Legal · updated 11 September 2026

Privacy policy

Draft. This reflects how the product works and is written to be accurate, but it has not yet been reviewed by counsel for the jurisdictions we sell in. Until it has, treat it as a description of our practice rather than a contract term.

Xtallo is operated by XDQ Labs Private Limited, Spaze iTech Park, Gurugram, Haryana, India (“we”). This policy covers three kinds of people: customers who use Xtallo, the people our customers call using it, and visitors to this site.

If you are somebody an Xtallo talent called

An Xtallo talent tells you it is an AI and that the call is recorded in its first sentence, before anything else. The business that set it up is the party that decided to call you; we process the call on their behalf.

What is recorded: the audio of the call, a transcript, the outcome (for example “asked to be called back Thursday”), and an automated quality score. These are held in the calling business’s workspace.
Why you were called: the business declared a basis before dialling — an existing relationship, a form you completed, an enquiry you made, or written consent for automated calls — and that basis is recorded against your number.
If you ask not to be called: the call ends, your number is marked do-not-call in that workspace, and it is not dialled again by any talent in it. This is enforced in code, not left to the talent’s judgement.
Your rights: you may ask the calling business for the recording and transcript, ask for correction, or ask for deletion. If you cannot reach them, contact us at privacy@xtallo.com with the number that was called and we will route the request.

If you are a customer

Account data: name, email, company, billing details, and the settings you choose.
Your contacts: numbers and names you upload or connect. You are responsible for having a lawful basis to call them; we ask you to declare it when a list enters and we refuse numbers that lack one.
Calls: recordings, transcripts, outcomes and scores, for every call your talents make, retained for as long as your workspace exists unless you delete them sooner.
What we do not do: we do not use your calls, contacts or pitches to train models used by other customers. Transcripts are sent to a model provider to run the call and to score it; those providers are contractually barred from training on the content.
Carrier credentials: stored encrypted, write-only — never displayed after entry, and rotated rather than read.

Retention and deletion

Call recordings and transcripts: until you delete them or close your workspace, then 30 days.
Do-not-call records: kept after workspace closure, so a number that asked not to be called is not called if the business returns.
Consent records: kept for the period your jurisdiction requires as evidence of lawful basis, typically the life of the relationship plus two years.
Deleting a talent does not delete its calls. Calls are the record of what was said to real people, and are kept until the workspace deletes them.

Where data lives and who sees it

Servers in India and, for international customers, in the region nearest your carrier. Sub-processors: our hosting provider, the telephony carrier you connect, a speech-to-text and text-to-speech provider, and a model provider for conversation and scoring. A current list is available on request. Our staff access customer data only to provide support you have asked for or to investigate abuse, and every such access is logged.

Cookies and this site

Essential cookies only on the app. This marketing site uses no analytics that transmit your IP address to a third party. See the cookie policy.

Contact

privacy@xtallo.com · XDQ Labs Private Limited, Spaze iTech Park, Gurugram, Haryana, India.