Privacy Policy

Andromeda Intelligence Private Limited

Effective date: 15 October 2026
Last updated: 15 October 2026

Privacy at a glance

Cygnus Voice uses artificial intelligence to answer and manage calls, take information, book appointments and carry out actions selected by a customer. Providing those functions requires us and our service providers to process live speech, text and other personal data.

Audio is not recorded by Cygnus Voice by default. Where an audio-recording feature is offered, a retained recording is created only after an authorised customer expressly requests or enables recording and the legally required participant notices and permissions have been obtained. Live audio processing and text transcription can still occur when recording is off.

We use text transcripts for evaluations, subject to the safeguards in Section 6. We do not use call audio or voice recordings for model training, fine-tuning, evaluations or other secondary product-improvement purposes. A customer's request to record a call does not change that prohibition.

We use product and website analytics to understand how the Services are used. We also use the infrastructure, AI, communications, payment and integration providers described below. A provider receives the information needed for its particular function, not automatically every category of data we hold.

Questions, privacy requests and complaints may be sent to support@andromeda-intelligence.com with the subject “Cygnus Voice Privacy.”

1. Who we are and what this Policy covers

Andromeda Intelligence Private Limited (the Company, we, us or our) operates Cygnus Voice. This Privacy Policy (the Policy) explains our handling of personal data in connection with the Cygnus Voice application, its associated websites, account administration, customer support, calls, browser-based tests and connected features (together, the Services).

Our principal business contact address is Hustlehub Tech Park, Sector 2, HSR Layout, Bengaluru, Karnataka 560102, India. Our registered office is Plot No. 59–62, Naubad Industrial Area, Bidar, Karnataka 585403, India. Contact details are also provided in Section 23.

A Customer is the person or organisation that configures or subscribes to a workspace. Authorised Users are the people the Customer permits to use it. Call Participants include callers, people whose calls are transferred, and people taking part in browser tests. Customer Data includes the information a Customer, its Authorised Users, Call Participants or connected services supply to or generate within the Services.

This Policy does not replace a Customer's own privacy notice, any applicable data processing agreement (DPA), or the independent policies of a service a Customer chooses to connect. It is a privacy notice, not a request to waive privacy rights. Using the Services, accepting our Terms of Service, or having a Customer account does not, by itself, provide every consent that a particular processing activity may require.

2. Our role and the Customer's role

For our own website, account, subscription, security, business-contact and legal-administration activities, we generally determine the purposes and means of processing and act as a controller or Data Fiduciary, where those concepts apply.

For Customer-directed call handling, contact management, appointment booking, knowledge-base retrieval and connected actions, the Customer generally determines why the data is processed. We normally process that Customer Data on its behalf as a processor or Data Processor, subject to the applicable agreement and lawful instructions. An organisation may itself be processing information for another organisation; our role then follows the applicable processing chain.

We do not treat our access to Customer Data as unrestricted permission to use it for our own purposes. The evaluation arrangements in Section 6 distinguish Customer-directed quality assurance from any separately authorised, Company-directed processing. The real circumstances and applicable law, not a contractual label alone, determine each party's role.

The Customer must provide appropriate notices to Call Participants and other affected people, establish a lawful basis for its activities, obtain necessary permissions, configure appropriate access and retention, and respond to requests for data it controls. This allocation does not remove obligations that the law imposes directly on us. A person may contact us even without a Cygnus Voice account; we will assist or coordinate with the relevant Customer where appropriate.

3. Personal data we collect and where it comes from

We collect information directly from you and Call Participants; from the Customer and its workspace members; from telephone networks and service providers; from connected accounts and customer-selected endpoints; and automatically when someone uses our websites or application. We also generate information such as transcripts, summaries, classifications, usage records and security events.

The information processed depends on the features enabled and the content supplied. A transcript or uploaded document may contain information about someone other than the person supplying it. Sensitive information may be present when a participant or Customer supplies it; Section 20 explains the restrictions that apply.

4. Why we process personal data

We process the relevant categories above to provide, administer and secure the Services: authenticate users; operate workspaces and agents; connect and transfer calls; respond to callers; maintain permitted call and contact records; retrieve authorised knowledge; book or cancel appointments; execute configured tools; deliver notifications; measure usage; and handle subscriptions, support and disputes.

