Privacy Policy

This Privacy Policy explains how AIforge Tech Private Limited ("Finn", "we", "us", "our") processes personal data. We provide a platform that lets businesses build and run AI agents that talk to their own customers by phone, WhatsApp, website chat, SMS and email, and lets their own sales representatives call leads through the Rep Parallel Dialer (together the "Software" or "Platform"), accessible via hirefinn.ai.

Our practices are designed to meet the data protection frameworks that apply to us, including the Digital Personal Data Protection Act, 2023 (DPDP, India) and the General Data Protection Regulation (GDPR, EU/UK). For California residents, Section 12 sets out how we honor rights under the California Consumer Privacy Act, as amended by the CPRA (CCPA, USA).

How we call, text and email people, and how to make it stop, is explained in our Communication Terms at hirefinn.ai/communication-terms.

1. Our Role: Controller vs. Processor

To clarify our legal responsibilities, Finn operates in two distinct capacities:

• Data Controller: We are the Controller for personal data about people who use or buy our services ("Users", including team members who log in to a User's account); people who book a demo, contact us, sign up for updates or visit our Website; business contacts we reach out to about Finn (Section 2.C); and people our own team or our own AI agent calls, texts, emails or chats with about Finn.
• Data Processor: When a business uses Finn to talk to its own customers or contacts ("End Customers") — on calls, WhatsApp, website chat, SMS or email — we act only as that business's Processor. The business is the Controller (or "Business" under the CCPA, or "Data Fiduciary" under India's DPDP Act): it decides why and how the data is used, and it is responsible for telling End Customers about it and for obtaining any consent needed to call, text, message or record them. If a business contacted you through Finn, that business's own privacy policy applies to you.

Our services are designed for business use and are not directed to individuals under 18. We do not knowingly process the personal data of minors; if we learn that we have, we will delete it.

2. What Data We Collect

We collect data in the categories below. Most of it comes from you directly. Some comes from the businesses that use Finn (End Customer data), from Meta when a business connects WhatsApp (Section 5), from our payment providers, from your device when you use our Website, from data providers and public sources for our own business outreach (Section 2.C), and, when a business asks us to, from contact-data enrichment providers listed at hirefinn.ai/subprocessors.

A. Account and Billing Data (User Data)

To register and run your account, we collect:

• First and last name
• Email address
• Company name
• Your team members' names, email addresses and roles
• Records of actions taken in the dashboard (for example, which team member replied to a conversation)
• If you connect WhatsApp, the account details Meta shares with us during setup (see Section 5)

If you choose a paid service, we also collect your payment details. Payments are processed by our payment providers; we do not store full card numbers.

Purpose: To fulfill our SaaS contract, manage your plan and wallet, and provide customer support.

B. Demo Bookings and Enquiries

When you book a demo, we collect:

• Full name and work email address
• Phone number (optional)
• Company website, company size, what you want Finn for (calls, chat, the dialer) and, optionally, your monthly conversation volume
• Anything you write in the comment box
• Your choices on the optional "Text me" and "Call me" boxes, and a record of those choices (see Section 4)

Purpose: To schedule and hold your demo, follow up about it and answer your questions; if you ticked the matching box, to text you or have our AI agent call you about your demo and account; and to send you occasional product-update emails (see Section 2.J).

C. Business Contact Data We Obtain From Other Sources

For our own business-to-business sales outreach, we obtain the business contact details of people at companies that may be interested in Finn. We are the Controller of this data.

What we collect: name, work email address, job title, company, business phone number, and LinkedIn or other public professional profile URL.

Where it comes from: business contact data providers we obtain lists from, and public sources such as company websites and professional networks.

Why we use it: to contact you about Finn by email, and by calls from a member of our team (we don't make promotional sales calls to Indian numbers). We do not send these contacts automated text messages or AI voice calls without their consent.

Legal basis: our legitimate interest in offering our services to businesses that may need them; consent where the law requires it.

How long we keep it: 24 months after our last contact with you, unless you object sooner or become a User.

