Data processing terms, in plain English.

1. 01

   We process on your instructions only

   Your instructions are what you configure (agents, campaigns, workflows, retention settings), what you send through the API, and what the agreement says. We use your customers’ personal data to provide the service you asked for, to keep it secure and to bill for usage, and for nothing else.

2. 02

   We do not train AI models on your data

   Graine does not use your customer data to train or fine-tune general AI models. A custom voice is made only from the recordings you give us for it. The speech and language providers an agent uses are listed on the Trust Center, you choose them agent by agent, and their own terms apply to what is sent to them. Some run model-improvement programs of their own: for example, we have not opted out of Deepgram's. Ask us before you choose a provider for calls that matter.

3. 03

   Subprocessors, and notice when they change

   Every subprocessor is listed with what it processes and where. We give you at least 30 days’ notice before we add or replace one. If you object on reasonable grounds we will work with you on it, and the agreement sets out what happens if we cannot agree.

4. 04

   Security that stays at least as strong as described

   We protect your data with the measures on the Trust Center and in the security overview. Each control there is marked Implemented or In progress, and we will not make the Implemented ones weaker.

5. 05

   We tell you within 24 hours of confirming a breach

   If we confirm a personal-data breach affecting your data, we tell you within 24 hours of confirming it, with what we know: what happened, which data, the likely consequences and what we are doing about it. That gives you what you need for your own duties, such as telling the Data Protection Board of India within 72 hours (DPDP Rules, Rule 7), or a supervisory authority under the GDPR.

6. 06

   We help you answer people

   When a person asks you for access to, correction of or erasure of their data, we help you answer. If a person whom one of your agents contacted writes to us instead, we pass the request to you and do not answer it ourselves. Today finding and exporting one person’s data is done with our team on your request; self-serve tools for it are being built.

7. 07

   We delete your data when you leave

   When the agreement ends, we return your data on request and delete it from live systems within 30 days of your written instruction. Copies in backups age out on our providers’ normal cycle. We keep only what the law requires us to keep, and tell you what that is: under India’s DPDP Rules, for example, personal data, traffic data and processing logs are kept for at least 12 months from the date of processing. One limit today: a working copy of call records, kept in a separate store of ours, is not removed by this.

8. 08

   We show you, not just tell you

   SOC 2 and ISO/IEC 27001:2022 are both in progress, and we do not hold a report or a certificate yet. Until we do, we give assurance in other ways: this Trust Center, our policies under a non-disclosure agreement, a completed security questionnaire, and a review of the architecture with the engineers who built it. We cooperate with a reasonable audit by you or an auditor you appoint, on notice. When our reports exist, we share them.

9. 09

   Where your data goes

   Personal data is processed in the places the subprocessor list shows, and where we have not confirmed a location with the vendor, the list says “On request”. If your law needs particular transfer terms, tell us when you request the agreement.

The agreement also covers liability, governing law, the order in which documents apply and how notices are given. It is not summarised here.