Privacy Policy

• Website enquiries and demo requests: the name, phone number, email address, and business name you enter in a form on our website, the consent choices you make, and the recording, transcript, and AI analysis of any demo call you ask for. Section 2 explains how we use them.
• Account and billing information: your name, business name, email address, phone number, workspace membership, subscription, wallet, invoice, and payment-related records.
• Usage and technical information: dashboard activity, feature usage, timestamps, IP address, device and browser information, cookies, error reports, and security logs.
• Voice data: call participants, phone numbers, recordings, transcripts, call events, outcomes, duration, and related analytics generated when you use an AI voice agent.
• Customer and workflow data: contacts, leads, campaign settings, CRM records, order details, appointment information, instructions, prompts, and content that you or your connected systems provide.
• Meta and WhatsApp account data: Meta Business Portfolio and WhatsApp Business Account identifiers, business phone-number identifiers, display profiles, account status, quality information, messaging limits, message templates, and integration settings.
• WhatsApp communication data: customer phone numbers and profile names, messages, media and file metadata, rendered template values, conversation history, message identifiers, webhook payloads, timestamps, and sent, delivered, read, or failed status information.
• Integration credentials: authorisation codes are exchanged without being retained, while access tokens and other credentials needed to maintain a connection are stored in encrypted form.

This section is the privacy notice linked from every form on our website. It applies when you ask for a demo call, try the in-browser voice demo, ask us to get in touch, or book a meeting. Our website forms are only for people aged 18 or older.

• What we collect: the name, phone number, email address, and business name you enter; a record of your consent (what you agreed to, when, and the IP address and browser it came from); and, for a demo call, its recording, transcript, and an AI-generated note of your interest. The in-browser demo uses your microphone; that conversation is processed by AI and may be recorded and transcribed.
• Why we use it: to place the demo call you asked for and follow up about it; to contact you about your enquiry or arrange the meeting you booked; to prevent misuse of free demo calls; and, only if you tick the separate optional box, to send you product updates and offers. We use each detail only for the purpose you agreed to.
• Who we share it with: our telephony and AI voice providers to run the call, our cloud hosting and database providers to store it, and Cal.com when you pick a meeting time. They act only on our instructions. We do not sell your personal data.
• How long we keep it: up to twelve (12) months after your last interaction with us, unless you become a customer (Section 9 then applies) or the law requires us to keep it longer. We keep the record of your consent for as long as we keep the details it covers.
• Your choices: you can withdraw consent, stop updates, or ask to see, correct, or delete your details at any time on our Privacy Rights page. Withdrawing is as easy as giving consent. It stops future use but does not undo processing already done.
• Complaints: follow the escalation steps in Section 17. If you are still not satisfied, you may complain to the Data Protection Board of India.

• To create and administer your account, workspace, permissions, subscription, wallet, and support requests.
• To respond to website enquiries and demo requests as described in Section 2.
• To provide calls, messaging, conversations, campaigns, CRM synchronisation, order notifications, appointments, analytics, and other workflows you configure.
• To connect and maintain authorised third-party integrations, including Meta and WhatsApp Business accounts.
• To create or synchronise approved message templates and send, receive, route, display, and report on WhatsApp communications for your workspace.
• To process requested AI functions such as transcription, response generation, classification, summarisation, and workflow automation.
• To meter usage, process billing, prevent duplicate charges, and maintain financial and operational records.
• To secure, troubleshoot, monitor, improve, and support the Service, enforce our Terms, and comply with legal obligations.

We determine how account, website, billing, security, and support data is processed for operating Pineyard AI. For contacts, leads, communications, and other data you submit or connect on behalf of your customers or other individuals (“End Users”), you determine the purpose of the communication and instruct us how to process that data through your configuration of the Service. We process such data on your behalf to provide the functions you request.

You are responsible for having a lawful basis to provide End User data to Pineyard AI and for giving required notices and obtaining required consents. This includes complying with applicable telemarketing, recording, WhatsApp opt-in, message-template, and business messaging requirements. You must not use the Service for spam, harassment, unlawful profiling, deception, or communications prohibited by law or platform policy.

