Privacy Policy

01The short version

We cannot hear your team. Voice is end-to-end encrypted and is never recorded or stored by anybody, including us.

We hold the minimum needed to run the service: who is in which workspace, which devices belong to them, and your billing records.

02Who is responsible

TappyCall, a sole proprietorship of Navidanjum Shaikh operates TappyCall.

For your administrator's email address and phone number, and for your billing records, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 — we decide why we hold them, and this policy explains it.

For the information about your workers — the name each person is known by, their device, and when they were last active — your employer is the Data Fiduciary and we are their Data Processor. They choose who joins and what each person is called; we only process it to run the service for them. If you are a worker and want to know what your employer holds about you, ask your employer first — we cannot identify you to them, and we hold no email address or phone number for you.

03What we collect

From a workspace administrator: an email address, and a phone number if you give one. This is the only place in the product where an email address is required.

From a worker: the display name they type when joining, and the model of their device so two people with the same name can be told apart. No email, no password, no phone number.

From every device: a device record and when it was last seen, so a lost phone can be revoked.

Payment details are handled by our payment provider. We do not see or store card numbers.

04Voice, specifically

Voice. Your team’s audio passes through our servers only as it travels between handsets — end-to-end encrypted, held in memory for no longer than the moment it takes to relay, and never written to disk anywhere in the system. There is no recording feature, and we cannot listen to it.

05What we never collect

Location. We do not track where a device is.

Contacts, photos, messages, or anything else on the phone.

06Why we hold it

To deliver the service you are paying for, to bill you correctly, and to let an administrator manage who has access.

We also record that an emergency broadcast happened and who raised it. An alert that overrides everyone's mute has to be accountable.

07Who we share it with

Our hosting provider and our payment provider, only as far as is needed to run the service and take payment.

We do not sell personal data and we do not use it for advertising.

08How long we keep it

While your workspace is active, and for 6 months after it is cancelled or deleted. After that the workspace's data is removed.

Invoices are kept for as long as tax law requires, which is longer than the period above.

09Your rights

You can ask us for a summary of the personal data we hold about you and how we process it; ask us to correct it if it is wrong or incomplete; ask us to delete it; and nominate somebody to exercise these rights if you die or become unable to.

Write to us using the contact page. We will acknowledge you and answer as quickly as we can, and in any event within the time the law allows.

Some information we cannot delete on request, because the law requires us to keep it. Invoices are the main example: a tax invoice must show who it was issued to, and we are required to retain it. We will tell you if this applies to something you have asked us to delete.

A workspace administrator can remove a worker at any time, which revokes their device immediately.

10Children

TappyCall is sold to organisations for use by their workers and is not directed at children. The law requires verifiable consent from a parent or guardian before a child's data may be processed, and we have no way to obtain it — so our terms require that workspace administrators do not add anyone under 18.

11If something goes wrong

If personal data we hold is exposed, we will tell the Data Protection Board of India and the people affected, in plain language: what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

Voice is not affected by this. It is end-to-end encrypted and never written to disk anywhere in the system, so there is no store of recordings that could be exposed.

12If you are not happy

Our grievance contact is Navidanjum Shaikh, who can be reached at the address on the contact page. Please write there first — most things are quicker to fix directly.

If you are not satisfied with our answer, you have the right to complain to the Data Protection Board of India.