Troika Tech AI Privacy Policy

This Privacy Policy (“Policy”) describes how Troika Tech Services Private Limited, Troika Management Services Pvt Limited and Troika Plus Private Limited (“Troika Tech”, “we”, “us”, “our”) collects, processes, stores, shares, protects, and uses personal data in connection with the use of our AI communication products offering AI Calling, Bulk AI Calling, AI Agent systems, SmartSites, Swara AI, Omni AI, APIs, AI Calling Numbers, and associated services (“Product”). By accessing or using our Product, the Customer and the Customer’s end-users (“Data Subjects”) agree to the practices described in this Policy.

For the purposes of this Privacy Policy, references to "Troika Tech", "we", "us", or "our" may include one or more affiliated entities within the Troika group, including Troika Tech Services Private Limited, Troika Management Services Pvt Limited, and Troika Plus Private Limited. Depending on the nature of the Product, Service, commercial arrangement, jurisdiction, operational requirement, support requirement, or billing relationship, Services may be offered, managed, invoiced, supported, maintained, administered, or operated by one or more of these affiliated entities.

1. Scope of this Privacy Policy

This Policy applies to all:

• Customers using Troika Tech’s AI Agent services, AI Calling Services and Bulk AI Calling Services.
• Authorized Users operating the Product on behalf of the Customer
• End-users who interact with the Customer’s business through Troika Tech’s AI Agents
• Data collected through our website, dashboards, mobile applications, APIs, and integrations

This Privacy Policy also applies to the AI Calling App, published on Google Play by Troika Plus Private Limited on behalf of Troika Tech Services Private Limited.

This Policy does not apply to third-party tools integrated by Customers, where Troika Tech does not determine processing purposes.

2. Categories of Data We Collect

Depending on how the Product is used, we may collect the following types of personal data:

2.1 Contact and Identification Data

• Name
• Phone number
• Email address
• Business name
• KYC documentation (e.g., address proof, incorporation certificate, GST numbers, cancelled cheques, Tax Statements, Financial Documents)
• Identity verification data (where required by telecom/IT laws)

2.2 Communication Data

Data generated through AI voice or chat interactions, including:

• Call recordings
• Call transcripts
• Chat transcripts
• Voice samples
• AI-generated summaries
• Campaign metadata (time, duration, telecom operator, location metadata provided by carrier)

2.3 Technical and Usage Data

• Device identifiers
• IP address
• Browser information
• Operating system
• API usage logs
• Interaction patterns
• Workflow triggers and configurations
• AI Agent behavior logs

2.4 Billing and Transaction Data

• Payment confirmations
• Account balance (prepaid usage)
• Invoice records

2.5 Customer-Provided Data

Any data uploaded or integrated by the Customer, including:

• Lead lists
• CRM data
• Contact histories
• Business workflows
• Custom instructions for AI Agents

2.6 Sensitive Personal Data (Where Applicable)

We do not intentionally collect sensitive data unless:

• Requested explicitly by the Customer, AND
• Required for a lawful purpose AND
• Provided with clear consent under DPDP Act / GDPR Article 9.

3. How We Use Personal Data

Troika Tech processes data for the following lawful purposes:

3.1 Service Delivery

• Routing and enabling AI voice and chat interactions
• Processing AI responses and automations
• Providing communication analytics
• Allocating AI Calling Numbers
• Supporting APIs, integrations, and workflows

3.2 Customer Administration

• Account creation
• Billing, invoicing, and prepaid recharge management
• Fraud prevention
• KYC compliance

3.3 AI Model Functioning

• Generating real-time responses
• Improving message understanding
• Detecting misuse, impersonation, or harmful content
• Preventing telecom and data violations

3.4 Security and Compliance

• Detecting and preventing unauthorized access
• Complying with TRAI/DoT, law enforcement, or regulatory orders
• Handling disputes regarding spam, DND violations, complaints, or fraudulent use

3.5 Improvement and Diagnostics

• Monitoring system performance
• Developing new features
• Conducting internal quality assessments

Processing is carried out strictly in accordance with Customer, Project and Services requirements, except where required by law.

4. Legal Basis for Processing (GDPR & DPDP Compliant)

We process personal data under the following legal grounds:

4.1 Consent

Where required for:

• Call recordings
• Chat transcripts
• Automated communication
• Data profiling
• International data transfers
• Sensitive personal data

4.2 Contractual Necessity

Processing needed to deliver the Product under the service contract with the Customer.