Your right to object: you can object or opt out at any time by using the unsubscribe link in any of our emails, by telling the person who calls you, or by emailing [email protected]. We will then stop contacting you and keep only your email address or phone number, and the date, on our opt-out list so we don't contact you again.

D. Communications Data (End Customer Data)

When a business uses Finn, we process on its behalf:

• Calls: real-time audio, voice recordings and transcripts; caller and recipient phone numbers, routing data, call duration and timestamps.
• Messages (WhatsApp, website chat, SMS and email): message text and any files, images or voice notes sent; the person's phone number, WhatsApp profile name, email address or any name they give; delivery and read status; and timestamps.
• Website chat on a business's site: the page the chat was started from and technical data such as browser type and IP address, used to run the chat and keep out spam.
• Analytics: conversation summaries, and sentiment and mood detection analysis generated by the AI.
• Data a business adds: contact lists the business uploads, and details its AI agent captures during a conversation.
• Rep Parallel Dialer: lead names and phone numbers, call outcomes and notes, recordings and transcripts where the business enables them, and the names and voices of the business's representatives.

Purpose: To run the business's AI agents and inbox on its behalf, as it instructs.

When our own AI agent or team talks to you about Finn — for example a demo call, a text about your booking, or a chat on hirefinn.ai — we process the same kinds of data as Controller, for the purposes in Section 3.

E. Website Chat on hirefinn.ai

Chat on hirefinn.ai, on our website and in the dashboard, runs on Finn's own chat widget, hosted on our own Platform. A chat may be answered by an AI agent, which tells you it is an AI, or by a member of our team. If you are signed in, we pass your name, email address, account ID and workspace to the chat so we know who we are talking to.

When you chat with us, we process your messages, any name, email address or phone number you choose to give, the page you started the chat from, and technical data such as your browser type and IP address. The widget stores a small identifier in your browser so an open conversation can continue when you come back. Chat conversations are kept as described in Section 9.

F. Visiting Our Website

When you visit our Website for informational purposes, we automatically collect and store certain "log data". This data is stored temporarily in server log files to ensure the stability and security of the Website, and is deleted on a rolling basis once it is no longer needed for those purposes. The data includes:

• IP address
• Browser and operating system information
• Referral URL
• Time and duration of access
• Retrieved files and services used

Purpose: The legal basis for this data processing is our legitimate interest in ensuring the proper operation of the Website.

G. Cookies and Third-Party Tracking

Our Website uses cookies to improve functionality and analyze your usage. You can manage cookie preferences via your browser settings or our cookie banner. We use two types of cookies:

• Session Cookies: These are deleted after your visit.
• Persistent Cookies: These remain on your device until deleted manually.

For product analytics we use PostHog, and our own chat widget provides website and in-app support. These may set cookies or similar storage to track usage and keep a chat open; you can manage or revoke your consent at any time via the cookie banner. For signed-in Users, the chat widget is part of in-app support and is not controlled by the banner.

When a User clicks "Connect WhatsApp" in the dashboard, we load Meta's software (the Facebook JavaScript SDK) to run Meta's sign-up window. Meta's own privacy policy applies to that window.

H. Contact Form

When you use our contact form, we collect:

• Your name
• Email address

Purpose: This data is used solely to respond to your queries and will not be shared with third parties unless explicitly stated in this policy.

I. Third-Party Services

We use service providers to host, run, secure and support Finn, including cloud hosting, AI model providers, telephony and messaging providers, payment processors, email delivery, analytics, error monitoring, bot protection and network security, and contact-data enrichment and company-research providers. Section 6 explains who receives what. A complete, current list of the third parties that process data on our behalf — including the purpose and region of each — is published at hirefinn.ai/subprocessors. For more information on how these services process your data, you can consult their respective privacy policies.

J. Email From Finn

We send three kinds of email:

• Service emails about your account, security, billing or a demo you booked. We send these as needed to provide the service, and they do not contain advertising.
• Product updates. If you book a demo or sign up, we may send you occasional emails about new features and product news.
• Replies to questions you send us.

Product-update emails are sent from our own systems through Google Workspace (Gmail API). Google is one of the subprocessors listed at hirefinn.ai/subprocessors.