We also process appropriate information to detect misuse, investigate faults and security incidents, comply with lawful requests and legal obligations, maintain necessary business records, and evaluate the quality and safety of the Services. Text evaluations are subject to Section 6, and analytics to Section 11. We do not use a general “service improvement” purpose to override the restrictions on audio, connected-service data protected under Section 10, sensitive information or Customer-controlled processing.

Where the GDPR or UK GDPR applies to processing for which we are a controller, the following describes the bases we use when their conditions are satisfied. These bases are not a claim that every jurisdiction recognises an identical set of legal grounds.

Where Indian law applies, we process data under the applicable requirements of the Information Technology Act and associated rules and the Digital Personal Data Protection framework, in each case to the extent in force and applicable. We do not rely on “legitimate interests” as a substitute for a permission or legal ground specifically required under Indian law. Additional conditions apply to sensitive or specially protected data.

Information marked necessary for a particular function must be provided for that function to work. Withholding it may prevent that function, but is not permission to penalise someone for exercising a statutory privacy right.

5. Live audio and optional voice recordings

5.1 Live processing is necessary for a voice service

Telephone carriers and our telephony and AI providers process live audio to connect the call, recognise speech and produce spoken responses. For browser tests, microphone audio is processed after the user grants the relevant browser permission and starts the test. Live audio processing can produce a stored text transcript even when no retained audio recording is requested.

A browser microphone permission, a subscription, an AI-interaction notice and permission to retain an audio recording are different things. None automatically substitutes for the others.

5.2 Recording is off by default and requires an express instruction

Cygnus Voice does not create retained audio recordings of calls by default. Where we offer a recording feature, we create such a recording only when an authorised Customer expressly requests or enables it for the applicable call or clearly identified set of calls, and the required notices, consents or other legal permissions are in place. Merely placing or receiving a call is not an instruction to enable recording.

The Customer is responsible for providing the applicable participant notice and obtaining any permission required for its recording. Its activation of a recording setting does not, by itself, establish the consent of every Call Participant. Where consent is required and has not been obtained, the Customer must not enable recording. Disabling future recording does not automatically delete a recording already lawfully created; deletion is addressed in Sections 14 and 15.

This Policy does not promise that recording is available on every plan or in every deployment. Before recording is offered, the feature must identify its purpose and applicable retention arrangements.

5.3 No training, evaluation or other secondary use of audio

We do not use call audio or voice recordings to train or fine-tune AI models, evaluate or benchmark models, improve models or products through secondary analysis, clone voices, create voiceprints for identification, target advertising, or build or sell datasets. We do not authorise our processors to use that audio or those recordings for these purposes.

An expressly requested recording is processed only to deliver and administer that requested recording service, such as securely storing it, making it available to authorised recipients, playing or exporting it at the Customer's direction, and deleting it, together with processing strictly necessary to protect that recording or comply with binding law. This limited processing is not permission to repurpose recordings for training or evaluations. Our text-evaluation permission in Section 6 does not extend to audio.

5.4 Provider processing is separate from a Customer playback recording

Telephony and AI providers may process transient audio buffers and maintain limited operational, security or legally required records under their applicable terms and data controls. We do not describe the Services as “zero data retention” or claim that every provider immediately erases every copy of audio or call-related information. A no-training commitment and disabling an optional recording feature are not the same as an approved provider-wide zero-retention arrangement.

We use provider settings and processing terms appropriate to the commitments in this Policy. Optional provider features that retain a completed call recording must not be enabled outside the authorisation described above. Customer-selected external recording systems, a participant's own recording device, and recordings made independently after a call is transferred are governed by the responsible party's notices and applicable law, not by an instruction from Cygnus Voice.

6. Transcripts, evaluations and AI improvement

6.1 Operational transcripts

We create and process text transcripts to conduct and document conversations, extract the information needed for a task, generate summaries, support authorised follow-up and show call information to the Customer. We also process transcript information during the call so the agent and its tools can respond in context. Transcripts and AI-generated conclusions may contain errors and should not be treated as verified statements by a person.

