Privacy policy

1. Who we are

Tyvra is a product of GrayOpus Labs (“we”, “us”). Tyvra is a platform of AI agents that businesses use to answer and make phone calls, reply to WhatsApp messages, voice notes and emails, and carry out tasks such as booking appointments, verifying identity and updating customer records.

This policy explains how personal data is handled when you interact with a business through Tyvra, and when you visit tyvra.ai. Contact us about anything in it at hello@grayopus.com.

2. Our role, and the business’s role

When you call a business, message it on WhatsApp or email it, and Tyvra handles that conversation, the business is responsible for your personal data. Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), it is the Data Fiduciary: it decides what is collected and why.

We are its Data Processor. We process your data only on its instructions and under our agreement with it, and we do not use it for our own purposes.

That business’s own privacy notice also applies to you. If you have a question about how a particular business uses your data, you can ask it directly, or ask us and we will help.

For data we collect for ourselves, such as emails sent to us or the contact details of people at our business customers, we are the Data Fiduciary.

The legal basis for processing

A business that uses Tyvra processes your data either with your consent or for a legitimate use permitted by section 7 of the DPDP Act, for example because you contacted it and voluntarily gave the information needed to help you. We process emails you send us, and the contact details of people at our business customers, because they were given to us for that purpose.

3. What Tyvra processes

Phone calls

Your phone number, the number you called, the time and length of the call, the audio of the call, a written transcript, and the language you spoke. Calls may be recorded. To tell your voice apart from background speech, the system may analyse voice characteristics during the call; this is used only to run that call.

WhatsApp

Your WhatsApp phone number and profile name, the messages and voice notes you send, the replies sent to you, and delivery and read status. Voice notes are converted to text so the agent can understand them.

Email

If a business connects its email account to Tyvra, such as a Gmail or Google Workspace mailbox, the emails you exchange with it: your email address and name, the content of your messages and any attachments, and when they were sent. Section 5 explains how data from connected accounts is handled.

Voice on websites and apps

If a business puts a Tyvra microphone on its website or app, the audio you speak into it and its transcript, and anything you enter in the form it fills in.

What you tell the agent

Whatever you share so the agent can help you: for example your name, appointment preferences, the reason for your visit, an order or booking reference, or business registration details such as a PAN, GSTIN or CIN. Please share only what is needed.

Sensitive information

Some information handled through Tyvra is sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: health information you mention to a clinic, financial information such as bank or card details, and characteristics of your voice. The business that collects it is responsible for obtaining your consent. We process it only on that business’s instructions, and our systems are designed to mask card and identity-document numbers before conversation text reaches a language model.

Identity checks

If a business uses Tyvra to verify you, your mobile number and the one-time code sent to it by SMS or read out to you in a call back.

Results of the conversation

A summary of the call or chat, its outcome, any action taken (for example an appointment booked), suggested next steps, and quality scores used to review how well the conversation was handled.

People at our business customers

Names, work email addresses and phone numbers of the staff who use Tyvra, and a record of what they do in it. If a business records a person’s voice to create its agent’s voice, that recording and the voice model made from it, used only to speak for that business.

Consent for voices

A business may create an agent’s voice from a recording of a real person only with that person’s explicit consent, which the business must obtain and keep a record of. We do not create a voice from anyone under 18. The person can withdraw consent at any time by writing to the business or to us. We then stop using the voice, and delete the recording and the voice model within 30 days.

4. How the data is used

• To hold the conversation: understand what you say, answer you in your language, and speak or write the reply.
• To carry out what you ask, in the business’s own systems: book or change an appointment, look up an order, verify your identity, send you a confirmation.
• To hand the conversation to a person at the business when you ask for one or when the agent cannot help.
• To give the business a record of the conversation and to help it review and improve the quality of its service.
• To keep the service secure, detect abuse and repeated nuisance calls, and fix faults.
• To meet legal obligations.

We do not sell personal data, use it for advertising, or share it with data brokers.

5. Data from WhatsApp, Gmail and other connected services

Businesses connect Tyvra to the platforms they already use so its agents can talk to customers there. The same rule applies to every one of them: we use the data we receive from a connected service only to provide that feature to the business that connected it. We do not sell it, use it for advertising, use it to build profiles of you, or share it with anyone except the providers listed in section 7 who help us run the service.

WhatsApp (Meta)

Messages reach Tyvra through Meta’s WhatsApp Business Platform. We use the phone number, profile name, message content and voice notes received this way only to hold the conversation with the business you are messaging and to keep a record of it for that business. Messages are sent to you only by the business you are in contact with, and you can ask it to stop messaging you at any time, or tell us and we will pass it on. Meta’s own handling of this data is described in WhatsApp’s privacy policy.

Gmail and Google Workspace

When a business connects a Google account, Tyvra asks for permission to read the emails in the connected mailbox and to send and organise email from it. We use this access only so Tyvra’s agents can read customer emails sent to that business, reply to them on its behalf, and keep a record of the conversation for it.