Every product-update email has an unsubscribe link, and you can also unsubscribe at hirefinn.ai/marketing/unsubscribe or by emailing [email protected]. We act on unsubscribe requests within 10 business days, usually much sooner. After you unsubscribe, we keep your email address on a suppression list only so we don't email you again.

Our basis for product-update emails depends on where you are. In the EU and UK, it is our legitimate interest in telling business contacts about a product they have shown interest in; you can object at any time and we will stop. In India, it is the consent you give when you book a demo or sign up, which you can withdraw at any time as easily as you gave it. In the US, we send these emails in line with the CAN-SPAM Act.

We do not send marketing text messages. Texts and calls are covered in Section 4.

3. How We Use Data and Why (Legal Bases)

We use personal data only for the purposes below. Where the GDPR or the DPDP applies, the legal basis for each purpose is:

• Creating and running your account, billing you and giving support (account and billing data): performance of our contract with you (GDPR); your consent or a legitimate use you initiated (DPDP).
• Running a business's AI agents and inbox (communications data): we act on the business's instructions as its Processor; the business chooses its own legal basis.
• Holding your demo and following up about it (demo booking data): steps you asked us to take before entering into a contract, and our legitimate interests (GDPR); data you gave voluntarily for that purpose (DPDP).
• Texting you, or having our AI agent call you, about your demo and account (phone number and consent record): your consent, given by ticking the boxes on our form, which you can withdraw at any time.
• Business-to-business outreach by email and by calls from our team (business contact data, Section 2.C): our legitimate interests; consent where the law requires it.
• Sending product-update emails (name, email address, company): see Section 2.J.
• Keeping records that prove consent and honoring opt-outs (consent and opt-out records): legal obligation, and our legitimate interest in showing that we follow communications laws.
• Keeping the Website and Platform secure and working, and preventing fraud and abuse (log data, device data, account activity): legitimate interests (GDPR); legitimate uses permitted by law (DPDP).
• Analytics on our Website and product (cookie and usage data): your consent via the cookie banner.
• Complying with law, tax and accounting rules, responding to lawful requests and defending legal claims (any relevant data): legal obligation; legitimate interests.

If you don't give us data that a contract needs (for example, a working email address for an account), we can't provide that service. Everything else on our forms is optional unless marked as required.

4. Calls, Text Messages and Your Mobile Number

We call and text people in India, the European Union, the United Kingdom and the United States, and follow the calling and messaging rules that apply in each.

How we get your consent. On our Book a demo form, after you type a phone number, we show two optional boxes that are never pre-ticked: "Text me (SMS/WhatsApp)" and "Call me (incl. AI agent)", for demo and account updates only. Neither is required to book. A member of our team may still phone you about the demo you booked; we only text you, or have our AI agent call you, if you ticked the matching box or contacted us first on that channel.

What the texts are for. We text you, by SMS or WhatsApp, about your demo booking, your account and support conversations. We do not send marketing texts. Message frequency varies. Message and data rates may apply.

What we record about your choice. For each box we store the channel, whether you said yes or no, the date and time, the version of the wording you saw, the page you were on, your IP address and your browser's user agent. When you reply STOP, say "stop calling", or otherwise opt out, we record that too. We keep these records to prove consent and to make sure we don't contact you after you opt out: consent records for 4 years after the last call or text to that number, and our opt-out list indefinitely, holding only the number or email address and the date.

Calls. Our AI voice agent tells you it is an AI. Calls may be recorded and transcribed, and we tell you at the start of the call when it is recorded. We call only between 8 am and 9 pm in your local time (9 am to 9 pm in India), or within shorter hours where local law requires.

India. Texts to Indian numbers are sent only from DLT-registered headers and templates under TRAI rules. We don't send promotional texts or make promotional sales calls to Indian numbers.

Your mobile number is not shared for marketing. We do not sell, rent or share mobile numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. Mobile information is shared only with the service providers that deliver our messages (for example, telecom carriers), and only to deliver them. Text-messaging opt-in data and consent are excluded from all other sharing described in this policy.