4.3 Legitimate Interests

• Preventing fraud or misuse
• Monitoring service quality
• Securing our infrastructure
• Improving Product functionality

Such processing is carried out after balancing Troika Tech’s legitimate interests against the fundamental rights and freedoms of data subjects.

4.4 Legal Obligations

Compliance with:

• Indian telecom regulations
• Law enforcement requests
• Tax and accounting rules
• DPDP Act compliance requirements

4.5 Vital/Public Interest

If required under emergency legal orders or national security laws.

5. Customer Responsibility for Consent

The Customer confirms and warrants that:

• They have obtained valid, lawful, unambiguous consent from their end-users for all processing activities performed through the Product.
• They will provide clear notice to end-users regarding call monitoring, AI interactions, and data collection.
• They will maintain records of such consent in accordance with the DPDP Act, GDPR, and CCPA.
• Troika Tech is not responsible for obtaining consent on the Customer’s behalf.

Failure to obtain consent makes the Customer solely liable for regulatory or legal consequences.

6. Data Retention

• Communication Data: Retained for 30 days, unless extended for lawful purpose or Customer request (if permissible).
• KYC Data: Retained for periods mandated by telecom law.
• Billing and Audit Logs: Retained for statutory audit periods.
• Deleted data may persist in backup archives for limited periods as per security protocols.
• Troika Tech retains data only for the duration necessary for the purposes defined in this Policy or as required by law.
• Upon termination, Customer Data shall be deleted within 14 days, unless retention is required by law or regulatory obligations.
• Residual data in backup systems shall be securely deleted in accordance with standard retention cycles.

7. Data Sharing and Transfers

We may share data only under the following circumstances:

7.1 Service Providers

With vetted processors including:

• Cloud hosting providers
• Payment gateways
• Telecom operators
• Security vendors

7.2 Regulatory Authorities

Where required under:

• Law enforcement orders
• TRAI/DoT mandates
• Court orders
• Data protection authorities

7.3 Internal Teams

Only on a strict need-to-know basis.

7.4 International Transfers

Where data is transferred outside India or outside the EU:

• Adequate safeguards such as SCCs (Standard Contractual Clauses) are applied.
• Transfers comply with DPDP Act rules on cross-border data transfer.

Troika Tech does not sell personal data.

8. Data Security

Troika Tech implements robust technical and organizational security measures, including:

• Encryption in transit (TLS 1.2+)
• Encryption at rest
• Role-based access control
• Multi-factor authentication
• Audit logs
• Secure access key management
• ISO-aligned security design
• Vulnerability and penetration testing
• Continuous monitoring

While Troika Tech implements commercially reasonable administrative, technical, and organizational safeguards to protect personal data, no method of transmission over the internet, telecommunications network, cloud infrastructure, AI platform, or electronic storage system can be guaranteed to be completely secure, uninterrupted, or free from vulnerabilities. Accordingly, Troika Tech does not warrant or guarantee absolute security.

8.1 Data Breach Notification and Response

In the event of a confirmed unauthorized access, disclosure, alteration, or destruction of personal data (“Data Breach”), Troika Tech shall:

• Notify the Customer without undue delay and, where feasible, within 72 hours of becoming aware of such breach
• Provide reasonable details regarding:
  • Nature of the breach
  • Categories of data affected
  • Likely consequences
  • Measures taken or proposed to mitigate risks

Troika Tech shall take all reasonable steps to:

• Contain and remediate the breach
• Prevent recurrence
• Cooperate with the Customer in meeting any regulatory obligations

The Customer acknowledges and agrees that:

• Troika Tech shall not be liable for breaches arising due to:
  • Customer negligence
  • Weak credentials or API misuse
  • Unauthorized access resulting from Customer systems
• The Customer is responsible for:
  • Notifying its end-users where required
  • Maintaining compliance with applicable data protection laws

Troika Tech follows industry-standard incident response frameworks aligned with ISO and cloud security best practices.

Despite strong safeguards, no system is fully immune to risks; the Customer must ensure secure use of credentials and systems.

Troika Tech periodically reviews and updates its security measures in line with evolving industry standards.

