Privacy Policy

dviilo runs phone calls and conversations for you. That means we handle recordings of conversations — yours, and those of the people your assistant speaks with. This document says plainly what we do with them.

1. Who we are

Shivankit TechSolutions (OPC) Private Limited (“Shivankit TechSolutions”, “we”) operates dviilo, from India.

Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for your account information. When your assistant handles calls or messages with other people, your organisation is the Data Fiduciary for that conversation and we process it on your behalf — except for improving our models (section 4), which we do for ourselves. The same holds for the people in the lists your organisation gives the outreach desk: your organisation is the Data Fiduciary for them, and we process their details on its behalf, with the same exception.

Questions, requests and complaints: hello@shivankit.com.

2. What we collect

From your account

• Your email address or phone number, and a name if you give one. Sign-in is handled by our authentication provider; we never store your password in readable form.
• The phone numbers you register, your assistants' settings and instructions, and any voice you create.
• Payment details, handled by our payment processor.
• Usage and diagnostic information: call counts and durations, errors, IP address, and the type of browser or device.

From calls and conversations your assistant handles

• The phone numbers of both parties, and when the call happened.
• Recordings of calls.
• Transcripts, and the summaries, topics and other information derived from them.
• What your assistant did during the conversation: which tools or connected services it used, what it asked them, and what they returned.
• The content of messages sent or received through the platform.
• If you report a reply from your assistant: the reason you chose, any note you add, and a copy of the reply you reported.
• If you rate a reply from your assistant: your thumbs up or down and, for a thumbs down, the reason you chose and any note you add.
• Contacts you add or import.
• If you turn on the daily brief: your settings for it, and each brief your assistant puts together for you.

From DevControl: your computers and cloud workspaces

If you use DevControl to have a coding assistant work for you:

• The computers you connect: their names, whether they are online, and the projects on them that you work with.
• The tasks you give, by voice or in writing, and what the coding assistant does with them: its messages and questions, the commands it runs and their results, and the changes it makes to your code.
• In a cloud workspace: the files and code in it, which we keep on our servers for you, with a nightly backup.
• If you link a GitHub account: the link, stored encrypted, the repositories you link, and the changes waiting for your approval before they are sent to GitHub.
• The notifications we send you about your tasks.

From the Android app

• Microphone audio — while you are in a call or talking to the assistant, with a notification showing for the whole time. The app does not listen for a wake word and does not record in the background.
• Precise location — when you allow it, and only when your assistant needs it to answer something, such as finding places near you.
• Your phone's contacts — when you allow it, so your assistant knows who you mean when you name someone.
• Photos and files you choose to share with your assistant.
• A push token, so we can reach the app when your assistant needs you. There is no advertising or analytics SDK in the app.
• Crash and error information, sent to our own servers.

If you use the on-device model, what you ask it and what it answers stay on your phone.

From the outreach desk

If your organisation uses the outreach desk:

• The lists your organisation gives it, and the businesses and contacts in them.
• What it reads about those businesses on their public web pages, with the page each fact came from.
• Who your organisation's emails are sent from: the name, title, mailbox and postal address it enters.
• The emails it drafts, who approved or rejected each one, and which your organisation records as sent.
• Your organisation's do-not-contact list, including people who use the stop link in an email.

3. Why we use it

• To run the service — connect calls, transcribe them, let your assistant answer and act, and bill correctly.
• To keep it working — find and fix what broke.
• To improve our models — see section 4.
• To prevent abuse — spam, fraud, harassment, and misuse of the telephone network.
• To look into a reply you report — people on our staff read your report, any note you added and the copy of the reply.
• To look into a reply you rate — people on our staff may read your rating, any reason and note you gave, and the reply it is about with the message before it.
• To run DevControl — start, follow and stop the coding tasks you ask for, on your computers or in a cloud workspace, and tell you how they went.
• To send you a daily brief, if you turn it on — your assistant puts it together from your reminders and call-backs and sends it to you as a notification and a message in your chat.
• To meet legal obligations — tax records, and lawful requests from authorities.

We do not sell your data, and we do not share it with data brokers.

4. Improving our models

We build our own AI models: the language models that decide what your assistant says and does, and the speech recognition that turns what people say into text. They learn from real conversations.

It is on by default. By using dviilo, you allow us to use your organisation's calls and conversations with its assistants — past and future — to train, evaluate and improve our models. That covers:

• For speech recognition: the audio of calls, and the transcript matched to it. Speech recognition learns from the exact words matched to the sound, so this text is kept as it was transcribed.
• For our language models:the text of conversations, including which tools the assistant used, what it asked them — for example, what you asked it to search for — and what they returned. We may keep any of this that helps our models learn. Before storing what tools were asked and what they returned, we replace some of it with a description of its shape, such as “a list of six entries”; what we keep can still include personal details, yours and other people's.
• Ratings:the thumbs up or down you give your assistant's replies, with any reason and note, together with the conversation they are about.

People on our staff. To check what speech recognition heard and to correct it, people on our staff may listen to recordings of whole calls, and read and correct their transcripts, where the conversation is used to improve our models.

The setting belongs to the organisation. It applies to everyone in that organisation.

Conversations with other people. When someone calls a number your organisation operates, or your assistant calls or messages someone, your organisation is the Data Fiduciary for that conversation. Your organisation is responsible for telling those people that the conversation is recorded and may be used to improve the service, and for any consent its use of dviilo requires. If it cannot, it should turn model improvement off.

Turning it off. An owner of the organisation can turn model improvement off at any time by writing to hello@shivankit.com. Conversations after it is turned off are not used. A model that has already learned from earlier conversations cannot unlearn them, and the training data already built from them is kept.

What we do not do with it.We do not use it to build a synthetic copy of anyone's voice, we do not publish it, and we do not sell it.

The outreach desk.The desk's own records — your organisation's lists, its research and its drafts — are not used to improve our models. A conversation with your assistant may be, like any other, including one in which the assistant reads from the desk: what it says there, and what you say, is part of the conversation.

DevControl and the daily brief.The coding assistant's own work — its messages, the commands it runs and your code — is not used to improve our models, and neither is the text of your daily brief. Your conversation with your own assistant about them may be, like any other, including what DevControl reports back to it.

5. Recognising people by their voice

We do not recognise or identify people by their voice.

6. Telling the people your assistant speaks with

Calls are recorded. Your organisation is responsible for telling the people its assistant speaks with that the call is recorded and handled by an AI assistant. If your use falls under sector rules — lending, insurance, healthcare, debt collection — any further consent those rules need is your organisation's to obtain.

7. Who else processes the data

We use service providers for the following. Each gets what its job needs:

• Hosting, databases, file storage and our call engine.
• Cloud computers that run the coding tasks you start in a cloud workspace.
• Speech recognition and voice synthesis.
• Language model processing.
• Real-time audio for calls in the browser and the app.
• Web search, maps and place lookups, when your assistant needs them.
• Push notifications to the app.
• Email and SMS delivery, including sign-in codes.
• Payments.
• Error and performance monitoring.

When you connect another service to your assistant — a shopping, travel or home-automation account, for example — what your assistant sends it and receives from it goes through that service, under its own terms.

Some of these providers operate outside India, so your data may be processed abroad. Some of them may also use what they receive to improve their own services, under their own terms.

Coding tasks in a cloud workspace.The AI model provider we use for them today operates outside India and may use what it receives to improve its own models. Don't put passwords, keys or other people's personal data in a coding task.

8. How long we keep it

• Account information — for as long as the account exists.
• Recordings, transcripts and conversation records — for as long as the account exists, unless you ask us to delete them sooner.
• Data used to improve our models — for as long as we use it to improve them. Deleting an account or turning model improvement off does not remove what has already been used.
• Reports about a reply — until the conversation or call they point at is deleted, or your account is.
• Ratings of a reply — until the conversation or call they point at is deleted, or your account is.
• DevControl tasks — the record of each task, for 7 days; your conversations with the coding assistant, and the computers you connected, until you delete them or your account.
• Cloud workspaces, their files and their nightly backups — until you delete the workspace. Deleting your account does not yet delete them by itself: write to us and we will.
• Your GitHub link — until you unlink it or delete your account; when you delete your account we also withdraw it at GitHub.
• Daily briefs — for as long as the account exists.
• Diagnostic logs — for as long as we need them to run and fix the service.
• Billing records — for as long as Indian tax law requires. These contain no call content.
• A record of each deletion — when it happened, the organisation and assistants it concerned, and how much was deleted. It holds no recordings, transcripts or messages. We keep it for as long as we need it to show the deletion was done.
• Records that belong to your organisation — they stay with it when you delete your account, and they can still name you: for example, who approved an email, or the name and address its outreach emails are sent from. To have them changed or removed, ask an owner of the organisation.
• A record of your organisation's consent decisions — which version of these documents it accepted or declined, when, and who decided. It is kept after the organisation is erased: it shows the permission under which data already used to improve our models was collected. When the person who decided deletes their account, their part of it is removed.

9. Your rights

You can:

• Ask what personal data we hold about you, and get a copy.
• Ask us to correct anything inaccurate or incomplete.
• Delete your account and its data — see how.
• Turn model improvement off, as described in section 4.
• Nominate someone to act for you if you die or cannot act yourself.
• Complain to us, and then to the Data Protection Board of India.

Write to hello@shivankit.com. A person handles every request.

If an organisation contacted you using the outreach desk and you want it to stop, use the stop link in the email if it has one, or write to hello@shivankit.com. We may add you to that organisation's do-not-contact list or delete your details from its desk.

10. How we protect it

• Connections to our public services are encrypted with TLS.
• Access to our database is controlled by row-level security.
• On your phone, your session is stored in Android's encrypted storage.

If a breach affects your personal data, we will tell you and the authorities as the law in force requires.

11. Children

dviilo is not for anyone under 18. If you believe a child has an account, write to hello@shivankit.com.

12. Changes to this policy

This policy can change. The version in force is the one at this address, with its effective date at the top, and it applies from that date. Every earlier version stays readable at its own dated link, listed at the foot of this page.

13. Contact

Shivankit TechSolutions (OPC) Private Limited
hello@shivankit.com
Grievance Officer: the dviiloSupport Team, at the same address, with “Grievance” in the subject.