Privacy Policy

Effective date: 28 September 2026

1. Who we are

This policy explains how Comcent Technologies Private Limited (“Comcent”, “we”, “us”) handles personal data on this website, comcent.io, and in Comcent Cloud, our hosted voice infrastructure service at app.comcent.io.

Comcent Technologies Private Limited
Aasare, 2-187/B16, Fourth Floor, (301) Prathvi Palace
Behind Maari Gudi, Brahmavara, Karnataka, India - 576213
Email: contact@comcent.io

The open-source edition of Comcent runs on your own servers. We do not receive any data from it, and this policy does not apply to it.

2. Our role: controller and processor

Your account, billing and website use. For the data about the people who sign up, pay and visit our website, we decide why and how it is used. We are the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the “controller” under the EU and UK GDPR.
Call data. Our customers are organisations that use Comcent Cloud to handle calls with their own customers. For the calls, recordings, transcripts and contacts an organisation handles through Comcent Cloud, the organisation is the data fiduciary or controller, and we are its processor. We process that data only to provide the service to the organisation and on its instructions.

If you were on a call with an organisation that uses Comcent Cloud, please contact that organisation about your data. Its own privacy policy applies. If you contact us, we will pass your request on to it.

3. What we collect

Account data. When you or your organisation sign up: your name, email address, phone number, password (stored only as a secure hash), organisation name, and your role. If you sign in with Google or another identity provider, we receive your name and email address from it.

Billing data. The billing name and address, tax details if you give them, your top-ups, plan, charges and invoices. We do not collect or store card numbers or bank details: PayPal and Razorpay handle those. We receive payment metadata from them, such as the payment ID, amount, currency, status and the payer’s name and email.

Call data (processed for our customers). Call recordings, transcripts, AI summaries, sentiment and labels, call logs (numbers, times, durations, agents), voicemail, contact details, and voice bot conversations.

Usage data. How you use the app and website: pages and features used, device and browser, IP address, approximate location from the IP address, and logs we keep for security and troubleshooting.

Marketing and attribution data. The campaign that brought you to us, such as UTM tags and ad click IDs (for example gclid), and which ads or pages you saw before signing up. See section 6.

What you send us. Messages to support, feedback, and anything else you choose to share.

4. Why we use it and our lawful basis

Purpose	Lawful basis
Create and run your account, provide the service, process call data for your organisation	Performing our contract with you or your organisation
Take payments, issue invoices, keep accounting records	Contract, and legal obligation (tax and company law)
Security, fraud and abuse prevention (including coupon abuse and toll fraud)	Legitimate uses under the DPDP Act; legitimate interests under GDPR
Service emails (sign-up, security, low balance, renewals, invoices)	Contract
Support and responding to your requests	Contract, or legitimate interests
Analytics cookies on the website and in the app	Your consent
Advertising tags and measuring our ads	Your consent
Marketing emails	Your consent, which you can withdraw at any time
Complying with the law and responding to lawful requests	Legal obligation

Under the DPDP Act, we process your data with your consent or for the “legitimate uses” the Act allows, such as when you give us your data voluntarily to use a service or to meet a legal obligation. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before.

We do not sell your personal data.

We use the following subprocessors to run Comcent Cloud. Each gets only the data it needs for its task:

Subprocessor	What it does	Where
DigitalOcean	Hosting of the app, database and call servers	United States
Amazon Web Services (S3)	Storage of call recordings and encrypted backups	United States
OpenAI	Transcript analysis, summaries, sentiment and the voice bot	United States
Deepgram	Speech-to-text and text-to-speech	United States
Resend	Sending email	United States
PayPal	Payments outside India	Global
Razorpay	Payments in India	India
Zoho Books	Invoicing and accounting	India
Sentry	Error reports from our servers, which may include account identifiers	United States
Your phone carrier	Carrying your calls, such as Twilio or your SIP trunk provider, under your own agreement with the carrier	Depends on the carrier
We also use the analytics and advertising providers in section 6.

We may also share data:

with the Admins of your organisation, who can see its members’ activity and its call data;
with professional advisers, such as our accountants and lawyers;
when the law requires it, or to protect our users, the public or ourselves, for example against fraud; and
with a buyer or successor if our business is sold or merged, under this policy.

