Effective 29 October 2026. What changed: Rewritten in full to cover all four products (Loop, Talk, Dial and Experts), to name who runs Revvox, to list where data is stored today and every kind of supplier that touches it (by category, with each one’s purpose, data and region; the names are given to customers on request), to state the real default retention periods, and to set out credits, refunds and the Experts marketplace rules.
1. Who we are
Revvox is a trading name of Prince Kumar Singh, a sole proprietorship registered as a micro enterprise under Udyam, India. There is no separate company. In this policy “Revvox”, “we” and “us” mean that business. Contact: hello@revvox.io.
This policy covers revvox.io, interviews.revvox.io and experts.revvox.io, the Revvox app, and the calls, chats and interviews run through it.
2. Two roles: controller and processor
Revvox sells four products to businesses:
- Loop: an AI agent that calls a business’s new leads, qualifies them and books the next step.
- Talk: AI chat on a business’s website, online store and messaging channels.
- Dial: AI first-round hiring calls and coding rounds for employers.
- Experts: a marketplace where candidates book mock and technical interviews with independent human interviewers.
Our responsibility depends on whose data it is:
- We are the controller (in India, the data fiduciary) for our own customers’ account and billing data, website visitors, and Experts candidates and interviewers. We decide how that data is used.
- We are a processor for the people our customers contact: leads, job candidates, shoppers and chat visitors. The customer decides who is contacted and why, and we act only on its instructions under our data processing terms. For that data the customer is the controller.
3. What we collect
| About | What | From |
|---|---|---|
| Account | Name, work email, phone number, company, role, password hash or passkey, two-step login settings. If you sign in through the sign-in provider you choose, the name, email and photo it shares. | You |
| Billing | Plan, credits bought and used, invoices, billing country and tax ID. Card and UPI details go to our payment provider and never reach us. | You, our payment provider |
| Workspace content | Agent scripts and settings, questions, knowledge-base documents, job descriptions, chatbot setup, workflows, team members and their roles. | Customer |
| Leads and contacts (Loop) | Name, phone, email, what they asked about, the source form or CRM, consent record, call outcomes, scores. | Customer, its forms and CRM |
| Calls | Recording, transcript, answers extracted, summary, call times, numbers dialled, opt-out requests. | The call |
| Chats (Talk) | Website and messaging-channel messages, the name, phone or email a shopper gives, and the order details a chat looks up from a connected online store. | The chat, the customer's store |
| Candidates (Dial) | Name, phone, email, CV details, answers on the screening call, coding-round code and integrity signals, interview videos and ID photos where the employer asks for them. | Employer, the candidate |
| Experts candidates | Name, email, the rounds booked and paid for, the interviewer's written report, no-show and refund records. | You, the interviewer |
| Experts interviewers | Professional profile details shared by the sign-in provider they choose, skills, availability, rounds taken, ratings and reports written, and payout details (UPI ID, bank account or online payment account email). | You, your sign-in provider |
| Usage and security | IP address, browser, sign-in attempts, sessions, and an audit trail of logins, exports and setting changes. | Your device, our servers |
| Website visitors | IP address and pages requested; what you type into the early-access form or the call-me form. | You |
We do not ask for sensitive data such as health, religion or financial account details, except payout details from Experts interviewers. Customers must not configure questions that collect sensitive data without telling us first.
4. How we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running the service you signed up for: calls, chats, interviews, dashboards, integrations | Contract with you |
| Processing leads, candidates and shoppers for a customer | The customer’s instructions; the customer’s own lawful basis (usually consent) |
| Billing, invoices, tax records | Contract; legal obligation |
| Security: sign-in checks, fraud and abuse prevention, audit trails | Legitimate interests; legal obligation |
| Service emails: sign-in codes, receipts, outages, changes to terms | Contract |
| Product analytics in the app | Consent, asked once, changeable in settings |
| Analytics and advertising cookies on this website | Consent, through the cookie banner |
| Matching Experts candidates and interviewers, paying interviewers | Contract |
| Answering legal requests and enforcing our terms | Legal obligation; legitimate interests |
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use one customer’s data for another customer.
