Skip to content
CallMissed
Book a demo

Explore CallMissed

Skip to contentsSkip to document text

Privacy Policy

How we collect, use, and protect your data.

Last updated 18 sections

This Privacy Policy is published by CallMissed, a company incorporated in Delaware, USA, operating from Pune, Maharashtra, India ("CallMissed", "we", "us"), a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). It explains what personal data we collect, why we collect it, how we store and protect it, and your rights.

This notice is provided in plain language as required under the DPDP Rules. For cookie-specific information, see our Cookies Policy. For contractual processing terms, enterprise customers may refer to our Data Processing Agreement.

Two roles. For data about our own customers, website visitors, and account users, CallMissed is the Data Fiduciary. For data about our customers' end-customers — the people who call, message, or are contacted by a business using CallMissed — the business is the Data Fiduciary and CallMissed processes that data on its behalf as a Data Processor. If you interacted with a business that uses CallMissed, that business's privacy notice governs; you may also contact us and we will help route your request.

1. Information We Collect#

We collect only the personal data reasonably necessary to provide the Service. The categories below are itemised by purpose:

Account Information

  • Data collected: Full name, email address, phone number (optional), organization name, role, authentication identifiers (password hash, passkey public keys, two-factor settings), sign-up consent records, and answers you give during onboarding
  • Purpose: Account creation, authentication, tenant management, support, and billing contact
  • Legal basis: Performance of contract; consent where required

If you sign in with a supported identity provider, we receive only the profile information you authorise (typically name and email). We do not receive or store your password for that provider.

Usage, Session, and Device Data

  • Data collected: API call metadata (endpoint, model, token counts, latency, errors), conversation metadata (timestamps, channel type, duration), credit transactions, dashboard activity, audit-log entries, active sessions, IP address, and device/browser information
  • Purpose: Service delivery, billing, fraud prevention, rate limiting, security monitoring, and product improvement (aggregated/anonymised where possible)
  • Legal basis: Performance of contract; our legitimate uses for security, fraud prevention, and service operation as permitted under the DPDPA

Fraud and Abuse Prevention Signals

  • Data collected: At sign-up and on public demos: IP address, approximate country and network, a hashed browser user-agent, a browser/device identifier derived from browser characteristics, and the result of a bot-protection check
  • Purpose: Detecting duplicate or automated sign-ups created to obtain free credits more than once, enforcing demo usage limits, and protecting the Service from abuse
  • Legal basis: Our legitimate uses for preventing fraud and protecting the Service, as permitted under the DPDPA

These signals may be used to automatically block a sign-up or restrict linked accounts. Any such decision can be appealed and is reviewed by a person — see Account Suspensions & Appeals.

Communication Content (processed for our customers)

  • Data collected: Depending on the features a business enables: callers' and recipients' phone numbers, names, and email addresses; live call audio; call recordings; transcripts; messages, media, and email content; social-media messages and comments; order, cart, and form responses; contact and CRM records; tickets and survey responses; facts an agent remembers about a contact; AI-generated summaries, sentiment, outcomes, scores, and extracted fields; answering-machine detection results; do-not-call entries; and files, documents, and knowledge-base content
  • Purpose: Providing the chat, voice, CRM, support, analytics, and automation features the business configures
  • Legal basis: Performance of contract. The business acts as the Data Fiduciary and CallMissed acts as its Data Processor under our Data Processing Agreement; the business is responsible for the lawful basis and notices for that data, including telling callers when calls are recorded or handled by AI

This content is stored in the business's isolated tenant partition. It is never shared across tenants, never used to train third-party AI models, and never sold. Supervisors at the business may listen to live calls, and in listen mode the caller is not notified by the Service.

Connected Accounts and Integrations

  • Data collected: When a customer connects a calendar, email, e-commerce, CRM, social, or messaging account, we receive access credentials (stored encrypted for built-in integrations) and the records needed for the enabled feature — for example, calendar events and availability, store orders, products, customers and carts, and contact records. We send data to those accounts when an agent books a meeting, sends an email, creates a draft order, or syncs call notes. Custom tools, webhooks, and MCP connections send conversation data to endpoints the customer chooses
  • Purpose: Operating the integrations the customer enables
  • Legal basis: Performance of contract; processing on the customer's instructions for their end-customers' data

Personal Messaging Assistant

  • Data collected: If an account owner links their own personal messaging account, the assistant accesses the owner's chats — including messages from the owner's contacts, contact names and numbers, and voice notes if transcription is enabled — along with reminders, activity logs, and facts the assistant learns about the owner
  • Purpose: Providing the assistant's replies, reminders, and actions requested by the owner
  • Legal basis: Consent of the account owner, who links the account and may unlink it at any time. The owner is responsible for their use of their contacts' messages

