Roles
For the personal data a customer loads into Konvrs or collects through its agents (for example the people it calls, their numbers, recordings and transcripts), the customer is the data fiduciary and Konvrs AI Labs is the data processor. This addendum forms part of the Terms of Service.
What we do with the data
We process the data only to provide Konvrs to the customer and on the customer's documented instructions, which are the customer's use of the product and its settings. We do not use customer contact data for our own marketing and do not sell it.
The customer's duties
The customer must have a lawful basis, including any consent needed, for the data and for the calls; must give any notices the law requires, including about recording; and must tell us if an instruction would break the law.
Confidentiality
Our staff with access to customer data are bound by confidentiality.
Security
We keep appropriate technical and organisational measures, including: encryption in transit; encryption at rest for LeadFinder phone numbers and emails; hashing of passwords and of numbers kept for do-not-call checks; signed provider webhooks; separate workspaces with access checks on every request; role-based access; two-step sign-in for administrators; an audit log of administrator actions; backups; and monitoring. A summary is in our Privacy Policy.
Sub-processors
The customer agrees to our use of these sub-processors.
| Sub-processor | Purpose |
|---|---|
| Plivo, Twilio | Placing and receiving calls |
| OpenAI, ElevenLabs | Speech and language models |
| Razorpay | Payments (account holder data only) |
| Meta (WhatsApp Business), email provider | Messages the customer sends |
| Google (Places) | LeadFinder business listings |
| [hosting provider] | Hosting and storage |
We will tell customers before adding or replacing a sub-processor and give them a chance to object. We stay responsible for our sub-processors and bind them to equivalent terms.
Data subject requests
If someone asks us about data we process for a customer, we send them to the customer, and we help the customer respond within the time the law allows. People who ask not to be called can use Stop calls to my number; we keep a one-way hash of their number so that no Konvrs customer calls it again.
Personal data breach
If we become aware of a breach affecting customer data, we will tell the customer without undue delay and, where possible, within 72 hours, with what we know and what we are doing about it.
Return and deletion
When the agreement ends, or the customer asks, we delete or return customer data within 30 days, unless the law requires us to keep it. Backups are overwritten on their normal cycle.
Audits
We will provide reasonable information to show we meet this addendum and allow reasonable audits, no more than once a year, with notice, during business hours, at the customer's cost.
International transfers
Where a sub-processor handles data outside India, we will do so only as the law permits.