Privacy Policy

This policy explains how Brioways ("we", "us") handles personal data when you visit this website, contact us, or use our services. We follow the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it.

Who is responsible

For personal data collected through this website and in our own sales and support conversations, the Data Fiduciary is the company named in the "Contact for privacy requests" box at the end of this page, at the registered office address shown there.

For client projects (for example an AI voice agent answering a client's customers, or a WhatsApp chatbot on a client's number), the client is the Data Fiduciary and we act as a Data Processor on the client's written instructions. Those projects are covered by our Data Processing Agreement, not by the website sections of this policy. If you are a caller or customer of one of our clients, please contact that business first; we will help them respond to you.

Grievance Officer

You can send any privacy request or complaint to our Grievance Officer, whose name and email address are shown in the box at the end of this page. We will acknowledge your request within 7 days and respond within 30 days.

What we collect

• Contact form: name, company, mobile number, email, the service you are interested in, and your message.
• Audit bookings: name, email and the details you enter on our booking calendar.
• WhatsApp, phone and email: your number or email address and the messages you send us.
• Website usage: pages visited, referring website and campaign tags (UTM parameters), stored in your browser for the session and sent with any form you submit.

Why we collect it

• To reply to your enquiry and run the free audit you asked for.
• To send a proposal or follow up on a conversation you started.
• To understand which pages and campaigns are useful, in aggregate.

We do not sell personal data. We do not use your data, or our clients' customer data, to train public AI models.

Consent and your choices

By submitting a form, booking a call or messaging us, you consent to us using your details for the purposes above. You can withdraw consent at any time by writing to the Grievance Officer, and we will stop processing your data except where the law requires us to keep it.

Cookies and similar technologies

This website does not use advertising cookies.

• Strictly necessary storage: we store campaign tags (UTM parameters) in your browser's session storage so that a form submission records how you found us. This is cleared when you close the tab.
• Analytics: by default we use cookie-free analytics or none at all. If we switch on Google Analytics, a banner asks for your consent first, and Google Analytics cookies are only set if you click "Accept". Your choice is saved in your browser's local storage and you can change it by clearing site data.
• Third-party pages: our booking calendar (Calendly) and WhatsApp open on their own websites, which have their own cookie policies.

Who processes data for us

We use the following service providers (sub-processors). Each is bound by contract to protect the data and use it only to provide its service to us.

Some providers store data outside India. Transfers are made in line with the DPDP Act and any restrictions notified by the Government of India. For client projects, the providers used are listed in the client's Data Processing Agreement.

Calls, recordings and AI agents

For client projects that use voice agents, callers hear a notice at the start of the call that the call may be recorded and that they are speaking with a virtual assistant, and they can ask for a person at any time. The client decides whether calls are recorded and how long recordings and transcripts are kept. The client is responsible for its own consent notices to its customers; our Data Processing Agreement explains how our obligations as processor fit with them.

How long we keep data

• Enquiries that do not become clients: up to 12 months after the last contact.
• Client records: for the duration of the contract plus the period required by Indian tax and company law.
• Client project data (recordings, transcripts, chat logs): as set by the client in the Data Processing Agreement, then deleted or returned.
• Analytics: aggregated, without identifying individuals.

Your rights

Under the DPDP Act you can ask us to:

• tell you what personal data we hold about you and how it is used;
• correct, complete or update it;
• erase it, where we no longer need it;
• nominate another person to exercise your rights in case of death or incapacity.

Send requests to the Grievance Officer. If you are not satisfied with our response, you may approach the Data Protection Board of India.

Security

We use encryption in transit, access controls, multi-factor authentication on admin accounts and reputable cloud providers. No system is completely secure. We will notify affected people and the Data Protection Board of a personal data breach as required by law.

Children

This website is not intended for children. We do not knowingly collect data from anyone under 18.

Changes

We will update this page when our practices change, and show the date of the latest update at the top.