Mobile App

  • Data collected: A push-notification token and basic device information, and the account data you access through the app
  • Purpose: Signing you in and delivering notifications, which may include a sender's phone number and a message preview
  • Legal basis: Performance of contract; you can turn notifications off in your device settings

Public Demos, Website, and Enquiries

  • Browser voice demos (including our spiritual-teaching demo agents): your voice is processed in real time to generate the agent's replies, and a text transcript of the demo conversation is stored and may be reviewed by our team to improve the demo. Audio is not stored. Do not share sensitive personal information — such as health, financial, or religious details you would not want recorded as text — in a demo
  • Voice demo callback requests: if you accept the agent's offer to have our team follow up, we store the phone number you speak so a person from CallMissed can call you back. The agent asks once and states this purpose; if you decline, no number is saved from that request. Any number you speak remains part of the stored transcript
  • "Call me" demo: your mobile number, a one-time verification code sent to it by message, and your IP address, used to verify the number and place the demo call
  • Documentation AI assistant: questions you type are processed by an AI service partner to generate an answer
  • Book a demo and contact requests: name, email, phone, company, and the details you provide, used to schedule and respond to your request
  • Blog comments, likes, and newsletter: the name and comment you publish (shown publicly), your email address (never shown publicly), IP address, and an anonymous browser identifier for likes; newsletter email address until you unsubscribe
  • Job and program applications sent to us by email, including any CV or links you include

Legal basis: Consent, given when you choose to use the demo or submit the information, and our legitimate uses for security and abuse prevention. You may withdraw consent or ask us to delete this data at any time via data deletion.

Payment Information

  • Data collected: Billing name, email, phone (for receipts), transaction references, order IDs, payment status, amounts, and chargeback and refund records
  • Purpose: Processing payments and statutory financial record-keeping
  • Legal basis: Performance of contract; compliance with a legal obligation (tax and financial record-keeping)

Card numbers, CVVs, UPI PINs, and full bank credentials are processed by our authorised payment gateway and are not stored on CallMissed servers.

If you save a card or set up a UPI Autopay mandate, we store only a reference to the saved payment method and display details (the card brand and last 4 digits, or your UPI ID), together with your auto-recharge settings and charge history. We never store the full card number; our payment partner holds the card data. You can remove a saved payment method at any time in the console billing page.

Regulatory KYC Documents (Rented Phone Numbers)

  • Data collected: Business registration certificate (Certificate of Incorporation or Udyam), GST registration certificate, legal business name, registration number, registered address, and contact details — collected only when you apply to rent a phone number
  • Purpose: Mandatory Know Your Customer (KYC) verification required by Indian telecommunications regulation before a phone number can be assigned
  • Legal basis: Compliance with a legal obligation; performance of contract

The document files themselves are transmitted directly to our licensed telecom partner for regulatory verification and are not stored on CallMissed servers. We retain only the application details (business name, registration number, and verification status). The telecom partner and telecom authorities may retain verification records for the periods required of them under applicable law, which may include processing outside India under contractual safeguards. If recipients report calls from your number as spam, we receive those complaint records, including the complainant's number, so you can respond to them.

2. How We Use Your Information#

  • Service delivery: Processing API requests, operating AI agents and integrations, delivering conversation data, and operating real-time voice agents
  • Account management: Authentication, authorization, tenant isolation, and role-based access control
  • Billing and credits: Usage metering, payment reconciliation, plan enforcement, and transaction history
  • Security and abuse prevention: Rate limiting, access logging, duplicate-account detection, abuse detection, and incident response
  • Product analytics: Understanding how our websites and dashboard are used, as described in Section 11
  • Communications: Transactional emails (OTP, receipts, security alerts), product and usage updates, and marketing only with consent where required (see Section 16)
  • Legal compliance: Tax, audit, regulatory reporting, and responding to lawful requests

3. Data Storage, Residency, and Security#

Indian hosting

CallMissed hosts primary production systems on Microsoft Azure data centres in India (Central India region). Customer personal data and service content are ordinarily stored and processed within India unless we notify you otherwise in writing or applicable law requires a different approach.

Encrypted backups for production data are maintained within India. CallMissed is incorporated in Delaware, USA; our place of incorporation does not change where your data is stored.

Security safeguards (DPDP Rules, Rule 6)

  • Encryption in transit and at rest for stored personal data
  • Access controls, tenant isolation, and least-privilege administrative access
  • Protected credentials — passwords are stored as one-way hashes, and API keys and most connected-account credentials are stored encrypted, with access to an API key's full value requiring re-verification
  • Optional two-factor authentication and passkeys for account sign-in
  • Short-lived, access-controlled links for recordings, images, and other stored files
  • Security monitoring, logging, and incident response procedures
  • Regular backups and recovery testing
  • Employee and contractor confidentiality obligations

Further technical detail is available on our Security page.

