Privacy Policy

01Who we are

Levrage AI Labs Private Limited (“Levrage”, “we”, “us”) is a company incorporated in India, with its registered office in Hyderabad, Telangana. We provide AI voice and chat agents, calling campaigns, follow-ups and analytics for businesses, together with Bob, our builder and operations copilot (together, the “Services”).

This policy explains how we handle personal data when you visit www.levrage.ai (the “Website”), contact us, or use the Services as a customer. It is written to meet our obligations under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and its rules.

02Our two roles

We handle personal data in two different capacities:

• For our own purposes (as a Data Fiduciary): information about Website visitors, people who contact us, and the account holders and users at our customers. This policy fully applies.
• On behalf of our customers (as a Data Processor): information about the people our customers call or message using the Services, such as their leads, candidates or end customers. Here the customer decides why and how that data is used, and their own privacy notice applies. We process it only on their instructions and under our agreement with them. If you received a call or message from one of our customers, please contact that business first; we will help them respond to you.

03What we collect

When you use the contact form

Your name, email address, company, mobile number with country code, the subject and your message. We use these only to reply to you and follow up on your enquiry.

When you visit the Website

Like any website, our hosting provider automatically records basic technical information for security and reliability, such as your IP address, browser type, the pages requested and the time of the request. If you play a sample call recording, the audio is simply streamed to your browser; we do not record anything about you from it.

Only if you allow it in the cookie banner, we also use analytics to see how the Website is used. See Cookies.

When you or your organisation uses the Services

• Account information: name, work email, phone number, company, role and login details.
• Billing information: billing contact, address, tax details and payment records. Card details are handled by our payment provider and are not stored by us.
• Customer content: what customers upload or generate, including contact lists, knowledge documents, agent instructions, call and chat recordings, transcripts, collected fields, messages and outcomes. We process this as a Data Processor (see section 2).
• Usage and device data: how the Services are used, logs, error reports and settings, so we can operate, secure and improve them.
• Conversations with Bob: the briefs, questions and changes you discuss with Bob, so it can build and operate your agents.

04Cookies

When you first visit, the Website asks before it sets anything that tracks you. Until you choose, and if you choose “Reject all”, only the essential cookie below is used. You can change your choice at any time with “Cookie settings” at the foot of every page; turning analytics off deletes its cookies.

Google processes this data as our service provider. We don’t use advertising cookies, we don’t set cookies on other websites’ domains, we don’t sell this data, and nothing in the table except the essential cookie is set before you choose.

05Data from Facebook, Instagram, Messenger and WhatsApp

A customer can connect its Facebook Page, Instagram professional account, Messenger or WhatsApp Business account to the Services. To do so it signs in with Meta and chooses what to share. We then receive, only through Meta’s APIs and only for the accounts it connects:

• The Pages, Instagram accounts, WhatsApp Business accounts and phone numbers the customer selects, their names and IDs, and the access tokens Meta issues for them.
• Messages and comments people send to those accounts, with the sender’s name or username as Meta provides it.
• The customer’s WhatsApp message templates and their review status.
• If the customer connects them, answers submitted to its lead forms and the spend on its ad campaigns.

We use this data only to provide the Services to that customer: so its AI agents can reply, its team can see and answer conversations, and it can keep records and see results. We do not sell it, use it for advertising, or use it to train AI models offered to others, and we share it only as described under “Who we share it with”. Our use of data received from Meta also follows Meta’s Platform Terms and Developer Policies.

A customer can disconnect any of these accounts in the Services at any time, and anyone can remove “LevrageAI” from their Facebook account under Settings > Apps and websites. Either way we stop receiving data from that account and delete its access tokens straight away. To have data we already received deleted, follow our data deletion instructions.

06Data from CRMs, Google and other connected services

A customer can also connect other services to the Services. Each one asks the customer to sign in or provide a key and to approve what Levrage may access. We then access only the data the customer approves, only on its behalf:

• CRMs such as Zoho CRM, Salesforce, HubSpot, Pipedrive, Freshsales, Close, GoHighLevel and Odoo: contacts, leads and deals the customer chooses to sync, and the call and chat outcomes we write back.
• Google: Gmail, to send the emails the customer’s agents send and, if connected, to read replies; Google Calendar, to check availability and book meetings; Google Sheets and Drive, for the sheets and files the customer selects; Google Ads and Google Business Profile, for lead form submissions and campaign spend.
• Microsoft Outlook Calendar, to check availability and book meetings.
• Lead sources such as LinkedIn lead forms, IndiaMART, website forms and webhooks (for example Zapier): the leads they send.
• Stores and payments such as Shopify, Razorpay and Stripe: orders, checkouts, customers, products and payment status.
• Telephony and messaging such as Exotel, Knowlarity, SIP carriers, Telegram and email accounts: the calls and messages they carry.