6.2 Text transcripts are used for evaluations

We use text transcripts, including selected excerpts and related text outputs or action results, for permitted evaluations of Cygnus Voice. Evaluations can check whether an agent understood a request, followed instructions, selected an appropriate tool, produced a reliable answer or summary, handled a booking correctly, and behaved safely. They can include automated checks, comparison of configurations or model providers, regression testing and review by authorised personnel.

An evaluation measures behaviour or quality; it is not, by itself, training or fine-tuning model weights. Evaluation findings may inform changes to prompts, instructions, workflows and safeguards, subject to the restrictions below. Evaluation does not include replaying voice recordings to assess models.

6.3 Purpose, authorisation and minimisation

For Customer Data we hold as a processor, evaluations take place only within the Customer's documented, lawful instructions and our applicable processing agreement. A Customer must ensure its participant notices and lawful basis cover the instructed evaluation. This Policy alone is not a blanket instruction or a substitute for participant consent where required.

We do not repurpose identifiable Customer-controlled transcripts for unrelated or cross-customer improvement merely because they pass through the Services. Such Company-directed use requires an appropriate separate authorisation, notice and lawful basis. Where possible, we instead use synthetic examples, anonymised information or aggregated findings. Information that can still be linked to a person, including coded or pseudonymised excerpts, remains personal data.

We limit evaluation material to what the particular check needs, remove or redact unnecessary identifiers and sensitive details where practicable, restrict access, and assign evaluation copies an appropriate retention period. Reviewers and evaluation providers may receive unredacted content only where it is necessary, authorised and lawful; we do not promise that every transcript is anonymous before any processing occurs.

We do not use transcripts under this Policy to train or fine-tune general-purpose AI models or permit a provider to do so on our behalf. A future proposal to introduce a different permitted text-data purpose would require appropriate notice and any necessary authorisation before that use. The prohibition on secondary use of call audio and recordings remains separate.

6.4 Restricted data and available choices

Connected-service data covered by Section 10 remains subject to those additional protections, including when it is incorporated into a transcript or tool result. Sensitive information and children's information are not eligible for general-purpose evaluation datasets merely because they appear in a transcript. A recorded instruction or evaluation label must not override a person's valid withdrawal, objection or deletion request.

Customers may contact us to discuss evaluation restrictions or instructions. Individuals may exercise the rights described in Section 21. Where we rely on consent, it can be withdrawn; where an applicable right to object exists, we will assess the objection under that law. Restrictions on optional improvement do not prevent processing necessary to provide a requested service, comply with binding law or maintain security on another valid basis. We do not promise an in-product evaluation toggle unless it is actually made available.

7. Automated actions, classifications and human oversight

The Services can generate summaries, infer the purpose of a call, assign groups or tags, and execute enabled actions such as checking a calendar, creating or cancelling a booking, calling a customer-selected endpoint, or transferring a call. A Customer's configured rules can also affect whether and how a call is answered. Inputs, outputs and action results can be personal data.

Customers must check permissions and supervise consequential uses. Our agents are not a substitute for a required human decision-maker, and the Services must not be used as the sole basis for decisions with legal or similarly significant effects on individuals unless the arrangement, safeguards and legal requirements for that use have been separately established. We do not use a person's voice to establish biometric identity under this Policy.

Where applicable law provides rights concerning automated decision-making, individuals can request information, contest an outcome, seek correction or request human involvement from the responsible Customer or from us for decisions we control. We will not misrepresent an AI inference as a confirmed fact or refuse a valid privacy request solely on the basis of an AI-generated assessment.

8. Service providers and the data they receive

We use service providers to perform defined functions. They may receive personal data necessary for those functions, subject to applicable contracts, permitted instructions, confidentiality and security requirements. Some providers also process limited information as independent controllers for matters such as their own legal obligations, network operations or payment compliance. The same provider can have different roles for different activities.

We describe recipient categories here so you can understand what information is disclosed and why. The category does not mean that every provider receives every type of data, or that every listed feature is enabled for every Customer. The separate Service Provider and Subprocessor Register identifies providers and their functions; Customers may request the current register and relevant processing-location information through our privacy contact.

Certain providers use authorised downstream subprocessors, such as carriers, infrastructure operators or text-to-speech services. Those arrangements remain subject to the applicable processing terms and the restrictions in this Policy. A provider's own service chain does not authorise secondary use of call audio or recordings.