4. Authorised Service Partners#

We engage vetted service partners who process personal data on our instructions and only for specified purposes. We do not publish partner or sub-processor names on public marketing or legal pages; enterprise customers may request the current sub-processor schedule via karan@callmissed.com or our Data Processing Agreement.

Partner categories include cloud hosting and storage, AI inference, speech-to-text and text-to-speech, embeddings, web search, telecom carriers, business-messaging and social platforms, email delivery, push-notification delivery, payment gateways, identity providers, bot protection, product analytics and session replay, and content delivery. All partners are bound by written contracts requiring confidentiality, security safeguards equivalent to ours, assistance with data principal requests, and prompt breach notification. Third-party platforms that you or a business connect (such as a calendar, store, CRM, or social account) process data under their own terms as independent parties.

5. Automated Processing & Artificial Intelligence#

CallMissed is an AI platform. To deliver the features you configure, content you submit (such as messages, audio, transcriptions, documents, and prompts) is processed by automated systems and may be transmitted to vetted AI inference, speech-to-text, text-to-speech, and embedding service partners for the sole purpose of generating the requested output. These automated outputs assist your business but may be inaccurate or incomplete; you remain responsible for reviewing AI output before relying on it. Depending on the features you enable, automated processing also includes post-call summaries, sentiment and outcome classification, rubric-based call scoring, answering-machine detection, facts an agent remembers about a contact across conversations, and rule-based lead scores you configure. We do not use your content to train third-party AI models, and your content is not shared across tenants or sold. Where an interaction produces a decision with legal or similarly significant effect on an individual, a human review path is available on request.

6. Cross-Border Data Transfers#

We store and process customer personal data primarily within India. Certain service-partner categories (for example, some AI inference, web search, product analytics and session replay, push-notification delivery, telecom compliance, and global messaging, social, calendar, commerce or identity services you choose to connect) may process limited data outside India. Where this occurs we rely on contractual safeguards with each partner and transfer personal data only to jurisdictions not restricted by the Government of India, consistent with Section 16 of the DPDPA. Enterprise customers may request transfer details and the sub-processor schedule under our Data Processing Agreement.

7. Data Retention#

We retain personal data only for as long as necessary for the purposes described above:

  • Active accounts: Account data, conversations, transcripts, recordings, contacts, CRM records, memories, and analysis are kept for the life of the account unless you delete them sooner. Businesses can delete individual records and memories in the product
  • After an account deletion request: 30-day recovery window, then permanent deletion of account and conversation data (see Account Deletion). Call recordings can also be deleted on request at any time through support@callmissed.com
  • API request logs (only if enabled on an API key): 30 days
  • Usage logs, webhook delivery logs, and audit logs: For the life of the account by default. Account owners can set shorter retention periods in the product
  • Security/access logs and fraud-prevention signals: Retained per applicable Indian cybersecurity directions and for as long as needed to prevent repeat abuse
  • Suspended accounts: Retained while the suspension, any appeal, or any related legal claim is pending
  • Demo, enquiry, and blog data: Until you ask us to delete it or it is no longer needed for the purpose it was collected
  • Email unsubscribe records: Kept even after account deletion so that we continue to honour your opt-out
  • Payment and tax records: Up to 7 years as required under GST, Income Tax, and allied laws
  • Backups: Encrypted backup copies are purged on a rolling schedule, ordinarily within 90 days of deletion from primary systems.

8. Your Rights (DPDPA 2023)#

As a data principal, you have the right to:

  • Access — Obtain a summary of personal data we process and the processing activities undertaken
  • Correction — Update inaccurate or incomplete personal data
  • Erasure — Request deletion when consent is withdrawn or processing is no longer necessary (subject to legal retention)
  • Data export — Account owners and admins can download an export of users, contacts, and conversation history from the dashboard; transcripts, audit logs, and CRM records can be exported from their respective screens, and other data is available on request
  • Grievance redressal — Raise a complaint with our Grievance Officer, including from the dashboard
  • Nominate — Designate another individual to exercise your rights in the event of death or incapacity, including from the dashboard
  • Withdraw consent — Where processing is consent-based, withdraw consent through account settings or by contacting us

To exercise these rights, email support@callmissed.com or use in-product tools where available. If your data was processed on behalf of a business that uses CallMissed, please contact that business first; we will assist it in responding. We respond within timelines prescribed under applicable law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India once operational under the DPDPA framework.

