Privacy policy and data practices

1. Introduction and scope

This privacy policy explains how Bibha AI Inc. ("Bibha AI", "we", "us", or "our") collects, uses, discloses, and protects personal information when you use PeachDesk, our voice AI platform for designing, building, deploying, and operating AI voice agents.

This policy applies to:

Visitors of our website at https://peachdeskai.com and its subdomains.
Registered users and customers of the PeachDesk-hosted service at app.peachdeskai.com.
People whose personal data is processed by our customers through PeachDesk, such as callers who speak with a customer's voice agent.

PeachDesk is also available as a self-hosted deployment. Self-hosted deployments process data in the customer's own environment. We do not receive conversation content from self-hosted deployments unless the customer explicitly shares it with us, for example when reporting an issue.

By using our services, you acknowledge that you have read and understood this policy. If you do not agree with the practices described here, please discontinue use of our services.

2. Who is responsible for your data

The data controller responsible for your personal data is:

Bibha AI Inc.
3790 El Camino Real, Ste 853
Palo Alto, CA 94306, United States
Email: sales@bibha.ai
Website: https://peachdeskai.com

Where our customers use PeachDesk to process personal data of their own end users, callers, or clients, the customer acts as the data controller and we act as the data processor. For self-hosted deployments, processing takes place in the customer's own environment under the customer's control.

3. Data we collect

3.1 Data you provide

Account and identity data: name, email address, phone number, company name, job title, billing details, and login credentials (stored hashed).
Platform data: agent configurations, prompts, workflow definitions, knowledge base content you upload, voice configuration preferences, telephony configuration, and provider credentials you connect (stored encrypted).
Conversation data: call recordings, transcripts, and logs between your voice agents and the people they speak with, where recording is enabled.
Communications: messages you send us by email or through support and sales channels.

3.2 Usage and technical data

IP address, browser type, operating system, and device identifiers.
Pages visited, features used, timestamps, and referring URLs.
Error logs, performance data, and usage metrics for your account.

3.3 AI-generated data

Outputs produced by your voice agents, including spoken responses, transcripts, and summaries.
Analytics derived from processing on the platform.

3.4 Data from third parties

Data from third-party services you connect to PeachDesk, such as telephony providers, model providers, or business tools.
Payment verification data from our payment processors.

4. How we collect data

We collect data directly when you:

Create an account or register for the service.
Configure voice agents, upload knowledge base content, or connect providers.
Communicate with us by email, demo calls, or support requests.
Subscribe to marketing communications.

We collect some data automatically when you interact with our website and platform, through server logs and similar technologies (see Section 10). We receive data from third parties when you activate integrations or connect your own provider accounts.

5. Legal bases for processing

Where the General Data Protection Regulation (GDPR) applies, we process personal data on the following legal grounds:

Legal basis	Examples
Contractual necessity (Art. 6(1)(b))	Processing account data to provide the PeachDesk service; processing payment data for billing.
Legitimate interests (Art. 6(1)(f))	Product improvement, fraud prevention, security monitoring, and direct marketing to existing customers.
Consent (Art. 6(1)(a))	Marketing communications and optional cookies or tracking where required.
Legal obligation (Art. 6(1)(c))	Tax reporting and responding to lawful government requests.

Where we rely on legitimate interests, you may object to that processing at any time (see Section 11).

6. Why we process data

We process personal data to:

Provide, operate, and maintain PeachDesk, including building, deploying, and running your voice agents.
Create and manage your account, process payments, and provide support.
Improve the product: analyze usage patterns, debug, and optimize performance. We use anonymized and aggregated data for these purposes unless you opt in to broader usage.
Send transactional communications (account alerts, receipts, service updates) and, with consent or under legitimate interest, marketing communications.
Detect, prevent, and respond to fraud, abuse, and security incidents, enforce our terms, and comply with applicable law.

We do not sell your personal data. We share data only with the following categories of recipients:

7.1 Service providers

Cloud infrastructure providers that host the PeachDesk-hosted service.
Payment processors that handle billing.
Email and communication services we use to correspond with you.
Frontier model and speech providers that power the pipeline stages you route to them. When you bring your own provider keys (BYOK), your data is sent to those providers under your own agreement with them.
Telephony providers you connect, for example Twilio, Vonage, Plivo, Telnyx, Cloudonix, or Vobiz, to carry your calls.

Service providers process data on our behalf under contractual obligations to protect it. A current list of sub-processors is available on request at sales@bibha.ai.

7.2 Customer-directed sharing

When you deploy voice agents, data flows to the providers, tools, and end points you configure: the model providers for each pipeline stage, your telephony provider, and any third-party tools you integrate. For self-hosted deployments, this processing happens in your own environment.

