Nokvo Privacy Policy

Last Updated: June 10, 2026

Welcome to Nokvo ("we," "our," or "us"). We provide NOKVO, an enterprise-grade AI voice agent platform designed to automate and enhance business communications.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our application, or interact with our services. As a B2B Software-as-a-Service (SaaS) provider, it is critical to distinguish between data we collect for our own purposes (Account Data) and data we process on behalf of our business customers (Customer Data).

1. Our Role in Data Processing

Under applicable data protection laws:

• Data Controller: We are the data controller for the Account Data of our direct customers (businesses who subscribe to Nokvo).
• Data Processor (Service Provider): We are the data processor for Customer Data, which includes the personal information of our customers' end-users (e.g., callers interacting with the AI agent). We only process this data according to our customers' instructions.

2. Information We Collect

A. Information Collected as a Data Controller (Account Data)

When you register for a Nokvo account, we collect:

• Contact Details: Name, email address, company name, and phone number.
• Authentication Data: Authentication credentials, authentication tokens, OAuth tokens (e.g., Google, Zoho), and MFA/WebAuthn credentials.
• Billing Information: Payment details and billing addresses (processed via secure third-party payment gateways).
• Usage & Device Data: IP addresses, browser types, log data, and OpenTelemetry observability metrics to ensure platform stability.

B. Information Processed as a Data Processor (Customer Data)

When businesses use the Nokvo voice agents, we process data on their behalf, including:

• Call Data: End-user phone numbers, call metadata (duration, timestamps), and call audio recordings.
• Transcripts: Automated speech-to-text transcripts of conversations between callers and the AI agents.
• Integration Data: Data synced from third-party CRMs and ad platforms connected by the customer (e.g., Zoho Desk, Google Leads, Meta Leads, WhatsApp, SMS gateways).
• Knowledge Base Information: Proprietary business documents uploaded to inform the AI agent's responses.

3. Legal Basis for Processing

Where applicable, we process personal data based on:

• Performance of a Contract: To deliver the Nokvo platform and services to our customers.
• Legitimate Business Interests: To maintain security, troubleshoot issues, and improve platform functionality.
• Compliance with Legal Obligations: To comply with applicable laws and regulations.
• User Consent: Where explicitly required by law.

4. How We Use the Information

We use Account Data to:

• Provide, operate, and maintain the Nokvo platform.
• Process payments and calculate tenant billing/usage costs.
• Send administrative notifications, technical alerts, and security updates.
• Improve platform robustness, fix bugs, and optimize latency.

We process Customer Data exclusively to:

• Facilitate real-time, bidirectional voice conversations using AI.
• Transcribe speech to text, generate LLM responses, and synthesize text to speech.
• Extract conversational outcomes and schedule follow-up actions (e.g., via SMS or CRM sync).
• Maintain a short-term conversational memory to provide contextually accurate agent responses.

5. AI Model Training and Data Sales

• Nokvo does not sell, rent, or share Customer Data for advertising purposes.
• Nokvo does not use Customer Data, call recordings, transcripts, uploaded documents, phone numbers, or customer-specific business information to train public foundation models.
• Where permitted by law and customer agreements, Nokvo may use aggregated and de-identified usage metrics, performance statistics, and non-identifiable linguistic patterns to train models in the future and to improve platform performance, speech quality, and multilingual conversational experiences (e.g., to train and refine localized Indian-language voice models). Such information cannot reasonably be used to identify a customer, end-user, or business.

6. Automated Processing

Certain interactions may be processed automatically by AI systems in real-time. Customers are responsible for reviewing and supervising AI-driven workflows and outcomes where legally required by their respective jurisdictions.

7. Customer Responsibilities

As the Data Controller of Customer Data, our customers are responsible for:

• Obtaining any required consent for call recording and AI interactions from end-users.
• Providing the necessary privacy notices to their end-users.
• Ensuring the lawful collection and processing of personal data prior to its input into the Nokvo platform.
• Configuring data retention settings according to their own legal and compliance obligations.