8.2 Customer Security Responsibilities

Customers are responsible for maintaining the confidentiality and security of their login credentials, API keys, access tokens, devices, networks, internal systems, user permissions, and account access controls. Troika Tech shall not be liable for unauthorized access, misuse, disclosure, loss, or compromise of data resulting from Customer negligence, weak credentials, credential sharing, inadequate security controls, phishing attacks, malware, unauthorized third-party access, or failures within Customer-controlled systems.

9. Rights of Data Subjects

Depending on jurisdiction, data subjects may exercise:

India – DPDP Rights

• Right to access
• Right to correction
• Right to erasure
• Right to grievance redressal
• Right to withdraw consent
• Right to nominate

GDPR Rights

• Right to be informed
• Right to access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making

CCPA/CPRA Rights

• Right to know
• Right to delete
• Right to opt-out of sale or sharing of data
• Right to non-discrimination

Requests may be submitted to: info@troikatech.net

10. Data Processing on Behalf of Customers

Troika Tech acts as:

• A Data Processor under GDPR,
• A Data Fiduciary/Processor under DPDP Act, and
• A Service Provider under CCPA/CPRA

when processing Customer Data on the Customer’s instructions.

10.1 Ownership of Customer Data

As between Troika Tech and the Customer, the Customer retains all rights, title, and interest in Customer Data, databases, call content, transcripts, recordings, uploaded files, CRM data, and other information provided through the Product. Troika Tech obtains only the limited rights necessary to process such data for the purpose of providing, securing, supporting, maintaining, and improving the Services in accordance with applicable agreements and applicable law.

11. AI-Specific Privacy Disclosures

Because the Product uses automated AI systems:

11.1 Transparency

End-users may interact with automated systems without a human present.

11.2 Automated Decision-Making

Troika Tech does not take responsibility for:

• Decisions made by Customers based on AI outputs
• AI hallucinations, inaccuracies, or generated statements

11.3 Data Minimization

We avoid storing communication content beyond retention periods unless legally mandated.

12. Children’s Privacy

Troika Tech does not knowingly collect, process, or store personal data of individuals under the age of 18 years, unless:

• Explicitly permitted under applicable law, and
• Valid parental or guardian consent has been obtained by the Customer

If Troika Tech becomes aware that personal data of a minor has been collected or processed without valid authorization:

• Such data shall be promptly deleted, subject to legal and regulatory retention requirements
• Troika Tech may restrict or suspend access to the Product associated with such data

The Customer acknowledges and agrees that:

• They are solely responsible for ensuring that minors do not interact with the Product where prohibited
• They must implement appropriate safeguards to prevent unauthorized access by minors
• They are responsible for obtaining verifiable parental or guardian consent, where required under applicable laws

Troika Tech shall not be held liable for any claims, damages, or regulatory actions arising from:

• Customer’s failure to restrict access to minors
• Lack of valid consent for processing minor data
• Any interaction initiated by minors through Customer-controlled channels

13. Grievance Redressal

For India (DPDP Act & IT Act compliance):

For EU:

Requests may be addressed to our Data Protection Contact at: godwin@troikaplus.in

All grievances will be acknowledged within 48 working hours and resolved within 30 days, in accordance with applicable laws.

14. Changes to this Privacy Policy

Troika Tech may update this Privacy Policy periodically. Material updates may be communicated through the Product dashboard, website, email, customer portal, account notifications, or other reasonable communication channels. Customers are encouraged to periodically review the latest version of this Privacy Policy. Continued use of the Product after the effective date of an updated Privacy Policy constitutes acceptance of the revised Policy.

15. Contact Information

For any questions or requests relating to this Policy, please contact:

16. Cookies and Tracking Technologies

Troika Tech does not use traditional browser-based cookies for tracking users across websites. However, the Product may use limited system-level technologies necessary for the functioning, security, and performance of the platform.

16.1 System-Level Tracking

Troika Tech may collect certain technical and usage-related information, including:

• IP address
• Device and browser information
• API usage logs
• Session data required for authentication and security
• Interaction patterns within the Product

This information is used strictly for:

• Maintaining secure access
• Preventing fraud and unauthorized use
• Monitoring system performance
• Improving reliability of AI systems

16.2 No Cross-Site Tracking

Troika Tech does not:

• Track users across third-party websites
• Use advertising cookies
• Sell or share tracking data for marketing purposes

16.3 User Control

As Troika Tech does not rely on traditional cookies for core functionality, disabling cookies in the browser may not impact Product usage. However, certain system-level features may require session-based tracking to operate securely.