Dodkos Privacy Policy

Company details are being completed.

Policy version: 2026-10-22
Applies to: dodkos.com and every Dodkos workspace, tool and app
Read with: the Dodkos Terms of Service

1. About this policy

1.1. This policy explains what personal data Dodkos (the company named in section 12) handles, why, for how long, who helps us, and what rights people have. It is written for India's Digital Personal Data Protection Act, 2023 and its Rules ("DPDP Act"), and the Information Technology Act, 2000.

1.2. Words used as the DPDP Act uses them:

• Data Principal — the person the data is about (a lead, a caller, a user).
• Data Fiduciary — whoever decides why and how personal data is processed.
• Data Processor — whoever processes personal data for a Data Fiduciary.

2. Who is responsible for which data

2.1. Your leads and contacts (Customer Data). The business using Dodkos (the "customer") is the Data Fiduciary for the personal data of its leads, callers and contacts. Dodkos is the customer's Data Processor: we process this data under the contract in the Terms, for the purposes in sections 4.1 to 4.5.

2.2. Training and improving Dodkos's AI. At signup, the customer authorises Dodkos in writing to use all Customer Data and usage data to train, test, evaluate and improve Dodkos's AI systems (section 4.6). For this processing Dodkos decides the means, so Dodkos takes on the DPDP Act duties of a Data Fiduciary for it: purpose limitation, safeguards, and honouring erasure requests for future training.

2.3. Account users and website visitors. Dodkos is the Data Fiduciary for the personal data of the people who sign up, sign in and use a workspace, and of visitors to dodkos.com.

3. What data we handle

3.1. Signup and account data: name, work email, phone, company, role, city, business type, team size, lead sources and the tools asked for.

3.2. Consent record: the policy version accepted, the clauses it covers, the date and time, and the IP address and browser (user agent) at signup, and every later acceptance.

3.3. Customer Data in a workspace: leads (names, phone numbers, emails, budgets, preferences, notes), site visits, bookings and payment plans, team activity, files, and the knowledge base the customer writes.

3.4. Call data:

• Call detail records (CDR): numbers, date, time, duration, direction, outcome, cost.
• Recordings of calls made or answered through Dodkos: calls handled by Dodkos's AI caller ("AI calls"), and calls the customer's team places or receives on the workspace's phone line ("sales-desk calls"). The audio of a sales-desk call is kept by the telephony provider that carried it; the workspace keeps a link to it.
• Transcripts, call outcomes and AI summaries of those calls.

3.5. Chat data: WhatsApp and other messages sent and received through Dodkos, with media and delivery status.

3.6. Usage and technical data: how the tools are used, sign-in events, IP addresses, device and browser, error and security logs.

3.7. Billing data: invoices, GST details and payment status. Card details are handled by a payment service provider; Dodkos does not store card numbers.

3.8. Cookies: dodkos.com and workspaces use only cookies needed for sign-in and security. They use no analytics or advertising cookies. If that changes, we will list the new cookies here, and they will stay off until you turn them on.

4. Why Dodkos accesses and uses data

The customer authorises all of these at signup (Terms, section 4.2).

4.1. Run the service — store, route, call, message, score and display data in the customer's workspace.

4.2. Monitoring and safety review — automated monitoring of sign-ins, usage, call and message patterns for fraud, spam, attacks and breaches of the Terms. Authorised staff review data only when an automated check flags something, or when a complaint or report arrives.

4.3. Support — when the customer asks for help, or when we fix a fault affecting the workspace.

4.4. Backups and restore — daily encrypted copies, used only to restore lost or damaged data (section 8).

4.5. Legal requests and complaints — answering lawful requests from courts, regulators, telecom authorities and law enforcement, and investigating complaints about calls or messages. We disclose data only when the law or a valid order requires it, and tell the customer about a request that concerns its workspace where the law allows. Call records exist for this reason too (section 8).

4.6. Training and improving Dodkos's AI — Dodkos uses Customer Data and usage data, including call recordings, transcripts, call outcomes, chats and WhatsApp messages, and CRM activity, to train, test, evaluate and improve its AI systems and products, including models Dodkos builds in-house. These AI systems are shared by every Dodkos customer. How this is done:

• training happens on infrastructure under Dodkos's control, and the data stays on the Dodkos platform;
• where a task does not need them, names, phone numbers and email addresses are removed first; recordings used as audio still carry a voice, so recordings used for training remain personal data, with every safeguard in this section;
• one customer's business facts, prices, leads and recordings are never surfaced in another customer's calls, chats, prompts, knowledge or playbook. Each AI system is tested for this before it handles any customer's calls;
• training data is kept separate from workspaces, with access limited to named staff;
• data from a closed account, or of a person who erased their data or withdrew consent (section 10), is not used in new training runs. A system already trained is not retrained to forget it.

4.7. Account and billing — for account users: sign-in, invoices, service emails and notices of policy changes.

5. What we never do

5.1. We do not sell personal data.

5.2. We do not share one customer's data with another customer, and one customer's facts, prices, leads and recordings never appear in another customer's calls (section 4.6).

5.3. We do not use a customer's leads to market anything on Dodkos's own account.

5.4. We do not let any service provider train its own models on Customer Data.

5.5. We do not use data for purposes outside section 4 without new consent.

6. Service providers (categories)

Data stays on the Dodkos platform. The only others who process it are service providers needed to run the service, under written contracts that limit them to providing their service to us, require them to protect the data, and do not allow them to train their own models on it:

We do not name individual providers in this policy. We give the names of the providers that process a person's data to that person, or to the account owner, on written request.