We maintain the separate register as our material provider arrangements change. Where applicable law or a DPA requires subprocessor authorisation, advance notice of changes or an opportunity to object, we follow that process. We provide the provider identities and other information required by those obligations; describing categories in this Policy does not replace them. Customer-selected independent services and recipients are distinguished from subprocessors acting on our behalf.

9. Workspaces, integrations, actions and notifications

Workspace administrators and other appropriately authorised members can access and manage workspace information according to their permissions. This can include contacts, transcripts, summaries, agent configurations and connected services. An organisation's authorised use is governed by its own responsibilities and privacy notice. Joining or leaving a workspace does not automatically erase the organisation's lawful records.

Connecting an integration authorises the access shown in the connection flow. Where a connection is operated through an integration-management provider, that provider manages the connected-account credentials; Cygnus Voice also retains information such as the connection identifier, status and account label. Account sign-in credentials and customer-created webhook credentials have their own handling arrangements and should not be confused with those integration tokens.

Calendar functions process authorised calendar metadata and availability and transmit necessary booking details, which can include a caller's name, contact information, appointment time and notes. Other enabled tools transmit the selected parameters to the destination configured by the Customer. Relevant tool responses can be returned to our AI providers for processing and included in call results. Customer-supplied endpoint credentials are not intended to become model instructions or be disclosed to Call Participants.

Tests can have real effects. A browser test using a live calendar or webhook can send real personal data, create real appointments or change a connected system. Customers should use appropriate test accounts and synthetic data.

Disconnecting an integration stops future access through that connection, subject to operations already in progress and technical revocation processing. It does not automatically erase an appointment, sent email, SMS, exported file or other record already created in the destination system. Those records may need to be deleted with the responsible service or Customer.

Where enabled, summaries and booking notifications are sent to the recipients configured and authorised for the feature. Sending a summary by email or SMS creates a copy outside the call-history database. Customers must choose appropriate recipients and avoid including unnecessary sensitive information in notifications.

10. Additional protections for Google API data

Our handling of information received through Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data and developer policy.

We limit Google-derived information to permitted, clearly disclosed user-facing functions. We do not sell it, use it for advertising or creditworthiness, or use it to develop, train or improve general-purpose AI models. It is excluded from general-purpose or cross-customer evaluation datasets; the restriction also follows Google information copied into transcripts or tool results.

Transfers and human access occur only within Google's permitted exceptions and required permissions. Routine consent to this Policy is not permission for personnel to read a person's Google data. A business transfer remains subject to Google's specific prior-consent requirements. Customers can disconnect the integration and revoke access through Google; requests concerning copies held by us can be sent to our privacy contact. These restrictions prevail over any broader evaluation, disclosure or improvement language elsewhere in this Policy.

11. Cookies, similar technologies and analytics

We use essential browser storage and similar technologies to support authentication, session continuity, security, language and other requested preferences. Blocking essential technologies may prevent sign-in or other requested functions.

We use product and website analytics providers to understand how people reach and use our web surfaces and product, which features are useful, where errors occur, and how to improve navigation and reliability. Depending on the implementation and permitted choices, analytics can include page and feature interactions, referring pages, event times, browser/device information, network-derived information and cookie or other identifiers. Events associated with signed-in use may include a user or workspace identifier. Analytics is not automatically anonymous merely because names are omitted.

We limit analytics to information appropriate for those purposes. Call audio, voice recordings, full transcript text, knowledge-base document bodies, passwords, access tokens, payment credentials and unrestricted tool payloads are not approved analytics-event content. We apply appropriate collection restrictions and redaction to prevent sensitive content from being captured through event properties, page URLs or error information. This is separate from the necessary AI processing described above.

This version of the Policy covers product analytics, not session replay. We will not enable session replay on the Services without first providing an appropriate description of that processing and implementing necessary consent and sensitive-content controls. Session replay, where later introduced, must not be treated as permission to record microphone audio or telephone calls.

Where law requires consent for non-essential tracking, we obtain that consent before starting the relevant collection. You may decline or withdraw it through the privacy/cookie controls presented for the web surface, or contact us for assistance. Browser controls can also restrict cookies, but deleting a cookie may reset a stored preference and blocking cookies alone does not necessarily stop every form of collection. Declining optional analytics does not withdraw permissions needed for an explicitly requested call or account function.