6. Analytics and advertising

On comcent.io we use Google Analytics, Google Ads, Reddit and Microsoft advertising tags, and PostHog. In the app, PostHog records the pages you view and the features you use, and may record your session (password fields are never recorded).

When you sign up or first top up, we may send that event and its value, with a hashed (scrambled) copy of your email address, to Google Ads and Reddit to measure how well our ads work. We store the campaign details (UTM tags and click IDs) that brought you to us on your account, so we know which ads and posts bring customers.

Your choice. Analytics and advertising cookies and tags stay off until you accept them, through the cookie banner. Google tags run in Google’s Consent Mode: until you accept, they do not set cookies for analytics or ads. You can accept or reject analytics and advertising separately, and change your choice at any time from the Cookie settings link at the bottom of every page. Cookies we use:

Necessary: signing in to the app and keeping you signed in, security, and remembering your cookie choice (comcent_consent, kept for one year). These are always on.
Analytics: Google Analytics and PostHog, to understand how people use the website and app.
Advertising: Google Ads, Reddit and Microsoft Advertising, to measure our ads and show relevant ones.

7. International transfers

We are based in India, and most of our subprocessors are in the United States. Your data may therefore be processed outside your country. We choose providers with strong security and contract terms that protect personal data.

For data from the EU, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) in our providers’ data processing agreements, or on another transfer mechanism the law recognises.

8. How long we keep it

Call recordings are kept for your plan’s retention period (30 days, 1 year or 3 years) and then deleted.
Transcripts, summaries and sentiment are kept for the life of the account, unless your organisation deletes or anonymises them sooner.
Account data is kept while the account is active. After an account is closed we delete or anonymise it, except what we must keep by law.
Billing records and invoices are kept for as long as tax and accounting law requires.
Backups. Encrypted database backups are kept for 35 days (daily backups) and 400 days (monthly backups). Deleted data may stay in a backup until that backup expires, and is not used in the meantime.
Analytics data is kept for the period set in each analytics tool.

9. Security

We protect personal data with measures such as encryption in transit (TLS), encrypted backups, access controls that limit who can reach production systems, and logging. No system is perfectly secure, but we work to keep your data safe and fix problems quickly.

10. Data breaches

If a breach affects your personal data, we will tell you and the relevant authorities as the law requires, including the Data Protection Board of India under the DPDP Act and, where GDPR applies, the supervisory authority. For call data we process for an organisation, we will tell that organisation without undue delay so it can meet its own obligations.

11. Your rights

Under the DPDP Act (India) you can:

get a summary of the personal data we hold about you and how we use it;
have it corrected, completed or updated;
have it erased, unless we must keep it by law;
withdraw consent you gave;
have a grievance heard and resolved; and
nominate someone to exercise your rights if you die or become unable to.

Under the GDPR (EU and UK) you can:

access your personal data;
have it rectified;
have it erased;
restrict how we use it;
receive it in a portable format (data portability);
object to how we use it, including for direct marketing;
withdraw consent at any time; and
complain to your local data protection supervisory authority.

How to use your rights. Email contact@comcent.io from the address on your account, or tell us how we can confirm who you are. We will reply within 30 days. For call data, we will pass your request to the organisation that controls it and help it respond.

12. Grievance Officer

If you have a question or complaint about your personal data, contact:

Grievance Officer, Comcent Technologies Private Limited
Aasare, 2-187/B16, Fourth Floor, (301) Prathvi Palace
Behind Maari Gudi, Brahmavara, Karnataka, India - 576213
Email: contact@comcent.io

We will acknowledge your complaint and aim to resolve it within 30 days. If you are in India and not satisfied with our answer, you may complain to the Data Protection Board of India.

13. Children

Comcent Cloud is a business service and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact us and we will delete it.

14. Organisations’ own obligations

Organisations that use Comcent Cloud are responsible for their Callers’ and Members’ personal data: telling them how it is used (for example, that calls are recorded), having a lawful basis, and answering their requests. Our Terms of Use set out these responsibilities.

15. Changes to this policy

We may update this policy. When we make a change that matters, we will tell you by email or in the app before it takes effect. The effective date at the top shows which version applies.