Stopping calls and texts. Reply STOP to any text from us, say "stop calling" or "do not call" on any call, or email [email protected]. Replying STOP to our SMS also stops our WhatsApp messages, and replying STOP on WhatsApp also stops our SMS. Reply HELP for help. A "stop calling" or "do not call" request puts your number on our do-not-call list. Full details are in our Communication Terms at hirefinn.ai/communication-terms.

Businesses that use Finn to call or text their own customers are responsible for their own consent and opt-out handling (see Section 1).

5. WhatsApp and Data We Receive From Meta

Businesses can connect their own WhatsApp Business account to Finn using Meta's sign-up flow ("Embedded Signup"). When they do, and while they stay connected, we receive from Meta:

• The business's WhatsApp Business Account ID, phone number ID, display phone number and business name
• An access token that lets Finn send and receive messages for that number
• The business's approved message templates
• Messages its customers send and receive (text and any media), with each customer's phone number and WhatsApp profile name, and message delivery and read status

How we use it. Only to deliver that business's WhatsApp conversations: to show messages in the business's Finn inbox, to generate its AI agent's replies, to send replies and approved message templates written by the business's team, and to keep the connection working. We do not use data received from Meta for advertising, we do not sell it, and we do not use it to train AI models (see Section 7).

Who processes it. Messages are stored on our cloud infrastructure in the region agreed for the business's workspace, and are sent to our AI model providers, listed at hirefinn.ai/subprocessors, only to generate replies. Meta also processes the messages to deliver them, under WhatsApp's terms and Meta's privacy policy.

How WhatsApp messages work. When a customer messages a business, the business can reply freely for 24 hours after that customer's last message; after that, it can send only message templates that Meta has approved. A customer can block the number at any time, or ask the business to stop messaging them.

How long we keep it. WhatsApp conversations are kept for 24 months by default, or for any other period agreed for the business's workspace, and are deleted when that period ends. When a business disconnects WhatsApp in Finn, we stop receiving new messages for that number and delete its access token.

How to delete your data:

• If you are a business: disconnect WhatsApp in your Finn dashboard, or email [email protected] from your account email address asking us to delete your WhatsApp data. We complete deletion within 30 days and confirm in writing.
• If you messaged a business on WhatsApp: contact that business, which controls your conversation. You can also email [email protected] with the business's name and your phone number; we will pass your request to the business and help it delete your data.
• You can also remove Finn's access at any time in your Meta Business settings.

6. Who We Share Data With

We share personal data only as follows:

• Service providers (subprocessors) that host, run and support Finn, such as cloud hosting and storage providers, AI model and speech providers, telephony and messaging providers, email, payment processors, and analytics, monitoring and security tools. They may use the data only to provide their service to us. The full list, with the purpose and region of each, is at hirefinn.ai/subprocessors.
• Meta (WhatsApp), to deliver WhatsApp messages for businesses that connect it (see Section 5), and our own WhatsApp messages to people who asked us to text them.
• The business you dealt with. If a business contacted you through Finn, your conversation data belongs to that business and is available to it.
• Professional advisers such as lawyers and auditors, under duties of confidentiality.
• Authorities, when the law requires it.
• A buyer or successor, if our business is sold or merged, under the same protections as this policy.

We do not sell personal data. Mobile numbers and SMS opt-in consent are never shared for marketing (see Section 4).

7. AI Models and Your Data

We do not use your Input or Output (as defined in our General Terms and Conditions), your call recordings, transcripts or messages, or data we receive from Meta, to train, retrain, or fine-tune any AI model. Our conversational AI, on every channel, uses our own models and third-party AI providers engaged under terms, or with account settings, that exclude your data from model training; the providers are listed at hirefinn.ai/subprocessors. We use zero-data-retention configurations where the provider offers them and your plan includes them; otherwise, the provider may retain data only for a limited operational period under its own terms, and not for model training.

Users retain ownership of their data. Finn receives only a license to process that data as needed to provide the service, as set out in our General Terms and Conditions and Data Processing Addendum.