We do not use analytics events or call content to create audiences for cross-context behavioural advertising under this Policy. Recognised opt-out preference signals, including Global Privacy Control, are honoured for the activities and jurisdictions where applicable law requires them. A signal concerning sale or advertising does not automatically disable essential processing.

12. Other disclosures and activities we do not undertake

We may disclose relevant information to authorised Customer recipients; service providers acting within the purposes described above; professional advisers under appropriate confidentiality obligations; competent authorities where legally required; and parties necessary to investigate abuse, protect rights, resolve a dispute or respond to a security incident. We assess the legal basis and scope of such requests and limit disclosure as appropriate. A broad possibility of litigation is not permission for unrestricted sharing.

In a proposed or completed financing, merger, reorganisation or sale, personal data may be reviewed or transferred subject to appropriate confidentiality, purpose limitations, applicable law and any required notice or consent. Connected-service data protected under Section 10 remains subject to those restrictions, and Customer Data remains subject to any applicable DPA.

We do not sell personal data or share it for cross-context behavioural advertising as those terms are defined by applicable US state privacy laws. We do not rent or sell call transcripts, recordings, contact lists or knowledge-base content to data brokers. Payment for a defined processing service is not permission for that provider to reuse Customer Data for its independent advertising or training.

We may use or disclose genuinely anonymised or aggregated information that cannot reasonably identify a person, subject to applicable law and source restrictions. Removing a name alone is insufficient. We do not try to re-identify information we maintain as de-identified except for a narrowly permitted purpose, such as verifying that the de-identification remains effective.

13. International processing and transfers

We operate in India and use providers with international infrastructure. Information may be processed in India, the United States and other countries where the relevant providers, their authorised subprocessors or Customer-selected recipients operate. Storage location, processing location, remote support access and a provider's place of incorporation are not necessarily the same. We do not promise India-only, EU-only or other exclusive data residency unless it has been specifically agreed and technically supported for the applicable Services.

Where applicable law restricts a transfer, we use an appropriate lawful mechanism and necessary supplementary measures. Depending on the circumstances, this may include an adequacy decision, relevant standard contractual clauses, a UK transfer instrument, or another permitted arrangement. We obtain consent where the applicable transfer rule requires it, rather than assuming that use of the Services provides blanket transfer consent.

Customers can request information about relevant processing locations and applicable safeguards through our privacy contact, subject to legitimate security and confidentiality limits. A Customer connecting an external account or endpoint must also assess transfers created by its own instructions.

14. Retention of different data categories

We retain personal data for the period necessary for its specified purpose, the applicable Customer instructions and agreement, and binding legal requirements. We consider the nature and sensitivity of the data, the feature used, account status, a valid deletion request, operational necessity, security risks and relevant legal limitation or preservation periods. We do not treat all data as having the same retention period.

A plan-specific, feature-specific or agreed retention period will be identified in the relevant arrangement or provided on request. A transcript-retention setting does not mean every associated billing record, contact, backup, evaluation copy or external calendar event is erased on the same date. Conversely, a duty to preserve limited records does not justify retaining every transcript or recording indefinitely.

When we must retain information after a valid deletion request, we restrict its use to the remaining lawful purpose and explain the applicable limitation where legally permitted. Provider-controlled security, payment or legal records may have independent retention periods. We do not promise immediate physical erasure from every backup or third-party system.

15. Deletion, export, cancellation and released numbers

Customers and Authorised Users can use the controls available to them or contact us for access, correction, export or deletion assistance. We verify authority and scope before disclosing or changing information. Some organisation-controlled records require the Customer's instructions rather than those of a departing member; this does not override an individual's statutory rights.

An account deletion, workspace deletion, subscription cancellation, integration disconnection and contact deletion are different actions. Cancellation or non-payment may restrict access and may lead to deletion under our terms and retention arrangements, but it does not necessarily erase all information immediately. Customers should obtain needed exports before access ends. These provisions do not suspend our obligation to respond to a valid privacy request.