Where you use the Service to place or receive calls, you are responsible for informing End Users and obtaining any consent required for recording and AI-driven interactions. We process call content to deliver the functions you configure, including transcription, automated responses, call analysis, quality monitoring, reporting, and support.

When an authorised workspace administrator connects a Meta or WhatsApp Business account, Pineyard AI uses the access granted through Meta to validate the business account and phone number, maintain the connection, manage message templates, send and receive communications, process delivery events, display conversations, and provide the automations and reports selected by that workspace.

We process this Platform Data only for the connected client and only to provide, secure, support, or comply with obligations relating to the requested Service. We do not sell or license it, use one client's Platform Data for another client, use it for third-party advertising, independently profile WhatsApp users, or permit it to be used to train general-purpose AI models.

A workspace administrator may disconnect an integration, and access may also be revoked through Meta Business settings. Revocation stops future access but does not by itself erase information already stored by Pineyard AI; Section 11 explains how to request deletion.

When you enable an AI feature, Pineyard AI may send the minimum content reasonably needed for that feature to contracted AI service providers. This can include call transcripts, prompts, knowledge content, or portions of a customer conversation needed to generate a response, classify an interaction, or perform an automation. These providers may process the content only to provide the contracted service to Pineyard AI and are subject to confidentiality and data-protection obligations. Pineyard AI does not use Meta or WhatsApp Platform Data to train a general-purpose model.

Pineyard AI and its contracted service providers may process data in India and in other countries where they operate infrastructure or support services. Where data is transferred across borders, we take reasonable steps to use contractual, organisational, and technical safeguards appropriate to the data and applicable law. The location of a connected platform, telecom, cloud, or AI provider may differ from the location of your business or End Users.

We do not transfer personal data to any country or territory that the Central Government has restricted under Section 16 of the DPDP Act.

We retain information only for as long as reasonably necessary to provide and secure the Service, maintain required records, resolve disputes, and comply with legal and platform obligations. Retention depends on the type of information and how the Service is configured:

• Website enquiry and demo request details, including demo call recordings and transcripts, are retained for up to twelve (12) months after your last interaction with us, unless you become a customer or a longer period is required by law.
• Call recordings, transcripts, and associated call data are generally retained for twelve (12) months, unless a different period is required by law or agreed for a legitimate business need.
• Meta and WhatsApp credentials are retained while the connection is active. On disconnection, we revoke or unsubscribe access where supported and stop using the credentials operationally; stored copies are deleted following a verified deletion request, subject to necessary security and compliance records.
• WhatsApp messages, media references, rendered template values, conversation history, delivery records, and webhook payloads are retained while the account is active and for as long as needed for delivery, conversation history, reporting, fraud prevention, troubleshooting, support, or compliance.
• Account, consent, access, billing, tax, security, and audit records may be retained for the periods required by applicable law, platform terms, or the establishment and defence of legal claims.

Following a verified deletion request, covered information is deleted or irreversibly anonymised unless retention is legally required. Residual copies in encrypted backups are removed through the normal backup-overwrite cycle.

We do not sell personal data. We disclose information only as needed to provide the Service, follow your instructions, protect the Service, or comply with law. Recipients may include:

• Meta and WhatsApp, when you connect a WhatsApp Business account or send and receive communications through their platform.
• Cloud hosting, database, storage, content-delivery, observability, security, telephony, payment, email, scheduling, and customer-support providers.
• Contracted AI providers when you enable a feature that requires AI processing.
• CRM, commerce, calendar, and other integration providers that you direct us to connect.
• Professional advisers, auditors, insurers, prospective transaction counterparties under confidentiality obligations, and public authorities where disclosure is legally required.

Service providers are authorised to process information only for the contracted purpose and are subject to confidentiality, security, and data-protection obligations appropriate to their role.