Telling people they are talking to AI. Finn's own AI agents tell people they are AI. Businesses configure their own agents and are responsible for disclosing AI use and call recording as their local law requires; Finn provides the tools to do so (see hirefinn.ai/compliance).

Automated decision-making and profiling. Sentiment and mood analysis and conversation summaries are generated as analytics for the User (the Controller of End Customer data). Finn does not use them, or any other automated processing, to make decisions about you that produce legal or similarly significant effects.

Biometrics. We do not use voice recordings to identify individuals, create voiceprints, or process biometric identifiers for identification purposes.

8. Security and Industry-Specific Compliance

We provide enterprise-grade infrastructure designed to meet the strict security requirements of the healthcare, financial services, insurance, and debt collection sectors.

Security Measures: We implement robust technical and organizational safeguards, including data encryption in transit and at rest, and role-based access controls, to protect personal data from unauthorized access, loss, or manipulation. These measures are continually updated to reflect new security developments.

Compliance Frameworks: We hold a SOC 2 Type II attestation from an independent auditor; the report is available to customers under NDA.

Healthcare & Finance: For Users processing Protected Health Information (PHI) or highly sensitive financial data, specific obligations are governed by our separate Data Processing Addendum (DPA) and a Business Associate Agreement (BAA), which must be executed before PHI may be processed.

9. Data Retention and Deletion

We retain User account data while the account is active and as required by tax and commercial laws. Call data (including audio recordings and transcripts, and Rep Parallel Dialer call records) processed on behalf of Users is retained for 24 months by default, or for any other period agreed for the User's workspace, or until the User requests deletion. Rep Parallel Dialer call outcomes, attempt counts and do-not-call flags are kept for the life of the User's account so that its opt-outs keep working, and are deleted on termination. On termination, this data is deleted within thirty (30) days as set out in our Data Processing Addendum.

Messages and chat conversations (WhatsApp, website chat, SMS and email in the Finn inbox) processed on behalf of Users are retained for 24 months by default, or for any other period agreed for the User's workspace, and are deleted when that period ends or when the User requests deletion. On termination, this data is deleted within thirty (30) days as set out in our Data Processing Addendum.

Automatic Inactivity Wipe: To enforce strict data minimization, if a User account remains entirely inactive for a period of twelve (12) months, all associated End Customer call data (including audio and transcripts) will be automatically and permanently deleted.

Other data we keep as Controller:

• Demo bookings, enquiries and business contact data (see Section 2.C): 24 months after our last contact with you, unless you become a User.
• Consent records for calls and texts: 4 years after the last call or text to that number, so we can prove consent.
• Opt-out list (do-not-call, STOP and email unsubscribes): kept indefinitely, holding only the number or email address and the date, so we don't contact you again after you opt out.
• Our own conversations with you by website chat, WhatsApp, SMS or email: 24 months by default.
• WhatsApp access tokens: until the business disconnects WhatsApp or closes its account.
• Website log data: deleted on a rolling basis, as described in Section 2.F.

When a retention period ends, we delete or anonymize the data, unless the law requires us to keep it longer.

10. Your Data Protection Rights

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("Right to be Forgotten").
• Restrict or Object to certain processing activities, including marketing.
• Data Portability to receive your data in a machine-readable format.
• Withdraw Consent at any time where processing is based on consent. Withdrawing is as easy as giving it: reply STOP to texts, say "stop calling" on calls, or use the unsubscribe link in emails.
• Nominate another person to exercise your rights if you die or become unable to (India).
• Have your grievance handled by our Grievance Officer (see Section 14).
• Lodge a Complaint with a supervisory authority: if you are in the EU or UK, with your local data protection authority; if you are in India, with the Data Protection Board of India after first raising your grievance with our Grievance Officer (see Section 14).

To exercise your rights over data we control, or to ask us to delete your data, email [email protected]. Grievances can also be raised with our Grievance Officer at [email protected].

If a business contacted you through Finn, please send your request to that business (the Controller). If you send it to us instead, we will pass it to the business and help it respond.

11. International Data Transfers

If we transfer personal data outside of its originating jurisdiction (e.g., outside the EEA or India), we ensure appropriate legal safeguards are in place, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or other safeguards recognized under applicable law, to maintain data security. A current, per-workspace-region view of where each subprocessor processes data is published at hirefinn.ai/subprocessors.

Stored data, including call recordings, transcripts and chat conversations, is kept at rest in the region agreed for the User's workspace (India by default), as set out in our Data Processing Addendum. AI processing may take place in other regions, as listed on our subprocessors page, and WhatsApp messages are also processed by Meta. Rep Parallel Dialer recordings are stored with our telephony provider, and error logs with our monitoring provider, in the locations shown on our subprocessors page.

12. California Privacy Rights (CCPA/CPRA)

For call recordings, transcripts, messages and other End Customer data processed through our platform, we act as a service provider; requests concerning that data should be directed to the business you interacted with (our User, the Controller). For our direct Users, demo bookings, business contacts and website visitors, we act as a business.

We do not sell or share personal information, as those terms are defined in the CCPA as amended by the CPRA, and we have not done so in the preceding twelve (12) months. We do not use or disclose sensitive personal information for purposes that would require a right to limit.

In the last 12 months, as a business, we collected the categories below, from the sources in Section 2, for the purposes in Section 3, and disclosed them for business purposes only to the recipients in Section 6:

• Identifiers (name, email address, phone number, IP address, account ID): kept as described in Section 9.
• Commercial information (plan, wallet top-ups and billing history): while your account is active and as tax law requires.
• Internet activity (website and product usage, cookies): as described in Sections 2.F and 2.G.
• Audio and electronic information (recordings, transcripts and messages from our own calls, texts and chats with you): kept as described in Section 9.
• Professional information (company, job title, company website, company size, professional profile URL): 24 months after our last contact with you.
• Sensitive personal information (account log-in credentials): used only to secure your account, for as long as the account exists.

If you are a California resident, you have the right to:

• Know and access the personal information we collect about you, including the categories collected, their sources, and the purposes of collection.
• Correct inaccurate personal information.
• Delete your personal information, subject to statutory exceptions.
• Opt out of the sale or sharing of personal information (not applicable — we do not sell or share).
• Limit the use of sensitive personal information (not applicable — see above).
• Not be discriminated against for exercising any of these rights.

To exercise these rights, email [email protected] or our Grievance Officer at [email protected]. We will verify your request and respond within forty-five (45) days. You may designate an authorized agent to submit a request on your behalf; we will require proof of the agent's authorization and may verify your identity directly.

13. Changes to This Policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change materially affects how we use data you already gave us, we will tell Users by email or in the product before it takes effect, and ask for fresh consent where the law requires it.

14. Contact Information

For data protection inquiries, to exercise your rights, to request deletion of your data, or to access our Data Processing Addendum (DPA) — published at hirefinn.ai/dpa — please contact:

• AIforge Tech Private Limited (CIN U62099RJ2025PTC099494), D-253, Kardhani Govindpura, Kalwar Road, Jaipur, Rajasthan - 302012, India.
• Email: [email protected]
• Grievance Officer (under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023): Rajvirendra Singh Shekhawat, Director, AIforge Tech Private Limited, D-253, Kardhani Govindpura, Kalwar Road, Jaipur, Rajasthan - 302012, India. Email: [email protected]

We have not appointed a Data Protection Officer; our Grievance Officer handles data-protection enquiries.

We acknowledge grievances within 72 hours and resolve them within 30 days. If you are in India and your grievance is not resolved within that period, you may escalate it to the Data Protection Board of India.

EU Representative (Article 27 GDPR): We have appointed Prighter Group as our EU representative for data protection matters. If you are located in the European Union, you may contact our representative directly to exercise your data subject rights (such as access or erasure of your personal data) at https://app.prighter.com/portal/portier

UK Representative (UK GDPR): We have appointed Prighter Group as our UK representative for data protection matters. If you are located in the United Kingdom, you may contact our representative directly to exercise your data subject rights (such as access or erasure of your personal data) at https://app.prighter.com/portal/portier