7.3 Legal and regulatory disclosures

We may disclose data when required by law, regulation, legal process, or an enforceable governmental request, or to protect our legal rights, safety, or property.

7.4 Business transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the acquiring entity. We will notify you of any such change and the choices available to you.

8. International data transfers

Bibha AI Inc. is headquartered in Palo Alto, California, and our service providers operate in multiple jurisdictions. Your personal data may be transferred to, stored in, and processed in countries outside your country of residence.

For transfers of personal data from the EU/EEA to countries not recognized by the European Commission as providing adequate protection, we rely on Standard Contractual Clauses approved by the European Commission and on data processing agreements with appropriate safeguards. For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

Processing in the United States is governed by applicable US federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act. You may request a copy of the safeguards in place for international transfers at sales@bibha.ai.

9. Data retention

We keep personal data only for as long as needed to provide the service, meet legal obligations, and enforce our agreements.

Data category	Retention
Account data	For the duration of your account, then deleted or anonymized.
Agent configurations and content you upload	Until you delete them or close your account.
Call recordings, transcripts, and conversation logs	According to the retention window you configure per agent, with automated purge at the end of the window.
Usage and product analytics	Retained in aggregated or anonymized form.
Payment and billing records	As required by applicable tax and accounting laws.
Marketing consent records	For the duration of your consent.
Security logs	Kept for a limited period to investigate and prevent abuse.

In self-hosted deployments, retention is under your control in your own environment.

10. Cookies and tracking

Our website uses a small number of cookies and similar technologies. Our cookie policy explains what we use, why, and how to manage or disable them.

11. Your privacy rights

11.1 Rights under GDPR (EEA, UK, and Switzerland)

Right of access (Art. 15): request a copy of your personal data.
Right to rectification (Art. 16): correct inaccurate or incomplete data.
Right to erasure (Art. 17): request deletion, subject to legal retention requirements.
Right to restriction (Art. 18): limit processing in certain circumstances.
Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting prior processing.
Right not to be subject to automated decision-making (Art. 22): request human review of solely automated decisions that significantly affect you.

To exercise these rights, contact our Data Protection Officer at dpo@bibha.ai. We respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11.2 Rights under CCPA/CPRA (California)

Right to know: request the categories and specific pieces of personal information we hold, the sources, the purposes, and the categories of recipients.
Right to delete: request deletion, subject to certain exceptions.
Right to correct: request correction of inaccurate information.
Right to opt out of sale or sharing: we do not sell your personal information.
Right to limit use of sensitive personal information and right to non-discrimination for exercising your rights.

To submit a request, email sales@bibha.ai with the subject line "CCPA request". We verify your identity before processing and respond within 45 days.

11.3 Rights under US state privacy laws

Beyond California, a growing number of US states, including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon, have enacted comprehensive consumer privacy laws. Residents of these states have rights equivalent to those described in Section 11.2:

Right to know and access: confirm whether we process your personal data and request a copy of it.
Right to delete: request deletion, subject to certain exceptions.
Right to correct: request correction of inaccurate personal data.
Right to opt out of the sale of personal data and of targeted advertising or profiling: we do not sell your personal data (see Section 7).
Right to limit the use of sensitive personal information and right to non-discrimination for exercising your rights.
Right to data portability: receive your data in a portable format where the applicable state law provides for it.

To exercise these rights, contact our privacy contact at dpo@bibha.ai. Where state law gives you the right to appeal our decision on a request, you may appeal by replying to our response.

12. Children's privacy

PeachDesk is a business-to-business platform and is not directed to anyone under 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete it promptly. Contact us at sales@bibha.ai if you believe this has happened.

13. How we protect data

We apply technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction:

Encryption of data in transit.
Encryption at rest for provider credentials and webhook secrets you store on the platform.
Call recordings and transcripts stored in object storage the deployment controls, served through signed, time-limited URLs.
Access to internal systems limited to people who need it for their role.
Incident response procedures for security events.

For an overview of platform-level controls, see our security and privacy controls page. No method of transmission or storage is completely secure; please use strong passwords and report any suspected incident to sales@bibha.ai.

14. Data Protection Officer

We have appointed a Data Protection Officer who serves as our privacy contact. You can reach them at dpo@bibha.ai for GDPR and other data-protection questions, to exercise your rights, or to file a complaint about our data handling. For anything else about this policy, email sales@bibha.ai.

15. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. For material changes, we will notify registered users by email or a prominent notice on our website at least 30 days before the change takes effect. Non-material changes, such as formatting or clarifications, may be made without prior notice. The "Last updated" date above always reflects the most recent revision. Continued use of the services after an update takes effect constitutes your acknowledgment of the change.

16. Contact us

For questions, concerns, or requests about this policy or our data practices: