DPDP Compliance & DPA

Last updated: August 2026

1. Our role: Data Processor, not Data Fiduciary

Under the DPDP Act, the business that owns the phone number — the clinic, law firm, salon, or other business a caller reaches — is the Data Fiduciary for its own callers' and clients' personal data: it decides why that data is collected and how it's used. HeadStart AI acts as the Data Processor, handling that data strictly on the business's behalf and instructions, to provide the calling, booking, and notification service.

2. What that means in practice

We don't repurpose a business's caller data for our own separate purposes, we don't sell it, and we don't use it to train third-party AI models. Every safeguard on this page exists to keep that boundary real, not just stated.

3. Technical and organizational measures

• PII (name, phone number, address) is scrubbed from the call transcript by our own PII-scrubbing layer before any AI model — including the third-party model that generates the call summary — ever sees it.
• All data is stored exclusively on AWS Mumbai; nothing leaves India.
• AES-256 encryption at rest, TLS 1.3 in transit, on every request.
• Call recordings are auto-deleted after 90 days, with no manual step required.
• Verbal consent is logged with a timestamp on every call.

See the full privacy architecture for the data-flow diagram behind these points.

4. Sub-processors

Two categories of sub-processor are involved in delivering the service, and both are scoped as narrowly as the product allows:

• Cloud hosting (AWS, Mumbai region) — stores encrypted call data and dashboard records, physically located in India.
• AI processing — the conversational AI model that handles the live call only ever receives the PII-scrubbed transcript, never the caller's name, phone number, or address.
• WhatsApp (Meta) — used only to deliver the booking confirmations and reminders a business configures; receives the phone number and message content needed for that delivery, nothing more.

5. Breach notification

If we confirm a data breach affecting a business's caller or client data, we will notify that business without undue delay so they can meet their own notification obligations as the Data Fiduciary.

6. Your rights as a data principal

If you're a caller (a "data principal" under the Act) and want to access, correct, or request erasure of your data, contact the business you called directly, or reach us at the details below and we'll route your request to the right business.

7. Contact

Compliance questions or DPA requests: info@headstartai.in or WhatsApp.