Some of these providers process data outside India (section 7.1). We will email account owners at least 14 days before we start using a new category of service provider; an owner who objects may close the account before the change takes effect.

We may also disclose data when the law requires it (section 4.5), or to a successor if Dodkos's business is transferred, under this same policy.

7. Where data is stored and how it is protected

7.1. Location. Workspaces currently run in data centres in Singapore, and their encrypted backups are kept in object storage. Our service providers (section 6) may also process data outside India. The DPDP Act allows transfers outside India except to countries the Government restricts. If a country we use is restricted, or Indian law requires data to stay in India (for example if Dodkos is notified as a Significant Data Fiduciary), we will move the data or change how it is stored, and tell customers.

7.2. Separation. Each customer has its own workspace container, storage and database.

7.3. Security measures. We use reasonable security measures appropriate to the risk, including encryption in transit (TLS), access controls and logging. Daily backups are encrypted before they leave the workspace, with keys kept separately from the backups. No system is fully secure; section 11 says what we do if a breach happens.

7.4. Staff access. Only authorised Dodkos staff can open a workspace, only for a purpose in section 4, and with the least access needed. Dodkos's admin console has no screen that shows a workspace's leads, calls or chats. Staff access is logged internally:

• every action staff take on a workspace from the admin console (setting it up, changing its settings or plan, checking it, AI calling, sending its setup link, removing it) is recorded automatically: who, when, which workspace, what was done and the outcome;
• before staff open a workspace's data any other way (for a support case, a restore, a safety review or a legal request), they record who, when, which workspace, the purpose and the reason in the same log.

The log is kept for 1 year. It is Dodkos's own audit record and is not shown to customers.

7.5. Staff are bound by confidentiality, and lose access when their role ends.

7.6. Audits. Once a year, on written request, we share our security documents with a customer under confidentiality. This is how any audit right a customer has is met, unless a signed order says otherwise.

8. Retention

Data may be kept longer only where a law, a court order or an open legal complaint requires it, and only for that.

9. Account closure and deletion

9.1. Day 0 — the account is closed. Calling, messaging and sign-in stop.

9.2. Days 1–30 — the account owner can export its data, or reopen the account.

9.3. By day 30 — the workspace, its database and its storage are removed. One final encrypted copy is taken when it is removed, so a closed account can still be restored for a short time.

9.4. By day 60 — that final copy, and the workspace's daily backups, have expired and are deleted.

9.5. After that Dodkos keeps only the consent record, invoices, the staff-access log and the security logs, as in section 8, and data already in training sets and trained AI systems (section 4.6).

10. Rights of Data Principals

10.1. Under the DPDP Act, a person whose data is in Dodkos has the right to:

1. know what data is processed and how, and with whom it is shared;
2. correct, complete or update it;
3. erase it, where it is no longer needed for its purpose or the law;
4. withdraw consent as easily as it was given;
5. nominate someone to exercise these rights after death or incapacity;
6. grievance redressal, and then complain to the Data Protection Board of India.

10.2. Leads and contacts of a customer should first contact that business, which is their Data Fiduciary. If they write to Dodkos, we pass the request to the customer within 7 days and help the customer answer it. The customer can, from its workspace, erase a person's AI-call recordings, transcripts and summaries at once; the number then stays on the do-not-call list so it is not called again. For the use in section 4.6, Dodkos is responsible and answers directly. An erasure or withdrawal received by Dodkos, or made with the workspace's "Delete this person's data" action, excludes that person's data from future training.

10.3. Consent Managers. We honour withdrawals of consent received through a Consent Manager registered with the Data Protection Board of India, or through our own opt-out and erasure tools (section 10.2).

10.4. Account users and visitors can write to the Grievance Officer (section 12). We answer within 30 days.

10.5. Withdrawing consent and what it means. A person may withdraw consent at any time; it does not affect processing done before. For a lead, withdrawal means the customer must stop calling and messaging them, and Dodkos stops using their data in new training (section 4.6). For a customer, the permissions in the Terms (section 4.2), including training, are part of the service: withdrawing them means closing the account (section 9). From the day the account closes, its data is not used in new training.

11. Personal data breaches

11.1. If Dodkos becomes aware of a breach affecting Customer Data, we tell the affected customer without undue delay, with a target of 24 hours and in any case within 48 hours, with what happened, the data involved, and what we are doing. This lets the customer, as Data Fiduciary, inform affected people and the Data Protection Board of India as the DPDP Act requires.

11.2. For data where Dodkos is the Data Fiduciary (sections 2.2 and 2.3), Dodkos informs affected people and the Data Protection Board of India itself, within the times the DPDP Rules set.

11.3. Dodkos reports cyber security incidents to CERT-In (the Indian Computer Emergency Response Team) within the time Indian law requires.

12. Grievance Officer and contact

Company details are being completed.

We acknowledge a complaint about data or privacy within 48 hours and resolve it within 30 days. A complaint about content, calls or messages sent through Dodkos is acknowledged within 24 hours and resolved within 15 days (Terms, section 14.3). If you are not satisfied, you may complain to the Data Protection Board of India.

Company details are being completed.

13. Children

Dodkos is a business service, and every person who uses it must be 18 or older. We do not knowingly create accounts for children. Customers must not use Dodkos to call, message, target or build a profile of anyone they know or suspect is under 18, or otherwise process a child's data, without the verifiable parental consent the DPDP Act requires.

14. Changes to this policy

When we change this policy we publish a new dated version and list it below. We email account owners at least 15 days before a material change takes effect, and when it takes effect we ask for acceptance again at the next sign-in (Terms, section 3.4).

Changelog