Privacy Policy

Converlane is a brand operated by Starvox Labs Pvt. Ltd., a private limited company incorporated in India. References in this policy to “Converlane”, “we”, “us” or “our” mean Starvox Labs Pvt. Ltd., the data controller for the personal data described below.

We provide two related products. The first is an AI voice agent for inbound and outbound phone calls, sold to businesses that want to automate receptionist, lead-qualification, customer-service, appointment-setting, debt-recovery, and survey workloads. The second is an AI meeting agent that joins or hosts video meetings on behalf of a host. Both are sold business-to-business; the paying party (our customer) is generally the data controller for the calls and meetings they run. End users on the other end of a call — your customers, your leads, your patients — are data subjects under this policy. Where our customer is the controller for those end users, we act as a data processorfor that data; the customer’s own privacy notice governs the consent and lawful basis. Where we decide independently how to use data (for example, for our own product analytics), we act as a controller. This policy covers both roles and flags which is which where it matters.

For India residents, we are subject to the Digital Personal Data Protection Act, 2023 (DPDP Act). For residents of the European Economic Area, the United Kingdom, and Switzerland, we treat the EU GDPR and equivalent regimes as the operating standard. For residents of California, the CCPA/CPRA applies. Where laws conflict, we apply the higher standard.

We collect only the data that the service genuinely needs. Each category below maps to a real table or storage bucket in our system — we do not collect data we cannot point at.

To make the first list complete, here is what we have chosen not to collect:

• No card numbers or UPI handles. Razorpay collects them; we never see the raw values. We only persist the resulting payment ID.
• No third-party advertising identifiers. No Facebook Pixel, no Google Ads tag, no LinkedIn Insight tag, no TikTok Pixel. None of those scripts run on our pages.
• No biometric voiceprints derived from end-user calls.The voice agent uses Google Gemini for speech recognition and generation; we do not build a speaker-identification model from your callers’ voices.
• No precise geolocation. We coarsely infer country from IP for routing and abuse detection; we do not use GPS, Bluetooth, or WiFi-positioning.
• No social-graph data. When you sign in with Google or Microsoft SSO, we request the minimum scope: your name, your email, and (where requested) calendar/meeting permissions you have explicitly granted.

Under GDPR Article 6 and India’s DPDP Act, every act of processing needs a legal basis. Ours are:

• Contract (Art. 6(1)(b)): account data, call/meeting data, billing data, and usage data are processed because they are necessary to deliver the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): security logs, rate limiting, abuse detection, and aggregate product analytics. We balance these against your rights and you can object via the contact email below.
• Consent (Art. 6(1)(a)): optional analytics, marketing emails, and any voluntary opt-in to use call recordings to improve our models. Consent is withdrawable at any time from your account settings.
• Legal obligation (Art. 6(1)(c)): retention of invoices and tax records under Indian tax law.

We default to short retention windows and let you shorten them further by contract.

You can delete your workspace at any time from /settings/delete. Deletion removes account data, call data, transcripts, and meeting data within 30 days. Billing records are retained for the legally required period above and then purged.

We use the following sub-processors. Each one has been chosen because it is either the best-in-class for its function or has a data-residency profile that suits Indian customers. Material additions will be announced on this page at least 14 days before they go live.

Our primary data plane is in AWS Mumbai (ap-south-1): Supabase Postgres, S3, SES and SNS all run there. The following sub-processors process data outside India: Google Gemini (global Google Cloud regions), Resend (EU/US), Twilio (US), Meta WhatsApp Cloud API (EU/US), and PostHog (EU). For each, we rely on the provider’s GDPR-compliant Data Processing Addendum and Standard Contractual Clauses where applicable.

Under GDPR Articles 15–22 and equivalent provisions of the Indian DPDP Act, you have the right to:

• Access a copy of the personal data we hold about you — see /settings/data-export.
• Rectify inaccurate or incomplete data via your account settings.
• Erase your data — see /settings/delete.
• Port your data to another service, in a structured machine-readable format (JSON / CSV).
• Restrict processing while a complaint is being investigated.
• Object to processing based on legitimate interest.
• Withdraw consent for any processing that relies on consent, without affecting the lawfulness of prior processing.
• Lodge a complaint with your local supervisory authority (the Data Protection Board of India, or the relevant EU DPA).

We will respond to verified rights requests within 30 days. End users of our customers’ voice agents should generally direct rights requests to the customer (the controller); we will assist where required.

We use one strictly-necessary cookie (the Supabase session cookie) and one optional analytics tag (PostHog), which respects the Do Not Track header. We do not use any third-party advertising cookies. The full table is on the Cookie Policy page.

The service is sold to businesses and is not directed at, marketed to, or intended for use by anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please email the contact below and we will delete it.

We may update this policy as the product evolves. The “Last updated” date at the top of this page always reflects the most recent revision. Material changes — new categories of data, new sub-processors with broader scope, or changes to retention windows — will be announced by email and via an in-app notice at least 14 days before they take effect.

For privacy questions, rights requests, or to reach our data protection contact, write to krishal@advisio.in. Postal mail can be sent via our contact page.