8. Children's Privacy

Nokvo services are intended strictly for business use. Where customers (such as schools or educational institutions) use Nokvo to process data relating to minors, the customer is fully responsible for obtaining all necessary permissions and verifiable parental consents as required by applicable laws (e.g., COPPA, DPDP Act).

9. Third-Party Subprocessors and Integrations

To deliver low-latency, enterprise-grade AI voice services, we partner with specialized third-party infrastructure providers. Nokvo utilizes trusted third-party service providers to deliver certain aspects of the Services.

• Cloud Infrastructure & AI Models: Microsoft Azure (Azure OpenAI, Postgres, Redis, Blob Storage, Key Vault). Data is processed in designated regions (e.g., Central India, Sweden Central, South India).
• Telephony & Messaging: Plivo, Twilio, and Telnyx for SIP trunking, inbound/outbound voice calls, WhatsApp, and SMS delivery.
• Speech Services (STT/TTS): Sarvam AI and Soniox for real-time speech-to-text and text-to-speech rendering.
• Vector Databases: Qdrant for managing embedded knowledge base queries.
• Observability: LangSmith and OpenTelemetry for prompt tracing and latency diagnostics.

Nokvo seeks to maintain appropriate contractual, security, and privacy safeguards with its subprocessors, including Data Processing Agreements where applicable. Nokvo may update, replace, or add subprocessors from time to time. A current list of material subprocessors will be made available upon request or published through our website.

10. Data Retention

Call transcripts, call summaries, and recordings are retained according to customer-configured retention settings, subject to platform defaults and legal obligations. Customers remain responsible for selecting appropriate retention settings based on their legal, regulatory, and contractual obligations.

• Agent Memory: High-fidelity, temporary conversational state is held in active memory only for the duration of the session (TTL of 10 minutes post-call). Extracted conversational summaries and transcripts are persisted according to the customer's configured retention settings.
• Account Data: Retained for as long as your account is active, or as needed to comply with legal and billing obligations.

11. Data Security and Incident Notification

We implement rigorous technical and organizational measures to protect your data:

• Encryption: Data is encrypted at rest (using Azure Blob Storage and Postgres native encryption) and in transit (via TLS/HTTPS/WSS).
• Key Management: Sensitive tenant credentials (e.g., Twilio keys, OAuth secrets) are managed securely via Azure Key Vault with enforced secret rotation policies.
• Access Controls: Strict Role-Based Access Control (RBAC), multi-factor authentication (MFA) requirements for super-admins, and robust tenant isolation architectures.
• Security Incidents: In the event of a confirmed security incident affecting Customer Data, Nokvo will notify affected customers without undue delay and provide relevant information required to comply with applicable laws.

12. Your Privacy Rights

Depending on your jurisdiction (e.g., EU, UK, California), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data ("Right to be Forgotten").
• Restrict or Object to certain processing activities.
• Data Portability: Receive a copy of your data in a structured, machine-readable format.

Nokvo does not sell personal information or Customer Data to third parties.

Note for End-Users: If you interacted with a Nokvo AI voice agent deployed by one of our customers, please direct your privacy requests directly to that business, as they act as the Data Controller of your information.

13. Digital Personal Data Protection Act (DPDP Act)

Nokvo processes personal data in accordance with applicable Indian privacy laws, including the Digital Personal Data Protection Act, 2023, where applicable. We are committed to upholding the principles of data minimization, lawful processing, and security under the DPDP Act.

14. International Data Transfers

As a globally available platform, your data may be transferred to, and processed in, countries other than the country in which you are resident. We ensure that such transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission or other legally adequate mechanisms.

15. Legal Requests and Disclosure

Nokvo may disclose information where required by law, court order, regulatory authority, or other valid legal process. Where legally permitted, we will provide advance notice to affected customers.

16. Business Transfers

If Nokvo is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to applicable confidentiality obligations.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our platform infrastructure, new third-party integrations, or legal requirements. We will notify you of significant changes by emailing the primary contact on your account or displaying a prominent notice within the NOKVO portal.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our privacy team at: