This Privacy Policy explains how Prophecius Media Pvt Ltd ("Prophecius", "we", "us") collects, uses and protects personal data when you use Ora by Prophecius (the "Service"). It is written for India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and similar laws elsewhere.
For your own account details we decide how data is used, so we are the Data Fiduciary. For the data of your customers that passes through the Service (their chats, calls, orders and emails), your business is the Data Fiduciary and we process it only on your instructions, as your Data Processor.
We use information to provide and improve the Service: answering your customers, sending the messages and emails you ask us to send, reviewing calls, showing your reports, billing you, giving support, keeping the Service secure and preventing abuse, and meeting legal duties. We send you marketing only where you have agreed to it.
Conversations and content are used to produce replies and run features for your account. We do not sell personal data and do not use your business's conversations to train public AI models. Where we use third-party AI providers, we send only what a reply or review needs.
Voice notes. A voice note is sent to an AI provider to be turned into text. We keep the text only; the audio is not stored.
Website calls. When a visitor uses the call button, their voice is streamed to our speech provider to understand it, and the reply is spoken by an AI voice provider. We keep the words of the call and a short summary. We do not keep a recording of website calls.
Phone calls. Phone calls run on your business's own Plivo or Twilio account. If you switch on recording, the recording is stored in that account, not with us. When AI call checks are on, the recording is sent to an AI provider once to produce a transcript and a quality review; we keep the transcript (with phone numbers and email addresses masked) and the review. Your business is responsible for telling callers that calls may be recorded.
Scores are estimates. Lead scores, call scores and "chance to buy" are produced automatically to help your team decide what to do next. They are not decisions about a person and should not be used as the only basis for one.
Before the bot stores or answers anything in a new chat session, the person sees a short notice saying who is collecting their data and why, and is asked to agree. On the website this is a card in the chat; on WhatsApp, Telegram and Instagram it is the bot's first message, and their question is answered once they say yes. A chat session ends after a quiet gap, and the next one asks again.
We share data only with providers that help us run the Service, under confidentiality and data-protection terms:
Some services are connected by you, with your own account: Plivo or Twilio for calls and SMS, your own email provider for sending emails, Shopify or WooCommerce for orders, and your payment gateway for pay links. Those providers process data under their own terms with you. We may also disclose information where the law requires it.
We use essential cookies and local storage to keep you signed in and remember preferences, and limited analytics to understand how the Service is used. The chat widget keeps a visitor identifier in the browser so a returning visitor's chat can continue. You can control cookies in your browser; the cookie banner we provide lets your website visitors choose too.
We keep personal data while your account is active or as needed to provide the Service, then delete or anonymise it within a reasonable period unless the law requires us to keep it longer.
We use encryption in transit (HTTPS everywhere), access controls and separation between accounts. Secrets such as channel keys, mailbox passwords and Team Vault entries are encrypted before they are stored, and every view or copy of a Vault entry is logged. No system is perfectly secure; if a breach affects personal data, we will inform affected users and the authorities as the law requires.
Under the DPDP Act and similar laws, you may ask to access a summary of your personal data, correct or update it, have it erased, withdraw consent, nominate someone to act for you, and raise a grievance. To do so, email the Grievance Officer below. We respond as quickly as we can and within the time the law allows. If you are not satisfied, you may complain to the Data Protection Board of India.
If you are a customer of a business that uses Ora, that business is responsible for your data: please contact them first. You can always withdraw consent or ask for deletion directly in their chat.
Some of our providers process data outside India. Where data is transferred, we use providers and safeguards consistent with applicable law, and we will follow any restrictions the Government of India sets for transfers.
The Service is for businesses and is not directed at people under 18. We do not knowingly collect personal data from children. Businesses that serve children must get verifiable consent from a parent or guardian as the law requires.
We may update this Policy and will post the new date at the top. For significant changes we will tell you in the Service or by email.
Grievance Officer and privacy requests: propheciustech@gmail.com