DPDP notice
DIRA is a voice agent that answers and makes phone calls on behalf of a business. Those calls involve personal data belonging to the people who ring in. This notice sets out how that data is handled.
For calls handled by DIRA, the customer business is the Data Fiduciary and DIRA operates as its Data Processor. DIRA processes call data only on that business's documented instructions.
Consent on every call
Every call DIRA handles opens with a recorded disclosure that identifies the agent as an assistant, names the business, and states that the call is recorded. The caller is asked to continue before anything else happens. If a caller declines, the call is transferred to a human or ended, and no recording is retained.
Append-only records
The consent log is append-only. Entries are never edited or deleted in place — a correction is recorded as a new entry that supersedes the old one, leaving the original visible. This means the record of what a caller agreed to, and when, can always be reconstructed.
A human presses send
DIRA drafts follow-up messages; it never sends them. Every outbound WhatsApp, SMS or email is reviewed and sent by a person at the customer business, from their own number or address. DIRA does not message a customer directly.
Outbound calling
Before dialling, DIRA checks the number against the national Do Not Call registry and the consent record held for that person. Numbers without a lawful basis for contact are not dialled.
What is stored
- Call recordings and transcripts — for the retention period the customer business sets.
- Call summaries and recall lines — the short notes DIRA uses to open the next call.
- Contact details — name, phone number, and anything the caller volunteers.
- Consent entries — what was disclosed, what was agreed, and when.
Data is stored on Google Cloud infrastructure. Where the customer requires it, storage is pinned to an Indian region.
Rights of the Data Principal
Anyone whose data DIRA processes may ask for access to it, correction of it, or its erasure, and may withdraw consent at any time. Requests should go to the business that took the call, as Data Fiduciary. If you are not sure who that is, or you would rather come to us, write to hello@heydira.com and we will route it.
Breach notification
In the event of a personal data breach, DIRA notifies affected customer businesses without undue delay so they can meet their own reporting obligations to the Data Protection Board of India and to affected individuals.
Grievance officer
Contact hello@heydira.com. Grievances are acknowledged within 72 hours and resolved within 30 days.
Note for the DIRA team: the DPDP Act requires a named grievance officer with contact details, and the registered entity name and address. Add those before launch, confirm the retention periods and storage region against the deployed system, and have this reviewed by counsel. This draft reflects the product commitments described on the site but is not legal advice.