Deletion can require removal from primary records, derived information, evaluation stores, search indexes and provider systems. We take the steps appropriate to the data and our role, and coordinate with the Customer and processors where necessary. Copies already sent to a Customer, email recipient, calendar or other independently controlled destination may require action by that recipient. We provide assistance and notify recipients where required by law.

If a telephone number is not renewed or is otherwise released, a provider may later assign it to someone else. The Customer should remove released numbers from its websites, account-recovery settings and business materials. We do not intentionally transfer the former Customer's workspace, call history or personal data to the new holder merely because the number is reassigned. Caller-ID information alone is not reliable proof of the caller's identity.

16. Security and access safeguards

We use technical and organisational safeguards appropriate to the information and risks. These include authenticated and permission-controlled access, workspace scoping, protection of credentials, verification of relevant provider requests, secure transport on supported managed connections, and restrictions on access to Customer content. We seek to minimise sensitive content in operational logging and use provider security controls appropriate to the feature.

We do not claim that ordinary telephone networks are end-to-end encrypted, that every integration is controlled by us, or that any system is immune from unauthorised access, human error, outages or loss. A provider's certification is not a certification of Cygnus Voice. Where a personal-data incident triggers legal or contractual duties, we investigate and provide required notifications and assistance within the applicable time frames.

Customers are responsible for safeguarding their accounts, selecting appropriate users and recipients, configuring minimum necessary tool permissions, securing their own endpoints and promptly reporting suspected compromise. Those responsibilities do not exclude our own obligations to protect the data we process.

17. Human access and support

Authorised Company personnel and appropriately bound service-provider personnel may access personal data where necessary to provide support, investigate an incident, operate the Services, satisfy legal duties or conduct a permitted text evaluation. Access must be proportionate to the task and subject to applicable confidentiality and access restrictions. Administrative support may involve privileged access to an account or workspace where appropriate; this is not permission for unrestricted staff browsing.

An expressly requested audio recording is not made available for routine quality-review or evaluation listening. Any access to it is limited by Section 5. Connected-service data covered by Section 10 is subject to its more specific human-access restrictions.

Do not include unnecessary sensitive information, passwords or full payment credentials in a support message. A screenshot or attachment sent to support becomes part of the information processed to resolve that request.

18. Communications and marketing choices

We send service communications such as verification messages, security notices, invitations, billing information and configured operational notifications. These may be necessary for the requested service or legal compliance. Customers control their own instructions for notifications to Call Participants and must have the required permissions.

Where we send promotional communications, we provide the legally required choice to decline or unsubscribe. You can also contact us to stop our direct marketing. Opting out of marketing does not stop a security alert, receipt or other necessary non-promotional message. We do not repurpose call content to market unrelated products to Call Participants under this Policy.

19. Children and age restrictions

Cygnus Voice accounts are intended for adults aged 18 or older, or the higher age needed to enter the applicable contract. The Services are not directed to children and are not intended for unsupervised collection of children's information.

A Customer whose callers or users include children must establish the applicable lawful basis, provide age-appropriate notices, obtain any required verifiable parent or guardian permission, and configure the service to meet the relevant restrictions. A business may not assume that every caller is an adult. We do not use children's information for advertising profiles or general-purpose evaluation datasets. Where we learn that information was processed without a required permission, we work with the responsible Customer to restrict, delete or otherwise remediate the processing as required.

A parent, guardian or other authorised representative may contact us about a child's information. Definitions and protections for children differ by jurisdiction; mandatory local protections prevail over an account's minimum-age provision.

20. Sensitive information and restricted uses

Do not provide more personal information than a function needs. Customers must not intentionally configure the Services to collect passwords, payment-card security codes, government identifiers, detailed medical records, biometric identification information or similarly sensitive data unless the particular use has been expressly approved, technically supported and made lawful under the applicable arrangement.

A participant may nevertheless volunteer sensitive information. We handle such information as protected content and apply applicable restrictions; its presence in a conversation does not authorise unrelated evaluation or advertising. Necessary consent or another special-category processing condition must be established where applicable. Contact us promptly where content requires restricted handling or deletion.

Nothing in this Policy states that the Services are certified for healthcare, financial or other regulated data, or that a required healthcare or sector-specific agreement has been executed. Customers must establish suitability and any required contractual and technical safeguards before such a deployment.