We use this data only to provide the Services to that customer, as it configures them. We keep the access credentials these services issue only to act for the customer, and stop using them when it disconnects. A customer can disconnect any service in the Services or revoke access in that service’s own settings.

Google user data

Levrage’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features the customer turned on. We do not sell it, use it for advertising, or use it to develop or train generalised AI or machine-learning models, and people at Levrage do not read it unless the customer asks us to, it is needed for security, or the law requires it.

07Connecting Levrage to AI assistants

A customer can connect its Levrage account to an AI assistant such as Claude, ChatGPT or Gemini through our connector at mcp.levrage.ai, so the assistant can work in the account on its behalf. When it does:

• Signing in: the customer enters a Levrage API key on our Connect Levrage page. We store that key encrypted and give the assistant its own access token, which we keep only as a one-way hash. Access tokens last one hour and are renewed while the connection is in use; an unused connection lapses after 90 days.
• What we receive: only the requests the assistant sends to Levrage, such as listing agents, saving an agent’s instructions or adding leads, each with the details that action needs. We do not receive or store the customer’s conversation with the assistant.
• What we return: data from the customer’s own account that the request asks for, such as agents, call summaries and transcripts, leads and reports. The assistant’s provider processes it under its own terms and privacy policy, which the customer accepted with that provider.
• Logs: we keep basic operational records (which action ran, when, and whether it failed) for security and support, as described under retention below.
• Disconnecting: the customer can remove the connector in the assistant, or delete the API key in Levrage, which ends every connection that used it at once. Connections that used a deleted key stop working within a minute, and their stored tokens are erased when they expire.

Personal data of the people a customer calls or messages, such as its leads, is handled as described in section 2, with the customer deciding how it is used.

08How we use it

• To reply to enquiries and arrange demos or calls you ask for.
• To create and manage accounts, provide the Services and give support.
• To bill for the Services and keep financial records.
• To keep the Website and Services secure, prevent fraud and abuse, and fix problems.
• To improve the Services, using aggregated or de-identified information where we can.
• To send service messages, and product updates you can opt out of at any time.
• To meet legal obligations and enforce our Terms of Service.

We process personal data on the basis of your consent (for example, when you submit the contact form) or for legitimate uses permitted by the DPDP Act, such as providing a service you asked for or complying with law. We do not sell personal data.

We do not use customer content to train general-purpose AI models that are offered to other customers. We use customer content only to provide the Services to that customer, as their agreement with us allows.

09Who we share it with

We share personal data only as needed to run the Website and Services, with:

• Service providers who work on our behalf under contract, including cloud hosting, email (Zoho Mail delivers contact form messages to our team), payment processing, customer support tools, speech, language and AI model providers that power transcription, understanding and voice, and, only with your consent, Google Analytics for the Website.
• Telephony and messaging providers that carry calls and messages for customers, such as Exotel, Knowlarity, SIP carriers and Meta (WhatsApp, Facebook, Messenger and Instagram), when a customer connects them.
• Services a customer connects, such as its CRM, Google account, store or payment provider, as the customer directs (see “Data from CRMs, Google and other connected services”).
• Authorities when the law requires it, or to protect the rights, safety and property of Levrage, our customers or others.
• A successor if Levrage is involved in a merger, acquisition or sale of assets, subject to this policy.

10International transfers

We are based in India, and some of our service providers process data in other countries. When personal data is transferred outside India, we do so only to countries not restricted by the Government of India under the DPDP Act, and with contractual safeguards that require providers to protect it.

11How long we keep it

We keep personal data only as long as we need it for the purposes above:

• Contact form enquiries: for as long as needed to respond and follow up, then deleted.
• Account and billing records: for the life of the account, and afterwards as tax and accounting laws require.
• Customer content: for as long as the customer’s settings and agreement specify, and deleted or returned when the agreement ends.
• Technical logs: for a limited period for security and troubleshooting.

12How we protect it

We use reasonable security practices to protect personal data, including encryption in transit, access controls limited to people who need access, and monitoring of our systems. No system is perfectly secure; if a personal data breach occurs, we will notify affected people and the Data Protection Board of India as the law requires.

13Your rights

Subject to the DPDP Act, you can:

• Ask for a summary of the personal data we hold about you and how we process it.
• Ask us to correct, complete, update or erase your personal data.
• Withdraw consent you have given; this does not affect processing that already took place.
• Nominate someone to exercise your rights if you die or become unable to.
• Raise a grievance with us, and then with the Data Protection Board of India if it is not resolved.

To use any of these rights, email us at support@levrage.ai. We may need to confirm your identity first. If your data was collected by one of our customers, we will pass your request to them.

14Children

The Website and Services are meant for businesses and are not directed at children under 18. We do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

15Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “Last updated” date, and tell customers about significant changes by email or in the Services.

16Contact and grievances

For privacy questions, requests or complaints, contact our Grievance Officer:

We aim to acknowledge grievances promptly and resolve them within the time the law requires.