Legal
Privacy Policy
Effective 10 July 2026 · Version 1.0
1. Who we are, and the two roles we play
Whizz Pulse is operated by Whizz Tech, Office 218, Binghatti Azure, JVC, Dubai, UAE. Contact: support@whizztech.ai.
Whizz Pulse analyzes recorded customer-service calls that our customers — contact centers and BPOs — upload to it. It does not make, answer, or intercept calls. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the GDPR, we wear two hats:
- Controller — for the account data of our customers (the organizations using the dashboard and API).
- Processor — for the content of call recordings. The organization that recorded the call is the controller of the personal data inside it (its customers' voices and words, and its agents'); we process that data on their documented instructions. If you were a party to a recorded call, your first point of contact for access or deletion is the company you called — but you can also write to us and we will route the request and assist (see Section 7).
2. What we collect
From customers (organizations):
- Account data — email (one-time-passcode sign-in), organization name, plan and billing details.
- Configuration data — QA scorecards, criteria weights, retention settings, webhook endpoints.
- Usage data — API request logs, usage-metering records, job telemetry, and standard server logs (IP address, user agent) kept for security and billing.
Inside uploaded calls (processed for the organization):
- Call audio — the uploaded recording file.
- Transcripts — diarized text with speaker labels and word timestamps, in the call's language.
- Redaction records — which categories of identifier were scrubbed from the transcript (see Section 3).
- Analysis outputs — summary, sentiment, topics, pain points, predicted CSAT, escalation and churn risk, compliance flags, coaching suggestions.
- QA results — criterion scores, the verbatim transcript quotes cited as evidence, and review flags.
We do not run third-party advertising or analytics trackers on this site. Cookies are limited to what sign-in and language preference require.
3. PII redaction before analysis
Before any language model reads a transcript, deterministic code scrubs email addresses, payment-card numbers, and long digit strings (such as phone or account numbers) from the text, replacing them with placeholders like [CARD] and [NUMBER]. Analysis, QA scoring, and coaching all run on the redacted transcript. Redaction reduces the personal data exposed to models; it is not a guarantee that a transcript contains no personal data — names spoken in conversation, for example, remain part of the recording the customer chose to process.
4. How we use it
- To operate the service: transcribe, redact, analyze, and score the calls our customers upload, and deliver results via dashboard, API, and webhooks.
- To bill accurately: per-call usage metering and automatic refunds for failed jobs.
- To secure the platform: abuse prevention, rate limiting, audit logs.
- To communicate: sign-in codes and service notices.
We do not sell personal data. We do not use call audio, transcripts, or analysis outputs to train models — content is sent to our model providers solely to produce the customer's output, under API terms that exclude training use.
5. Retention — you control it
- Call audio, transcripts, and analysis — retained under the organization's control. Deleting a call removes its audio, transcript, and analysis together, via dashboard or API. Absent a configured retention window or a deletion request, this data is kept while the account remains active.
- Account data — kept while the organization is active; deleted within 30 days of account closure except records we must keep for legal or accounting reasons.
- Server logs — rotate within 90 days.
6. Subprocessors and hosting
We share data with these categories of subprocessor, each under a data-processing agreement:
- Cloud infrastructure — application hosting, call-audio storage (private buckets accessed via short-lived signed URLs), and model inference run on our cloud infrastructure provider in the United States. Primary region: Iowa, United States. Data-residency options for enterprise plans are scoped per contract, and this policy will name additional regions as they ship.
- Speech-recognition subprocessor — speech-to-text (transcription and speaker diarization) of uploaded call audio.
- AI analysis subprocessors — a primary frontier-model provider runs the analysis, with a second provider as a fallback lane. API-submitted content is excluded from training under each provider's API terms.
- Resend (United States) — transactional email: sign-in codes and service notices.
- Stripe — payment processing for paid plans; we do not store card numbers.
We will update this page before engaging a new subprocessor that handles personal data. The current list of subprocessors, by name, is available to customers on request at support@whizztech.ai. International transfers rely on appropriate safeguards, including standard contractual clauses where required.
7. Security
Call audio lives in private storage accessed only via short-lived signed URLs; API keys are stored hashed; webhook deliveries are signed so you can verify origin; transcripts are PII-redacted before model analysis; access to production systems is restricted and logged.
8. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, restrict, object to the processing of, or delete your personal data.
Customers: email support@whizztech.ai from your account address. Call participants (callers and agents on recorded calls): contact the company that recorded the call, or email us and we will forward the request to the responsible organization and assist with its completion. We respond within 30 days. If you believe a concern is unresolved, you may complain to your local supervisory authority.
9. Changes
We will post changes here and update the effective date. Material changes are announced by email to organization owners before they take effect.