21. Your privacy rights

Cygnus Voice is operated by Andromeda Intelligence Private Limited, based in India. We process personal data in accordance with applicable Indian data-protection laws and any other mandatory data-protection laws that apply to the relevant processing. Your available privacy rights depend on the applicable law and our role in handling your information. The relevant rights, procedures and remedies apply according to the provisions in force at the time. Nothing in this Policy or our Terms of Service excludes or limits rights that cannot lawfully be excluded or limited.

Where applicable law provides them, you may have rights to receive information about processing; review, access or obtain a copy of your personal data; correct it; request deletion; restrict processing; receive portable data; withdraw consent; object to certain processing; opt out of sale, specified sharing, cross-context advertising or specified profiling; exercise rights concerning sensitive information; and challenge certain automated decisions or request human involvement. You may also have rights to grievance redressal, to act through an authorised representative, or to nominate another person in specified circumstances.

The categories described in Section 3 include identifiers, account and customer-record information, commercial and transaction information, internet/device activity, approximate location where derived, professional or business information, communications and audio information, and inferences. Sensitive information may be processed if supplied or necessary for an expressly supported function. Sources, purposes, recipient categories and retention criteria are described in Sections 3–4 and 8–14. We do not sell personal data or share it for cross-context behavioural advertising under this Policy, and we do not use sensitive information for unrelated profiling. We honour applicable opt-out signals as described in Section 11.

Send a request to support@andromeda-intelligence.com with the subject “Cygnus Voice Privacy Request.” Include the contact details and workspace or call context reasonably needed to locate the information. You do not need to create an account. Do not send a password, full payment-card number or unnecessary identity document. We may request proportionate verification and evidence of an agent's authority before releasing data or making a consequential change.

Where the Customer controls the requested information, we normally refer the request to it or coordinate a response under our processing agreement. We do not use that referral to avoid obligations imposed directly on us. We may protect other people's information, confidential security details or legally privileged material when responding, and explain any lawful refusal or partial response where permitted.

We respond within the time required by applicable law, communicate any permitted extension and its reason, and do not charge a fee except where the law specifically permits it. We do not discriminate or retaliate because someone exercises a privacy right. Withdrawal does not make earlier lawful processing unlawful; it may prevent a function that genuinely depends on that permission. Other lawful processing may continue only within its proper scope. An objection to direct marketing will be respected for that purpose.

Contact our designated Privacy / Grievance Officer in Section 23 about complaints. We address grievances within the applicable statutory period and any shorter period that governs the particular issue. Where applicable law provides a right to appeal a refusal, send the appeal to our privacy contact with “Privacy Appeal” in the subject; we handle it under the applicable requirements.

You may also complain to a competent data-protection or other authority where applicable law permits, including where you live or work or where an alleged infringement occurred. Contacting us is not a condition of exercising that right unless the applicable law requires it. Our location in India does not require you to give up any mandatory local privacy right or remedy.

22. Changes to this Policy

We may update this Policy to reflect changes to the Services, providers, processing practices or law. We update the date above and give additional notice where legally required or appropriate for a material change. We obtain new consent or another necessary authorisation before introducing a use that requires it.

An update does not retroactively convert an unauthorised recording, prohibited audio use or unrelated use of Customer Data into a permitted activity. It also does not remove a statutory right or override a more protective obligation in an applicable DPA without the required legal and contractual process.

23. Contact, privacy requests and grievances

Company: Andromeda Intelligence Private Limited
Service: Cygnus Voice
Privacy and support email: support@andromeda-intelligence.com
Telephone: +91 86606 83961
Principal business contact address: Hustlehub Tech Park, Sector 2, HSR Layout, Bengaluru, Karnataka 560102, India
Registered office: Plot No. 59–62, Naubad Industrial Area, Bidar, Karnataka 585403, India

Designated Privacy / Grievance Officer: Founder, Akarsh Ghale
Officer email: support@andromeda-intelligence.com
Officer telephone: +91 86606 83961

Please identify whether your enquiry concerns your own account, an organisation's workspace, a particular call, optional recording, transcript evaluation, analytics or a connected service. We use the information supplied with a request to verify it, locate the relevant data, respond and maintain a proportionate record of how it was handled.