1. Overview & Scope
This Privacy Policy describes how tanderrum.ai (“we”, “us”, or “our”) collects, uses, processes, stores, and protects information gathered through our website (tanderrum.ai) and our proprietary artificial intelligence voice agent platform, MAYA (collectively, the “Service”).
We are committed to maintaining the highest degree of security, transparency, and data sovereignty for our business clients and their end-user callers.
2. Controller vs. Processor Roles
Understanding our role depends on how you interact with MAYA:
- When you visit our website: tanderrum.ai acts as the Data Controller regarding your contact inquiries, account credentials, and website analytics.
- When handling phone calls for our business clients: Our client (the business whose customer center is powered by MAYA) is the Data Controller. tanderrum.ai acts solely as a Data Processor (or “Service Provider” under applicable privacy statutes such as the California Consumer Privacy Act / CPRA). We process caller audio, transcripts, and records strictly pursuant to our client's contractual instructions and Data Processing Agreements (DPA).
3. Information We Collect
Depending on your usage of our Service, we collect the following categories of data:
A. Telephony & Voice Audio Data
Real-time audio streams generated during active inbound or outbound calls, caller phone numbers (ANI), dialed numbers (DNIS), call duration, network packet latency, and audio recordings (when recording is enabled by our client).
B. Transcripts & Conversational Content
Machine-generated transcripts of caller speech, conversational intent classifications, and entity extractions (such as order numbers, reservation dates, confirmation codes, or customer questions) required to complete call tasks.
C. CRM & Database Integration Data
Information fetched dynamically from client internal databases or CRMs (such as Salesforce, Zendesk, or custom SQL endpoints) to answer caller inquiries in real time. This data is processed transiently in memory to formulate the agent's spoken response.
D. Account & Administrative Data
Full names, business email addresses, company names, telephone numbers, billing records, and authentication credentials provided when signing up for or administering MAYA.
4. How We Use Voice & Call Data
We process voice and customer data strictly for the following operational purposes:
- Real-time Call Execution: Converting caller speech to text, understanding intent, executing database lookups, and generating natural spoken responses with low latency.
- Human Escalation: Seamlessly passing caller context, summaries, and transcripts to human support agents when a live transfer is triggered.
- Quality Assurance & Auditing: Providing our business clients with call logs, latency metrics, and performance analytics in their administrative dashboard.
- Fraud Prevention & Security: Detecting telephony abuse, denial-of-service attempts, and unauthorized access.
5. AI Training & Model Policy
Our Zero-Training Commitment
We do not sell customer data or caller information. We do not use customer proprietary call audio, voice recordings, caller transcripts, or confidential database data to train, fine-tune, or improve generalized public artificial intelligence models without explicit, written contractual consent from the client.
Customer data remains completely isolated in private, tenant-specific boundaries.
6. Retention & Audio Purging
We believe data should not be retained longer than required for business operations or legal compliance:
- Configurable Audio Purging: Clients can configure automated audio retention rules (e.g. immediate purge upon call completion, 7 days, 30 days, or custom schedules).
- Transcript Retention: Transcripts and metadata are retained according to the client's specified data retention policy.
- Account Termination: Upon termination of a client contract, all associated voice recordings, transcripts, and account data are permanently purged within thirty (30) days, except where retention is mandated by applicable law.
7. Security & Encryption Standards
We implement robust technical and organizational safeguards to ensure data confidentiality and integrity:
Encryption in Transit
All web traffic and API communications are secured using TLS 1.3 encryption. Telephony audio streams use secure SRTP and SIP-TLS wherever supported by telecom carriers.
Encryption at Rest
Stored recordings, transcripts, customer configurations, and database credentials are encrypted at rest using AES-256 with managed key rotation.
Access Control & RBAC
Strict role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege principles are enforced across our entire engineering environment.
Continuous Monitoring
24/7 security event monitoring, vulnerability assessments, automated dependency scanning, and centralized audit logging.
8. Subprocessors & Infrastructure
To provide MAYA, we partner with select third-party service providers (“Subprocessors”) who meet rigorous security and privacy requirements. These include:
- Tier-1 cloud hosting and compute providers (e.g., Google Cloud, AWS)
- Certified telecommunications carriers for global telephony trunking
- Low-latency conversational speech synthesis and recognition engines
- Security monitoring and error tracking services
9. International Data Transfers
If you access our Services from outside the jurisdiction where our servers are located, your data may be transferred across borders. We ensure all cross-border transfers comply with applicable data protection laws (including the European Union General Data Protection Regulation / GDPR) through Standard Contractual Clauses (SCCs) or adequacy decisions.
10. Your Privacy Rights
Depending on your geographic location and local privacy laws (including GDPR, UK GDPR, and CCPA/CPRA), you may have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete personal information.
- Request deletion or erasure of your personal data.
- Object to or restrict our processing of your personal information.
- Request a portable copy of your data in a structured, machine-readable format.
Note: If your personal data was processed during a phone call on behalf of one of our business clients, please direct your request directly to that business (the Data Controller). We will assist them in fulfilling your request.
11. Contact Our Privacy Team
If you have questions, comments, or requests regarding this Privacy Policy or our data protection practices, please contact us: