Privacy Policy & Data Protection

This Privacy Policy applies to personal digital data processed by Salow Technologies (“Salowtech”, “we”, “us”, or “our”) in connection with our website, custom client software platforms, mobile applications, APIs, and AI voice systems.

This Policy is drafted in strict adherence to the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 enacted by the Government of India, along with global privacy benchmarks including GDPR where applicable.

We may process the following categories of digital data:

• Identity & Contact Data: Full name, corporate email address, business telephone number, organizational title, company name, and physical office location.
• Commercial & Billing Data: GSTIN, PAN, bank account details for milestone transfers, billing addresses, and payment transaction IDs.
• Client Application Data: Database records, business entities, employee attendance logs, and inventory data hosted within client-commissioned software platforms.
• Voice, Audio & Telephony Data: Live telephony audio streams, dual-channel call recordings, and speech-to-text transcripts generated via Salowtech AI Voice Assistant modules.
• Technical & Telemetry Data: IP address, browser user-agent, operating system, API request latency, cold-start telemetry, and error stack traces.

In compliance with Section 4 of the DPDP Act, Salowtech processes personal data solely under recognized lawful bases:

• Consent: Given freely, specifically, informedly, conditionally, and unambiguously by the Data Principal through an affirmative action.
• Certain Legitimate Uses: As provided under Section 7 of the DPDP Act, including statutory compliance, fulfilling contracts requested by the Data Principal, and mitigating active cybersecurity threats.
• Statutory Tax & Audit Compliance: Retention of invoices and commercial transaction records required under the Central Goods and Services Tax Act, 2017.

Prior to or at the time of collecting personal data, Salowtech presents an itemized, accessible notice detailing the exact categories of data sought, the specific purposes of processing, the manner in which the Data Principal may exercise their statutory rights, and the designated Grievance Officer's contact coordinates.

Notices are made available in clear, plain English and are accessible to users across mobile, desktop, and interactive telephony interfaces.

Our marketing website uses strictly essential operational cookies and lightweight, privacy-preserving session tokens necessary for security, load balancing, and CSRF prevention.

We do not deploy intrusive cross-site behavioral tracking pixels or third-party ad retargeting beacons. Users may configure their browser to reject cookies, though doing so may disable authenticated dashboard access.

Salowtech never sells, leases, or trades personal data to data brokers or advertising exchanges.

Personal data is shared only with verified Data Processors bound by statutory Data Processing Agreements (DPAs) that mandate security standards equivalent to or exceeding this Policy, including:

• Cloud infrastructure hosts (AWS India, Google Cloud India, or client-specified private clouds).
• Telephony gateway carriers (Twilio, Exotel, or authorized telecom service providers in India).
• Licensed payment aggregators (Razorpay, Cashfree, or designated scheduled commercial banks).
• Governmental or regulatory authorities solely when mandated by valid court subpoena or statutory law.

Salowtech maintains organizational and technological safeguards designed to protect personal data from accidental loss, unauthorized destruction, or illicit access:

• Encryption Standards: AES-256 encryption for data at rest across all database partitions, and TLS 1.3 encryption for all data in transit.
• Least-Privilege Access: Strict multi-factor authentication (MFA) and Role-Based Access Control (RBAC) governing engineer access to production environments.
• Breach Notification: In the event of a verified personal data breach, Salowtech shall notify the Data Protection Board of India and affected Data Principals in the form and manner prescribed by Section 8(6) of the DPDP Act and DPDP Rules, 2025.

Salowtech retains personal data only for as long as necessary to satisfy the purpose for which it was collected or to comply with statutory legal requirements.

Upon expiration of the retention window or upon receiving a valid erasure request from a Data Principal, Salowtech securely purges, shreds, or irreversibly anonymizes the personal data from all active databases and secondary backup rotations within 30 calendar days.

Under Chapter III of the DPDP Act, 2023, every Data Principal whose personal data is processed by Salowtech is endowed with the following statutory rights:

• Right to Access Information: Obtain a summary of personal data processed, identities of all data fiduciaries/processors with whom data has been shared, and any other relevant processing details.
• Right to Correction & Erasure: Request the correction of misleading or inaccurate personal data, completion of incomplete data, or erasure of data no longer necessary for the original purpose.
• Right of Grievance Redressal: Avail readily accessible grievance redressal mechanisms with our Grievance Redressal Officer.
• Right to Nominate: Nominate any individual to exercise data principal rights in the event of death or incapacity.

Data Principals possess the statutory right to withdraw previously granted consent at any time. Withdrawal can be executed by emailing [email protected].

Withdrawal of consent does not affect the legality of processing executed prior to the withdrawal. Following withdrawal, Salowtech shall cease processing unless processing is mandated by statutory Indian law.

Salowtech does not knowingly process personal data relating to minors under 18 years of age without verifiable parental or legal guardian consent, in accordance with Section 9 of the DPDP Act. We do not engage in targeted advertising, behavioral tracking, or profiling directed at minors.

When you interact directly with our website or enter into commercial contracts with us, Salowtech acts as a Data Fiduciary determining the purpose and means of processing.

When Salowtech develops, hosts, or maintains software solutions for our enterprise clients wherein the Client stores end-user data (e.g. CRM contacts, ERP vendor records, HRM employee files), the Client acts as the Data Fiduciary and Salowtech acts solely as a Data Processor, processing data strictly pursuant to the Client’s documented instructions.

Salowtech stores primary enterprise and client data on servers physically located within India. In the event of cross-border data transfer to global cloud regions, such transfers shall comply strictly with notifications issued by the Central Government of India under Section 16 of the DPDP Act.

Salowtech may periodically update this Privacy Policy to reflect statutory developments, regulatory circulars, or architectural modifications. The “Effective Date” at the top of this document indicates when the latest revision took effect.

Material modifications will be communicated via website notice or direct email dispatch to registered enterprise contacts prior to taking effect.