/updating, to erasure, to grievance redressal, and to nominate another person to exercise your rights.

How to make a request

Email saul@callsaul.io (or use the in-product form when available). Tell us your name, the email/phone linked to the data, and what you're requesting, so we can locate it.

Identity verification

We verify your identity before acting, by matching the details you give against our records; for sensitive requests we may ask for more.

Response timelines

We acknowledge within 72 hours and respond within the period the law requires (United States generally ~45 days, extendable; India within the DPDP-prescribed period).

Requests about a call handled by one of our customers

If your request is about a call you had with a business that uses callSaul — an inbound call, an outbound call from the business, or a recording the business uploaded for analysis — that business controls the data. We route your request to that business and assist them; we do not decide it ourselves. The exception is an opt-out given during an outbound call: it is applied automatically on the business's behalf, without you needing to contact anyone.

Authorised agents and Nomination

You may use an authorised agent to make a request, with proof of authorisation. You may nominate another individual to exercise your rights (e.g., on death or incapacity).

Appeals and complaints

If you're unhappy with our response you may ask us to review it. Users in the United States may also contact your state Attorney General. Indian users may complain to the Data Protection Board of India.

Riders

[PP-US] Rider — US state privacy disclosures

(Applies to US residents; supplements the Privacy Policy)

• Categories of personal data collected: identifiers (name, email, phone, caller number) · audio/voice (recordings, transcripts, uploaded recordings) · internet/usage data · commercial (billing) · call-analysis outputs (summaries and call-quality scores, including scores about a business's own staff) · limited inferences (sentiment and tone scores derived from transcript text). With source, purpose (see "Why we use it" clause in Privacy Policy), and which sub-processors receive them (see "Annexure A").
• Notice at collection: we collect the above for the purposes in the "Why we use it" clause and keep it per "Annexure B".
• Sale / sharing: we do not sell or share personal data (as CCPA/CPRA define those terms) and do not use it for cross-context behavioural advertising.
• Sensitive personal information: we do not use SPI beyond providing the service.
• Biometric identifiers: we do not collect biometric identifiers or voiceprints, and we do not use voice to identify people (see "What we collect").
• Telemarketing: outbound calls placed through callSaul are made on behalf of the business that calls you, which must hold your prior express consent (prior express written consent for marketing calls). At the start of each call you are told that you are speaking with an AI assistant, which business is calling, and a number you can call back on. That business is responsible for screening its lists against do-not-call registries. Calls are placed only between 8am and 9pm in your local time (or narrower where state law requires). An opt-out is applied immediately to the campaign that called you, and across all of that business's calls and messages within 24 hours.
• Your rights: access/know · delete · correct · opt out of sale/share (not applicable — we don't sell/share) · non-discrimination. How to exercise your rights? Check Annexure C.
• Global Privacy Control: we honour GPC opt-out signals.
• Complaints: our privacy contact (check "Contact, Grievance, and Complaints clause"); your state Attorney General as a backstop.
• Auto-renewal: renewal terms are disclosed at signup as US state auto-renewal laws require (Check Refund and Cancellation Policy).

[PP-IN] Rider — India DPDP itemised notice

(Applies to individuals in India (Data Principals); supplements the Privacy Policy per the DPDP Act 2023 and its Rules)

• Purpose-based (itemised) structure:

  Purpose	Personal Data	Basis
  Provide the service (answer calls, book, capture leads)	Call audio, transcripts, caller number, caller details, config	Consent / performance
  Place outbound campaign calls on a business's behalf	Contact name and number, campaign variables, call audio, transcripts	Consent (obtained by the business as Data Fiduciary)
  Honour opt-outs and do-not-disturb preferences	Phone number, opt-out and suppression records	Legitimate use (compliance with law, including TRAI rules)
  Analyse recordings a business uploads (transcripts, summaries, scores, coaching)	Uploaded recordings, transcripts, agent and caller details, scores	Consent specific to AI analysis, obtained by the business (including from its agents)
  Operate & secure the platform	Account, usage, log data	Legitimate use / consent
  Support & communication	Account, contact data	Consent
  Billing	Account, billing data	Performance

• Consent: where we rely on consent, it is specific, informed, and freely given, and you can withdraw it at any time, as easily as you gave it (withdrawal doesn't affect processing already done).
• Your rights: access (a summary of your data, its processing, and who it's shared with) · correction/completion/updating · erasure · grievance redressal · nomination. (Check Annexure C)
• Recording: calls — inbound and outbound — are recorded with affirmative capture, logged with a timestamp.
• Commercial calls: businesses using callSaul must place commercial calls only as TRAI's rules require — DLT-registered, from 140-series (promotional) or 1600-series (service / transactional) numbers, using registered templates — must place promotional calls only between 9am and 9pm, and must not call numbers whose do-not-disturb (NCPR) preference covers that category. Text messages sent through callSaul in India go out under callSaul's own DLT registration, obtained through Exotel, using registered headers and templates. You can register a DND preference or complain by calling or texting 1909.
• Opt-out: you can opt out during any outbound call. An opt-out is applied immediately to the campaign that called you, and across all of that business's calls and messages within 24 hours. The business will not contact you again to seek consent for 90 days.
• Staff of our customers: if you are an agent whose calls a business uploads for analysis, you are a Data Principal; the business must document your consent separately from its customers' consent.
• Advance notice before erasure: you receive advance notice before scheduled erasure of your data (Check, see "Advance notice before erasure" clause in Annexure B).
• Children (under 18): where a business's calls involve a child's data, that business, as Data Fiduciary, must obtain verifiable parental/guardian consent. callSaul does not track or target children.
• Grievance Officer: Rohit Batra — saul@callsaul.io — Trikuti AI Labs (OPC) Pvt. Ltd., Mumbai. We acknowledge within 72 hours and resolve within 30 days. If unresolved, you may approach the Data Protection Board of India.
• Consent Manager: as the DPDP consent-manager framework takes effect, we will support it. (Full DPDP compliance timeline: 13 May 2027.)

Date of publication of the current version: 28.09.2026