1. Two different roles
Olkara, a business being incorporated in India (company registration is in progress; the registered name and address will appear here once it is complete) is responsible for this policy.
- As a controller ("Data Fiduciary" in India): for data about our website visitors, people who sign up, our customers' team members, and people who contact us. This policy explains how we handle that data.
- As a processor ("Data Processor" in India): for data our customers handle through Olkara, such as the people they call and the recordings of those calls. Our customer (the business that called you) decides how that data is used, and their privacy notice applies. We process it only on their instructions, under our Data Processing Agreement.
If you received a call from one of our customers and want to stop calls or ask about your data, use our opt-out page or contact that business. We will help either way.
2. Data we collect
3. Why we use it (and our legal bases)
- Provide and secure the service, verify businesses and prevent abuse (contract; legitimate interests; legal obligation).
- Bill you and keep tax and accounting records (contract; legal obligation).
- Support you and send service messages such as low-balance and security alerts (contract).
- Improve the product using aggregated, de-identified statistics (legitimate interests).
- Marketing emails to business contacts, which you can opt out of at any time (consent or legitimate interests, depending on where you are).
- Measure our ads and website, only with your cookie consent where it is required (consent).
In India, we process personal data on the basis of your consent or for legitimate uses permitted by the Digital Personal Data Protection Act, 2023. We do not use personal data to train shared AI models.
5. Where your data is stored
Your account: your name, email, password (stored only as a one-way hash), sign-in history, two-step verification settings and the list of workspaces you belong to are stored in the United States. One account can then sign in to workspaces in any region.
Workspace data: each customer workspace's business data (such as agents, leads, calls, recordings, transcripts and messages) is stored in the workspace's home region: India (Mumbai) for India workspaces, the United States for US and Canada workspaces. Some subprocessors (for example, AI model providers) may process data in other countries during a call. Where we transfer data across borders, we use contracts and safeguards required by law, such as Standard Contractual Clauses for data from the EU or UK.
6. How long we keep it
- Account data: while your account is open, then up to 30 days after closure so you can export it.
- Call recordings and transcripts: as long as the customer's workspace setting says (customers choose), then deleted.
- Billing and tax records: as long as tax and company law requires (in India, up to 8 years).
- Security logs: up to 12 months.
- Website analytics: up to 14 months.
7. Your rights
Depending on where you live, you can ask to access, correct, update, delete or receive a copy of your personal data, object to or restrict some uses, withdraw consent, and nominate someone to exercise your rights if you cannot (India). You will not be treated differently for using these rights.
- India (DPDP Act): rights to information, correction and erasure, grievance redressal and nomination. You may also complain to the Data Protection Board of India after using our grievance process.
- United States: residents of states with privacy laws (such as California) can request access, deletion and correction, and opt out of sale or sharing. We do not sell personal data.
- Canada: rights of access and correction under PIPEDA and provincial laws.
- EU and UK visitors: GDPR rights, including complaining to your data protection authority.
To make a request, email privacy@olkara.com. We may need to verify your identity. If the data belongs to one of our customers (for example, a call you received), we will pass your request to that business and help them respond.
8. Security
We encrypt data in transit and at rest, including recordings; separate each customer's data; give staff access only when needed, with logged and time-limited support access; and require two-step verification for administrators. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
9. Children
Olkara is for businesses and is not directed at children. We do not knowingly collect personal data of children (under 18 in India, under 13 in the US) through our website or app.
10. Changes and contact
We will post changes here and update the date at the top. If changes are significant, we will tell account holders by email or in the app.
Privacy questions and requests: privacy@olkara.com.
India Grievance Officer: Grievance Officer, grievance@olkara.com. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.