Privacy Policy
Last updated: 21 October 2026
This Privacy Policy explains how Zencia AI Tech Private Limited(“Zencia”, “we”, “us”) collects, uses, shares and protects personal data when you use ECHO by Zencia, our AI voice-agent platform available at app.zencia.ai and through our APIs, widgets and telephone integrations (together, the “Service”). It applies to our customers (“Operators”) who create AI agents, and to the people who speak with those agents (“Callers”).
We are a company registered in India. Registered office: 5/68 Vishal Khand, Gomtinagar, Lucknow, Uttar Pradesh 226010. Questions about this policy go to info@zencia.ai.
1. Data we collect
From Operators
- Account data: name, email address, password hash, country, phone number if you provide one, and the one-time codes we send to verify your email.
- Billing data: billing name, company, address, state, GSTIN, and payment references. Card and bank details are handled by Razorpay and never reach our servers.
- Agent configuration: prompts, knowledge-base content you upload or point us at (web pages, PDFs, text), voices, tools and settings.
- Integration credentials: API keys and OAuth tokens for services you connect, such as telephony providers, WhatsApp, Slack, Cal.com, Google Calendar and Microsoft Outlook.
- Usage data: minutes used, calls made, feature usage, device and browser information, IP address and log data.
From Callers
- Conversation data: audio of the call, transcripts, the phone number or chat identifier used, and anything the Caller says, including a name, contact details or booking preferences.
- Outcomes: whether an appointment was booked, a message sent, a lead captured or a call transferred.
Operators are responsible for telling their Callers that they are speaking with an AI agent and that the call may be recorded, where the law requires it, and for having a lawful basis to process their Callers’ data.
2. How we use data
- To run the Service: answer and place calls, generate speech and replies, book appointments, send confirmations and store call history for the Operator.
- To bill Operators, issue GST invoices and prevent fraud and abuse.
- To secure accounts, including email verification and rate limiting.
- To support Operators and improve the Service, using aggregated or de-identified usage statistics.
- To send service notices, such as low-balance alerts, plan expiry and announcements. Marketing email is sent only with your consent and can be stopped at any time.
We do not sell personal data. We do not use Caller conversations or Operator knowledge bases to train general-purpose AI models.
3. Data from connected Google accounts
ECHO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect Google Calendar, we request the calendar.events scope together with your basic profile (email). We use this access only to:
- read your busy times so your agent offers free slots only;
- create, and where you ask, update or cancel, events for appointments your agent books;
- show which Google account is connected.
Google data is used solely to provide the calendar features you turn on. It is not used for advertising, not sold, not shared with third parties except as needed to provide the feature, and not read by humans except with your permission, for security, or where the law requires it. Refresh and access tokens are stored encrypted at rest in our database and deleted when you disconnect Google Calendar from the Integrations page or delete your account. You can also revoke access at any time from your Google account’s security settings.
4. Data from connected Microsoft accounts
If you connect Microsoft Outlook, we request permission to send email on your behalf and to read your basic profile. We use it only to send the emails your agent is configured to send, such as booking confirmations. Tokens are deleted when you disconnect.
5. Who we share data with
| Provider | Purpose |
|---|---|
| Google (Gemini API, Cloud, Firebase) | Speech, language and reasoning for agents; hosting; authentication; database and file storage. |
| Razorpay | Payment processing and invoices. |
| Telephony providers you connect (Twilio, Bonvoice, VoiceLink) and Meta (WhatsApp) | Carrying calls and messages to and from Callers. |
| Services you connect (Cal.com, Google Calendar, Microsoft Outlook, Slack, Zapier and others) | Performing the actions your agent is configured to perform. |
| Microsoft (Outlook) | Sending our own verification and service emails. |
These providers process data under their own terms and only to provide their service to us. We may also disclose data when required by law, to protect rights and safety, or as part of a merger or acquisition, with notice where required.
6. Retention
- Call recordings are kept for the period included in the Operator’s plan (from 30 days to one year) and then deleted automatically. Transcripts and outcomes stay with the Operator’s call history until the Operator deletes them or closes the account.
- Knowledge-base content stays until the Operator removes it.
- Invoices and payment records are kept for the period required by Indian tax law.
- Integration tokens are deleted on disconnect. Account data is deleted within 30 days of account deletion, except where retention is required by law.
7. Security
Data is encrypted in transit (TLS) and at rest. Access inside Zencia is limited to staff who need it to operate the Service and is logged. Integration credentials are stored separately from general account data. No system is perfectly secure; if we learn of a breach affecting you, we will notify you and the relevant authority as the law requires.
8. International transfers
We are based in India and use cloud infrastructure that may store or process data in other countries, including the United States and the European Union. We rely on our providers’ contractual safeguards for these transfers.
9. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to withdraw consent. Operators can edit or delete most data from the dashboard. Callers should contact the Operator whose agent they spoke with, since the Operator controls that data; we will assist the Operator. For anything else, write to info@zencia.ai. We respond within 30 days.
10. Children
The Service is for businesses and is not directed at children under 18. We do not knowingly collect data from children.
11. Cookies
We use strictly necessary cookies and browser storage to keep you signed in and remember preferences such as language. We do not use advertising cookies on the app.
12. Changes
We may update this policy. Material changes are announced in the dashboard or by email before they take effect. The date at the top shows the latest revision.
13. Contact
Zencia AI Tech Private Limited
5/68 Vishal Khand, Gomtinagar, Lucknow, Uttar Pradesh 226010, India
info@zencia.ai