Under the DPDP Act, you have the right to:

• obtain a summary of the personal data we process about you, the processing we carry out, and the other Data Fiduciaries and Data Processors we have shared it with;
• have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated;
• have your personal data erased once it is no longer needed for the purpose you consented to, unless the law requires us to keep it;
• withdraw your consent at any time, as easily as you gave it, which stops future processing but does not affect processing already done;
• have your grievances about our processing redressed; and
• nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, use the request form on our Privacy Rights page or contact us using Section 17. We acknowledge requests within twenty-four (24) hours and complete them within thirty (30) days. We may ask for limited information to confirm your identity and use it only for that purpose. Workspace customers are responsible for responding to End User requests relating to data they control, and Pineyard AI will provide reasonable assistance where required.

To request account, workspace, Meta, or WhatsApp data deletion, follow our Data Deletion Instructions. You may also disconnect an integration and revoke Pineyard AI's future access through your Pineyard AI integration settings or Meta Business settings.

If you are not satisfied with how we resolve your grievance, you may complain to the Data Protection Board of India after using our grievance process.

We use reasonable technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure, loss, or destruction. Measures include workspace access controls, tenant-scoped data access, encryption of stored integration credentials, protected network transport, operational logging, and restricted administrative access. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

If a personal data breach affects you, we will inform you without delay and report it to the Data Protection Board of India, with a detailed report within seventy-two (72) hours of becoming aware of it, in line with the DPDP Act and the rules made under it.

Our website does not use advertising cookies or third-party analytics cookies. It stores only these small items, which it needs to work:

• pineyard_landing (cookie): remembers which version of the site to show you. Kept for up to one year.
• py_gate_done (your browser's local storage): remembers that you already filled in our pop-up form, so we do not show it again. Kept until you clear your browser data.
• pineyard_nav_toast_dismissed (your browser's session storage): remembers that you opened the mobile menu, so its hint stays hidden. Cleared when you close the tab.

We also count which buttons are used, for example opening a form, without cookies and without storing your IP address. If we add analytics or advertising cookies in future, we will ask for your consent first. You can clear or block these items in your browser settings; the site still works, though you may see the pop-up again.

The Service is intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data directly from children, and our website forms ask you to confirm that you are 18 or older. Customers must not use the Service to process children's data unless they have a lawful basis and all protections required by applicable law.

If you connect a Google account to use our Google Calendar integration, we access a limited set of Google user data to provide that feature: your Google account email address; your calendar list and free/busy information; and permission to create and edit calendar events using the Google calendar.events scope. We use this data solely to identify the connected account, avoid scheduling conflicts, and create or manage appointments on the calendar you select.

Pineyard AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. You can revoke our access by disconnecting the integration in your dashboard or through your Google Account security settings.

We may update this Privacy Policy as the Service, integrations, or legal requirements change. Material changes will be communicated through the Service, by email, or through another appropriate notice, and the effective date above will be revised.

For privacy questions, rights requests, or grievances, contact Pineyard AI Private Limited using the details below or the request form on our Privacy Rights page:

A complaint that is not resolved moves through these levels:

1. Level 1Support desk

   Contact

   sales@pineyard.ai · +91 8982838406 · request form

   For

   Any privacy question, rights request or complaint.

   Acknowledgement

   Within twenty-four (24) hours, with a reference number.

   Resolution

   Complaints within seven (7) days. Rights requests within thirty (30) days.

2. Level 2Grievance Officer

   Contact

   Email harshitpandey0404@gmail.com with the subject “Grievance escalation” and your reference number.

   For

   A complaint not resolved at Level 1 within seven (7) days, or an answer you disagree with.

   Acknowledgement

   Within twenty-four (24) hours.

   Resolution

   Within thirty (30) days of your original complaint.

3. Level 3Data Protection Board of India

   For

   If you are still not satisfied after Levels 1 and 2. The DPDP Act asks you to use our grievance process first.

Designated internal DPDP compliance owner: Harshit