Privacy Policy
1. Who we are
EVOLVE40X AI Technologies Private Limited ("EVOLVE40X", "we", "us") builds AI receptionists and conversational agents for businesses — voice agents that answer telephone calls, and messaging agents that reply on Instagram, WhatsApp and website chat. Our registered office is at Manyata Redwood, 9th Floor, Block D3, Manyata Tech Park Road, Thanisandra, Bengaluru 560045, Karnataka, India. We are the data controller for information collected through evolve40x.com and our own business channels, and a data processor for information our clients' agents handle on their behalf.
2. What this policy covers
This policy applies to:
- visitors to evolve40x.com and people who request a demo or contact us;
- people who message an Instagram or WhatsApp account, or call a phone number, that is served by an EVOLVE40X agent — whether that account belongs to us or to one of our clients;
- client staff who use the EVOLVE40X dashboard.
Where an agent operates on behalf of a client (for example a hotel group), that client decides why and how your data is used and is the controller; we process it under their instructions. Their own privacy notice applies alongside this one.
3. Information we collect
When you message or call an agent
- Message content — the text of Instagram DMs, WhatsApp messages or web chats you send, and the replies the agent gives.
- Call content — audio recordings and transcripts of calls handled by a voice agent, in the original language and in English.
- Identifiers — your Instagram username and platform user ID, your WhatsApp or telephone number, and the name you give during the conversation.
- Enquiry details — what you ask for, such as destination, dates, number of guests, budget or a call-back number.
- Metadata — timestamps, call duration, the account or number you contacted, and message delivery status.
When you use evolve40x.com
- Contact details you submit in a demo or contact form (name, business name, phone number, email, website URL).
- Standard web analytics (Google Analytics 4): pages visited, approximate location derived from IP, device and browser type. We do not run advertising trackers.
When you use the dashboard as client staff
- Your name, username, role, property assignment, work phone number for notifications, and an audit trail of actions you take on records.
We do not collect card or bank details through agents, and agents are instructed never to ask for them.
4. How we use it
- To answer your enquiry and continue the conversation with context — an agent needs the earlier messages in a thread to reply sensibly.
- To route your enquiry to the right business team, and to notify them (for example by WhatsApp) so a person can follow up.
- To show the business a record of the conversation, its status and any notes their team adds.
- To monitor quality: reviewing transcripts to fix mistakes, improve agent instructions and detect abuse.
- To measure usage and bill our clients (call minutes, message counts).
- To respond to demo requests and contact-form messages.
- To meet legal obligations and enforce our terms.
Where Indian law requires a legal basis, we rely on your consent (you chose to message or call), the performance of a service you asked for, and our and our clients' legitimate interest in running a customer-service channel.
5. AI processing
Agent replies are generated by large language models and speech models supplied by third-party AI providers, such as Anthropic, OpenAI, ElevenLabs and Sarvam AI. To generate a reply, the relevant conversation content is sent to the provider and processed under their API terms, which do not permit them to use it to train their models. We do not use your conversations to train models of our own. Agents identify themselves as AI assistants when asked, and are configured not to quote prices, confirm availability, take payments or handle complaints — those are handed to a person.
6. Instagram, WhatsApp and Meta platforms
Our Instagram and WhatsApp agents are built on Meta's Instagram Platform and WhatsApp Business Platform. We access only the data Meta's messaging permissions provide — messages sent to the connected business account, the sender's name and platform ID, and delivery events — and use it solely to reply to those messages and display them to the business. We comply with Meta's Platform Terms and Developer Policies. Business owners can disconnect an agent at any time from their Instagram settings or by asking us; when they do, we stop receiving their data. Your use of Instagram or WhatsApp itself is governed by Meta's own privacy policy.
7. Who we share it with
- The business you contacted — they see the full conversation in their dashboard, because it is their customer enquiry.
- Service providers who host or process data for us: Hostinger (web hosting, India/EU), Meta (Instagram and WhatsApp APIs), Twilio and Exotel (telephony; call recordings may be stored on their infrastructure in Singapore or Mumbai), ElevenLabs and Sarvam AI (voice agents), Anthropic and OpenAI (language models), Google (analytics). Each is bound by contract to process data only on our instructions.
- Authorities where required by law or a valid legal order.
We do not sell personal data and do not share it with advertisers.
8. How long we keep it
| Data | Retention |
|---|---|
| Message threads and call transcripts | 12 months from the last message, or until the client closes the record and asks for deletion, whichever is earlier |
| Call recordings | 6 months (telephony providers keep their own copy for up to 6 months and we cannot shorten that) |
| Demo and contact-form submissions | 12 months |
| Dashboard user accounts and audit trail | For the life of the client contract plus 12 months |
| Server logs | 90 days |
When a retention period ends we delete or anonymise the data. Backups are overwritten within 30 days after that.
9. Security
All traffic to our servers and to every provider is encrypted in transit (TLS 1.2 or higher). Stored data is encrypted at rest by our hosting provider. Webhook calls from Meta are verified by signature before they are processed. Dashboard access requires a username and password, sessions expire, and staff only see records for the properties they are assigned to. Access to production systems is limited to named EVOLVE40X engineers. We keep an audit log of changes to records. If we become aware of a breach affecting your data, we will notify the affected client and, where required, you and the relevant authority without undue delay.
10. Your rights
You can ask us to tell you what personal data we hold about you, correct it, delete it, or stop processing it. If the data belongs to a client's agent we will pass your request to that client and help them respond. To delete data collected through an Instagram or WhatsApp agent, use our data deletion page or email us. We respond within 30 days. Under the Digital Personal Data Protection Act, 2023 you can also complain to the Data Protection Board of India if you are not satisfied with our response. Our grievance officer can be reached at the contact below.
11. Children
Our services are for businesses and their adult customers. We do not knowingly collect data from anyone under 18. If you believe a child has messaged an agent, contact us and we will delete the conversation.
12. Changes
We will post any changes on this page and update the effective date. Material changes affecting clients will be notified to them by email.
13. Contact
Grievance officer, EVOLVE40X AI Technologies Private Limited
Manyata Redwood, 9th Floor, Block D3, Manyata Tech Park Road, Thanisandra, Bengaluru 560045, Karnataka, India
contact@evolve40x.com · +91 99623 96035