Privacy Policy

Welcome to Aromatic Intelligence. Aromatic Intelligence Pvt Ltd (“we,” “our,” or “us”) is an AI voice telephony and workflow automation company physically headquartered and operating in Bengaluru, Karnataka, India.

This Privacy Policy outlines our procedures and technical safeguards governing personal data collection and processing pursuant to the Digital Personal Data Protection Act, 2023 (DPDP Act 2023), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018).

This policy applies to all visitors to our website, authorized subscribers of our platform, and end-users dialing telephone numbers connected to our conversational voice AI infrastructure.

When you utilize our platform or interact with our Voice AI agents, we collect the following categories of data strictly necessary for delivering our services:

• Account & Administrative Data: Subscriber name, business email address, organization name, billing details, and API configuration parameters.
• Conversational Audio & Transcripts: Real-time voice audio streams captured over SIP/WebRTC, streaming Speech-to-Text (STT) transcriptions, call durations, audio recording URLs, and caller CLI/ANI numbers.
• Agent Knowledge Base Documents: Informational PDFs, FAQ documents, clinical treatment protocols, and operating schedules uploaded by the account holder to ground the AI in verified business truth (RAG).
• Guided Intake & Appointment Context: Caller names, telephone numbers, chief medical complaints or service inquiries, requested appointment slots, and attending doctor/staff selections gathered dynamically during guided triage conversations.
• Technical & Consent Verification Logs: IP addresses, browser user-agents, network timestamps, and cryptographic audit records establishing legally valid consent and acceptance of platform terms pursuant to the DPDP Act 2023.

Pursuant to Section 4 and Section 7 of the DPDP Act 2023, personal data is processed solely for specified, lawful, and necessary operational purposes:

• Voice AI Conversation Turn-Taking: Processing speech audio in real-time (sub-900ms direct voice latency) to extract intent, generate grounded responses, and synthesize neural audio.
• Guided Booking & Calendar Locking: Automating 4-stage administrative triage and reserving confirmed slots in connected calendars or clinic management systems.
• Coexistence for WhatsApp Business: Sending appointment confirmations, maps, or intake summaries to the caller’s WhatsApp number via the official WhatsApp Business API alongside human staff access.
• Service Quality & Model Optimization: Analyzing interaction transcripts and anonymized acoustic patterns to lower turn-taking latency, enhance Indian accent recognition, and improve conversational accuracy.
• Security, Audit & Legal Compliance: Safeguarding platform infrastructure, monitoring for fraudulent traffic, enforcing our Acceptable Use Policy, and maintaining statutory consent records.

To operate our real-time voice AI infrastructure, strictly necessary data segments are securely processed by specialized infrastructure partners under enterprise zero-data-retention agreements:

• LLM Reasoning & Dialogue: Enterprise language model inference nodes are utilized for contextual conversational logic and call summarization under zero-training API agreements.
• Speech Infrastructure: Audio is routed through dedicated streaming Speech-to-Text (STT) transcription clusters and neural voice synthesis engines.
• Carrier Telephony & Virtual Lines: Licensed telecommunications carrier partners provide SIP trunking and phone number provisioning. Know Your Customer (KYC) regulatory compliance is managed in accordance with Department of Telecommunications (DoT) directives.
• WhatsApp Business Platform: WhatsApp Business Cloud API infrastructure routes post-call WhatsApp confirmations with end-to-end transport encryption.
• Indian Cloud Data Residency: Core databases, vector embeddings, and workflow automations are localized in India across Tier-IV Indian Cloud Data Centers (Mumbai/Hyderabad) and localized database nodes.
• Payment Processing: RBI-authorized payment gateway partners process credit transactions and subscription renewals under PCI-DSS Level 1 compliance. We do not store raw card credentials.

All data is protected by rigorous technical safeguards in compliance with Section 8(5) of the DPDP Act 2023:

• Encryption in Transit: TLS 1.3 / TLS 1.2 cryptographic protocols on all HTTPS and WebSocket endpoints.
• Encryption at Rest: AES-256 bit encryption applied across all databases, audio storage buckets, and vector tables.
• Row Level Security (RLS): Multi-tenant isolation ensuring that no client account can ever view or access another client’s call recordings or patient data.

Under Chapter III (Sections 11–14) of the Digital Personal Data Protection Act, 2023, you (as a Data Principal) possess the following statutory rights:

• Right to Access Information (Section 11): You may request a summary of personal data processed, description of processing activities, and identities of all entities with whom data has been shared.
• Right to Correction & Erasure (Section 12): You may request correction of inaccurate data, completion of incomplete data, updating of records, and erasure of personal data when no longer needed.
• Right of Grievance Redressal (Section 13): You have the right to a readily accessible grievance redressal mechanism regarding any data protection concern.
• Right to Nominate (Section 14): You have the right to nominate any individual to exercise your rights in the event of death or incapacity.
• Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time as easily as giving consent.

To exercise any of these rights, please contact our Grievance Officer at helparomaticintelligence@gmail.com.

Aromatic Intelligence is a B2B telephony and workflow automation platform. Our Services are intended exclusively for commercial entities and individuals aged 18 years or older.

In accordance with Section 9 of the DPDP Act 2023, we do not knowingly process personal data of children without verifiable consent of the parent or lawful guardian. We do not undertake tracking, behavioral monitoring, or targeted advertising directed at children, nor do we process children's personal data that is likely to cause any detrimental effect on their well-being.

While our core database clusters, vector repositories, and orchestration engines are hosted in India (Mumbai/Hyderabad cloud data centers), high-performance real-time processing components (such as low-latency LLM inference) may execute across secure international edge nodes.

All cross-border transfers strictly comply with Section 16 of the DPDP Act 2023 and notifications issued by the Central Government of India, transferring data exclusively to jurisdictions not restricted or blacklisted by the Government under zero-retention enterprise agreements.

In compliance with Section 8(7) of the DPDP Act 2023, we erase personal data or remove identifiers as soon as:

• The purpose for which the personal data was collected is no longer being served; and
• Retention is no longer necessary for legal, regulatory, or compliance purposes under Indian law.

Call recordings and transcripts are retained for the duration of the active subscription period or until explicitly deleted by the account administrator. Telecom Call Detail Records (CDRs) are retained strictly in accordance with Department of Telecommunications (DoT) licensing directives.

Aromatic Intelligence strictly adheres to regulations issued by the Telecom Regulatory Authority of India (TRAI), including the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018).

Our platform is engineered for inbound telephone call answering and requested customer follow-ups. We strictly prohibit the use of our Voice AI agents for unsolicited commercial bulk telemarketing calls or calls to numbers registered on the National Do Not Call (NDNC / DND) Registry without explicit scrub compliance and verified customer opt-in.

In fulfillment of Section 8(9) and Section 13 of the DPDP Act 2023, the details of our designated Grievance Officer are set forth below:

Statutory Appeal Right (Section 13(3)): If you are not satisfied with the resolution provided by our Grievance Officer, or if no response is received within the statutory period, you hold the statutory right to register a formal complaint with the Data Protection Board of India (DPBI) in accordance with the procedures prescribed under the DPDP Act 2023.