10. Children's Privacy#

CallMissed is a B2B service for businesses and developers, and our public demos are intended for adults. They are not directed at individuals under 18. We do not knowingly collect personal data from minors, and we do not undertake processing likely to cause a detrimental effect on the well-being of a child or use children's data for tracking, behavioural monitoring, or targeted advertising. If you use CallMissed to communicate with your own end-customers, you are responsible for obtaining any verifiable parental consent required under the DPDPA before processing a minor's personal data through the Service. If we learn that we have collected a minor's data without the required consent, we will delete it promptly.

11. Cookies, Analytics, and Session Replay#

See our Cookies Policy for details. In summary:

  • Essential cookies/tokens for authentication and security, and a bot-protection check on some forms and demos
  • Functional preferences (e.g. theme) stored locally
  • Product analytics on our main website and dashboard, which runs only after you accept it in the cookie banner; on our documentation, status page, and developer playground, basic page analytics runs without a banner
  • Session replay, which records page interactions (with form inputs and marked sensitive fields masked) to help us fix usability problems. A session-replay tool, which may set its own cookies, loads on our main website, dashboard, and developer playground without a separate consent prompt. A second replay capability also records the network requests a page makes, with passwords, tokens, and API keys removed in your browser before upload; it runs after you accept analytics on our main website and dashboard, and without a banner on our documentation, status page, and developer playground. You can block both with your browser settings or a content blocker
  • No third-party advertising cookies on core product surfaces

12. Personal Data Breach Notification#

In the event of a personal data breach likely to affect your rights:

  • We will notify affected data principals without undue delay in concise, plain language, describing the breach, likely consequences, measures taken, and recommended safety steps (DPDP Rules, Rule 7)
  • We will notify the Data Protection Board of India without undue delay and provide a detailed report within 72 hours where required, unless an extension is granted
  • Where the breach affects data we process for a business, we will notify that business so it can meet its own obligations

13. Disclosure to Authorities#

We may disclose personal data where required by law, a court order, or a lawful request from a government, regulatory, telecom, or law-enforcement authority, and to protect the rights, safety, or property of CallMissed, our customers, or the public. Where lawful, we will notify the affected customer before disclosing its data. In a merger, acquisition, or sale of assets, personal data may transfer to the successor, which will remain bound by this Policy.

14. Applicable Law and Compliance Framework#

This Policy is designed to comply with, among others:

  • Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025
  • Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (during the transitional period)
  • Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — grievance mechanism
  • CERT-In directions on cybersecurity incident reporting and log retention, where applicable
  • Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020

15. Changes to This Policy#

We may update this Policy from time to time. Material changes will be notified via email or dashboard notice at least 30 days before they take effect, except where immediate change is required by law. The "Last updated" date at the top reflects the latest revision.

16. How We Communicate With You#

When you hold a CallMissed account, we may contact you in the following ways:

  • Service and transactional messages — one-time passcodes, verification and password-reset messages, payment receipts and invoices, security alerts, and notices about your account, billing, or material changes to the service. These are necessary to operate your account and are sent for as long as your account is active; they are not marketing and cannot be opted out of while you use the service.
  • Support responses — replies to requests you send us, and follow-ups needed to resolve them.
  • Product, usage, and account-activity updates — for example, feature announcements, usage summaries, and tips based on how you use your account. You can turn each of these categories off in your email preferences.
  • Marketing — offers and promotions, sent only where you have opted in or where otherwise permitted by law. Every such message includes a way to unsubscribe, and you can opt out at any time without affecting service messages.

We contact you through the channels tied to your account — primarily the email address on file, in-product or dashboard notices, and mobile push notifications if enabled. Where you have provided a phone number and given the required consent, we may also reach you by phone, SMS, or business messaging for verification or service purposes. Keep your contact details current so you receive important notices; you can update them at any time in your account settings, or reach us at support@callmissed.com with any questions about our communications.

17. Contact Us#

Entity details (Consumer Protection (E-Commerce) Rules, 2020):

  • Contracting entity: CallMissed, incorporated in Delaware, USA
  • Operating office in India: Pune, Maharashtra, India

18. Grievance Redressal & Grievance Officer#

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the DPDPA, the contact details of our Grievance Officer are published below.

  • Designation: Grievance Officer
  • Email: karan@callmissed.com
  • Address: CallMissed, Pune, Maharashtra, India

How we handle complaints:

  • We acknowledge every complaint within 24 hours of receipt (IT Rules, 2021).
  • We resolve complaints within 15 days of receipt (IT Rules, 2021), and in any case grievances relating to personal data within the period prescribed under the DPDP Rules, 2025 (not exceeding 90 days).
  • Grievances under the SPDI Rules, 2011 are redressed within one month.

If you are not satisfied with the resolution, you may escalate to the Data Protection Board of India via its official online portal.