Tyvra’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the email features the business has chosen to use.
• We do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with your notice.
• We do not use it for advertising, and we do not sell it.
• We do not use it, and do not transfer it to anyone, to create, train or improve any AI or machine-learning model.
• No person reads it unless: the business has explicitly agreed to that for specific messages, and we have recorded that agreement; it is necessary for security purposes, such as investigating a bug or abuse; it is needed to comply with the law; or it has been aggregated and anonymised and is used for our internal operations.

Emails retrieved this way are kept for the retention period in section 9. The business can disconnect Tyvra at any time, and the account owner can revoke access at myaccount.google.com/permissions. Once access is revoked, Tyvra can no longer read or send email from that account, and we delete the stored access token.

Other services

A business may also connect Tyvra to its own systems, such as a booking, CRM or billing system. We read and update those systems only to carry out what you ask during the conversation, and only with the access the business grants.

6. How the AI agents process your data

Your speech is converted to text, the text is sent to a language model together with information from the business (such as its prices, policies and available appointment times), and the reply is converted back into speech or a message.

Some of these steps run on our own servers. Others use the AI providers listed in section 7. Our systems are designed to mask numbers such as card, PAN and identity-document numbers before conversation text is sent to a language model.

The agent may make mistakes. Where it matters, the business sets it to ask for your confirmation before acting, or to pass the conversation to a person.

7. Service providers

We share personal data with these providers only so they can help us run Tyvra, under contracts that require them to protect it:

• Google Cloud: hosting, databases, storage of call recordings, AI language models (Vertex AI) and text-to-speech.
• Sarvam AI: speech recognition, speech synthesis and language models for Indian languages.
• Meta Platforms: the WhatsApp Business Platform, which carries WhatsApp messages.
• Google: the Gmail and Google Workspace APIs, when a business connects its email account.
• Twilio: sending one-time verification codes by SMS.
• Telecom carriers: carrying phone calls.
• Amazon Web Services: hosting the tyvra.ai website.

We also disclose information where the law requires it, for example in response to a lawful order from a court or government authority.

8. Where data is stored

We host Tyvra in Google Cloud’s India region where we can. Some providers, including Meta, Google and Twilio, may process data outside India to deliver their service. We do not transfer personal data to any country the Government of India has restricted.

9. How long it is kept

Each business sets how long its conversation data is kept. A business can ask us to delete its data sooner, and we delete it when our agreement with the business ends.

Indian law requires a record of processing activity to be kept for at least one year, even where the content of a conversation has been deleted sooner. That record shows when data was processed, not what was said, and we use it only to meet that requirement and to keep the service secure.

10. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data held about you and how it is used;
• have it corrected, completed or updated;
• have it erased, where it is no longer needed;
• withdraw consent you have given, without affecting what was done before;
• have a grievance about how your data was handled addressed;
• nominate someone to exercise these rights if you die or become unable to.

Where a business is responsible for your data, you can make these requests to it. You can also write to hello@grayopus.com and we will act on the request or pass it to the business, and tell you which. We acknowledge requests within 72 hours and respond within 30 days. If a request is complex we may need longer, and we will tell you why, but we always respond within the time the law allows. If you are not satisfied with the response, you can complain to the Data Protection Board of India.

11. How to have your data deleted

1. Email hello@grayopus.com with the subject “Delete my data”.
2. Include the phone number you called from or messaged on WhatsApp, or the email address you wrote from, and the name of the business, if you know it.
3. We may ask you to confirm the request from that number or address, so that nobody else can delete your data.
4. We delete your call recordings, transcripts, messages, emails and related records within 30 days and email you to confirm. Where a business is responsible for your data, we carry out the deletion with it.

We may keep a minimal record that a deletion took place, and anything the law requires us to keep, but we do not use it for anything else.

12. Security

Data is encrypted in transit and stored on cloud infrastructure that encrypts it at rest. Each business’s data is logically separated from every other business’s. Access is limited to the staff who need it to run and support the service, and actions taken by agents are logged.

If a breach affects your personal data, we will inform the business responsible and, as required by law, the Data Protection Board of India and you.

13. Children

Tyvra is a service for businesses and is not directed at children. We do not knowingly process the personal data of anyone under 18 for our own purposes. Where a business uses Tyvra to serve children, such as a clinic booking an appointment for a child, the business is responsible for obtaining verifiable consent from a parent or guardian as the DPDP Act requires.

14. The tyvra.ai website

The website sets no cookies, runs no analytics and has no forms. Like any website, it receives your IP address and browser details when you visit, through Amazon Web Services, which hosts it, and through Google Fonts, which supplies its typefaces (see Google’s privacy policy). We do not use this information to identify you.

15. Grievance Officer

For complaints or concerns about how your personal data is handled, contact our Grievance Officer at hello@grayopus.com with “Privacy” in the subject line. We acknowledge grievances within 72 hours and resolve them within one month of receiving them.

16. Law and language

This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and the rules made under it.

You can ask for this policy in Hindi or in any other language listed in the Eighth Schedule to the Constitution of India by writing to hello@grayopus.com.

17. Changes to this policy

If we change how personal data is handled, we will update this page and the date at the top. If a change is significant, we will tell the businesses that use Tyvra so they can inform you.