5. If you only visit our websites
Our website hosting provider serves the sites and receives your IP address and the pages you request. Fonts are served from our own domain, so no font provider sees your visit. If you fill in the early-access form, what you type goes to a private spreadsheet only Revvox can open; we use it to contact you about access and delete your row on request. If you ask the agent to call you, your number is used for that call and handled like any other call (section 8). Cookies are in section 17.
6. If a business called, messaged or interviewed you through Revvox
A business used Revvox to call you about an enquiry, a job application or an order, or to answer you in a chat. That business decides how your information is used; we hold it on its behalf. What we hold is what the business gave us (for example the details from its form or your application), what you said or typed, the recording and transcript if recording was on, and the record of when you were contacted and what happened.
To see, correct or delete it, contact the business named at the start of the call or chat. If you cannot reach it, email hello@revvox.io with the phone number or email involved; we will identify the business, pass your request on and act on its instruction.
To stop calls, say so on any call. The opt-out is saved immediately and blocks every later call from that business through Revvox.
7. AI and your data
Calls, chats and analysis are run by AI models from specialist providers:
- Voice calls run on a voice AI provider that turns speech into text and back, runs the agent’s language model during the call and keeps the call recording.
- Chat replies, call analysis, summaries, document reading and Vira (the in-app assistant) use large language models from AI model providers, depending on how the service and the workspace are set up.
These providers process data in the United States (section 11). The categories are listed in section 10.
We do not use customer data to train or fine-tune any AI model, ours or anyone else’s, and we have no models of our own trained on it. We send these providers only what a task needs, through their business APIs. We use AI model providers under business terms that do not allow them to train their models on your data, as their terms state, and we have not opted in to any such use; they may keep data for up to 30 days to detect abuse. The voice AI provider processes call audio as our sub-processor under its business terms. Each provider’s own terms govern what it keeps.
AI can be wrong. Scores, summaries, fit labels and suggested replies are aids for the business, not decisions about you. Hiring decisions in Dial are made by the employer. If you think an automated assessment was wrong, ask the business to review it; it can see the recording, transcript and reasons.
8. Calls, recordings and calling rules
Every call opens by saying it is an AI assistant and naming the business it is calling for. The agent cannot be set to claim it is a human. Where a call is recorded, the opening line says so, and a business can switch recording off.
Before each call Revvox checks the calling hours for the person’s time zone, the business’s opt-out and do-not-call lists, and the consent record held for that person, and it blocks and logs any call that fails. Checking national do-not-call registries (such as India’s NCPR or the US National DNC Registry) remains the business’s responsibility unless we tell it in writing that we do it for its account.
Recordings and transcripts are kept for the periods in section 12, then deleted, including the copies our voice AI provider and telephony carriers hold, which we ask them to delete.
9. Who we share data with
- Suppliers that run parts of the service for us, listed in section 10.
- Services a customer connects: its CRM, store, messaging channels, calendar or ad platforms. Data goes there because the customer asked for it, and the customer’s agreement with that service governs it.
- Within Experts: an interviewer sees the candidate’s name, the round booked and anything the candidate shares in the round; the candidate sees the interviewer’s public profile and report.
- Authorities, when the law requires it. We push back on requests that are not lawful and tell the customer unless we are not allowed to.
- A buyer or successor of the business, bound by this policy, if Revvox is sold or transferred. We will tell customers first.
10. Sub-processors
| Category | Purpose | Data | Region |
|---|---|---|---|
| Cloud hosting and file storage | Servers that run the Revvox API, call gateway and workers, and store files (interview videos, voice samples, uploads, ID photos); encrypted backups | Everything the service processes passes through these servers | India (Bengaluru) |
| Database | Primary database | Account, workspace, lead, contact, call, chat and billing records | India (Mumbai) |
| Website and app hosting | Serves this website and the Revvox web app | IP address, pages requested, and the app traffic passing to our API | Global edge; app functions in India (Mumbai) |
| Voice AI | Runs the voice agent: speech recognition, speech synthesis, the call's language model, and call recordings | Call audio, transcripts, the phone number dialled, the lead or candidate details the agent needs on the call | United States |
| AI language models | Website and messaging chat replies, call analysis and summaries, reading uploaded documents, drafting agents, chatbots and workflows, and the in-app assistant | Chat messages, transcripts, extracted answers, documents and descriptions you send, the context needed to answer | United States |
| Telephony carriers | Phone numbers, placing and carrying calls | Phone numbers, call audio in transit, call metadata | Global |
| Payments: merchant of record | Takes payment, issues invoices, handles tax and refunds | Billing name, email, country, tax ID if given, what was bought; card and UPI details go to the payment provider, never to us | Global |
| Transactional email | Account emails: sign-in codes, verification, password reset, invitations, receipts and notices | Recipient email address, the email's content, delivery and bounce events | Outside India (Japan sending region) |
| Feature switches and product analytics | Feature switches for every workspace; product analytics in the app only for people who say yes to it | Workspace ID and which features are on; for those who agreed, pages and buttons used (never what you type) | European Union |
| Early-access sign-ups | A private spreadsheet that stores the website's early-access form | What you type into the early-access form | Global |
| Sign-in provider you choose (only if chosen or switched on) | Lets you sign in with an account you already have, only if you choose it | Name, email and profile photo it shares at sign-in; for Experts interviewers, their professional headline too | Global |
| Bot protection (only if chosen or switched on) | A bot check on sign-up and website chat, when switched on | IP address and browser signals during the check | Global |
| Video rooms and shared code pad | The video room and the shared code pad for Experts interview rounds | Audio and video of the round, display names, code typed during the round | Global |
Apps you connect (stores, CRMs, team chat, messaging channels, calendars, ad platforms for lead forms and conversion events, your own phone numbers) receive only what you choose to sync, under your own agreement with them.
The names of our sub-processors are given to customers under our data processing agreement. Email hello@revvox.io for the current list. We tell customers 30 days before adding or replacing a sub-processor, and they can object.
These are the kinds of suppliers that process personal data for us, with what each does and where. Categories marked as used only if chosen or switched on see nothing until then. The same list is kept on our sub-processor page.
11. Where data is stored, and international transfers
Our servers and stored files are in Bengaluru, India, and our database is in Mumbai, India. Call recordings are held by our voice AI provider in the United States, AI language models run in the United States, and some other suppliers process data outside India (section 10 shows the region for each category).
If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to India and the United States. Neither has an adequacy decision covering all these transfers, so we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) in our own contracts and in our suppliers’ data processing terms, plus the security measures in section 13. Ask us for a copy of the relevant clauses.
12. How long we keep data
| What | Kept for (default) |
|---|---|
| Call recordings | 90 days. A workspace can set 1 to 365 days. |
| Call transcripts | 180 days. A workspace can set 1 to 365 days. |
| Leads (Loop) and contacts (Dial) | 1 year after the last activity. A workspace can set 30 days to 5 years. |
| Call attempt records (time, route, outcome) | 1 year after the call. A workspace can set 30 days to 5 years. |
| Conversations with Vira, the in-app assistant | 180 days after the last message. A workspace can set 7 days to 2 years. |
| Interview videos, voice samples and coding-round code | 90 days |
| ID photos | 30 days |
| Uploaded files (lists and documents being imported) | 30 days; what was imported follows the windows above |
| Website chat and messaging transcripts (Talk) | While the workspace is open, or until the customer deletes them |
| Complaints (grievance register) | 3 years after the last change |
| Billing and payment records | 8 years, for tax law |
| Opt-out and do-not-call records, consent withdrawals | Kept while the workspace is open, because they stop the next call |
| Audit trail (who did what in a workspace) | 7 years |
| Sign-in attempts / ended sessions / account emails | 90 days / 30 days / 30 days |
| Encrypted backups | Up to 12 months, after which deleted data is gone from backups too |
When a period ends the data is deleted, including the vendor copies we can reach. If you delete your account, your personal account data is erased, and any workspace only you belonged to is closed and stops renewing; its records then expire on the windows above. To have a closed workspace deleted sooner, email hello@revvox.io and we will do it within 30 days. Records the law makes us keep (billing, and opt-outs that stop future calls) are kept for that purpose only.
13. Security
- Encryption in transit (TLS) everywhere, and at rest for the database and backups.
- Phone numbers, access tokens and other secrets are also encrypted field by field (AES-256-GCM).
- Role-based access inside each workspace, and every workspace’s data kept apart from every other.
- An audit trail of logins, exports and setting changes that customers can see.
- Staff tools require two-step login, and staff actions on a workspace are logged.
- Encrypted backups and a written restore process.
We hold no third-party security certification (such as SOC 2 or ISO 27001) yet. If a breach affects your personal data, we will tell affected customers without undue delay, and tell regulators and affected people where the law requires it (for GDPR, the regulator within 72 hours of becoming aware).
14. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your data, in a portable format;
- correct or complete it;
- delete it;
- restrict or object to how we use it, including any use based on legitimate interests;
- withdraw a consent you gave, at any time.
Account holders can export their own data and delete their account in the app’s account settings. For anything else, email hello@revvox.io. We answer within 30 days, free, and we may ask you to prove who you are. If we process your data for a customer (section 6), we pass your request to that customer.
EEA and UK: you can also complain to your local data protection authority (in the UK, the ICO). California: you have the rights to know, delete, correct and opt out of sale or sharing, and to limit use of sensitive data; we do not sell or share personal information as those laws define it, and we will not treat you differently for using your rights. An authorised agent can ask for you with your signed permission. India: see section 15.
15. India: the DPDP Act, 2023
Revvox is run from India and stores its main database and files in India, so the Digital Personal Data Protection Act, 2023 applies to everything we do. Where this section and the rest of the policy differ for people in India, this section applies.
Who is the data fiduciary
For account, billing, website and Experts data, Revvox is the data fiduciary. We rely on your consent when you sign up or book, and on the legitimate uses the Act allows, such as meeting a legal obligation. For the people our customers contact (leads, candidates, shoppers), the customer is the data fiduciary: it must hold a valid consent, or another lawful ground, for each person, and we are its data processor.
Notice
This policy is our notice: what we process, why, and how to use your rights and complain. Every call opens by naming the business calling, saying it is an AI assistant, and saying when the call is recorded.
Your rights as a data principal
- Access: a summary of the personal data we process about you, what we do with it, and who we shared it with.
- Correction and erasure: to correct, complete or update your data, and to erase data we no longer need.
- Withdraw consent: as easily as you gave it. Withdrawal does not undo processing already done.
- Grievance redressal: to complain to our grievance officer and get an answer.
- Nomination: to name someone to use these rights for you if you die or cannot act.
If a business contacted you through Revvox, send the request to that business, or email us and we will pass it on and act on its instruction (see section 6). On a call you can simply say you do not want more calls: it is recorded at once and blocks every later call from that business through Revvox.
Grievance officer
Prince Kumar Singh, Founder. Email hello@revvox.io with “Grievance” in the subject. We acknowledge within 7 days and resolve within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
Breaches
If a personal data breach happens, we will tell the Data Protection Board of India and each affected person as the Act and its rules require, and tell affected customers without undue delay so they can meet their own duties.
Transfers outside India
Some suppliers process data outside India, mainly in the United States (see section 10). We do not transfer personal data to any country the Government of India has restricted.
16. Children
Revvox is for businesses and for adults. Nobody under 18 may hold an account or book an Experts round, and customers must not use Revvox to contact anyone under 18. If you think we hold a child’s data, email hello@revvox.io and we will delete it.
17. Cookies and similar storage
| Name or kind | Why | Type |
|---|---|---|
| rvx_consent | Remembers your cookie choice on this website, for 180 days | Essential |
| Sign-in cookies in the app | Keep you signed in and protect forms from forgery | Essential |
| Analytics consent (app, browser storage) | Remembers whether you agreed to product analytics | Essential |
| Website analytics tags | Visit counts and a few button clicks; only after you choose Accept | Analytics, only with consent |
| Product analytics (app) | Which pages and buttons are used; only after you say yes | Analytics, only with consent |
Until you accept, the website’s tags run in consent mode with analytics and advertising storage denied, and the app loads no analytics at all. Change your website choice at any time: .
18. Changes to this policy
We change the effective date at the top for every change. For a change that matters, we email account owners at least 30 days before it takes effect, unless the law or a security issue needs it sooner.
19. Contact and grievances
Email hello@revvox.io. For grievances under India’s DPDP Act, write to the grievance officer named in section 15 with “Grievance” in the subject.