Compliance, in plain words
Eight rules every call obeys.
These are not aspirations and they are not in a policy document nobody reads. They are enforced in the call flow and the dialer, which means Zimaao cannot be configured to break them, by you or by us.
- Enforced in
- The call flow, not the script
- Cannot be disabled
- Rules one, two and six
- Evidence
- On every call record
- 01
It says it is an AI in the first sentence of every call.
Inbound and outbound, in the caller language, before anything else is asked or offered. The line is part of the call opening and cannot be removed, shortened or buried. Every call record stores the moment it was spoken.
- 02
It asks before recording, and honours a no.
Consent is requested in plain words, not legal text read at speed. If the caller declines, the recording stops and the call continues on transcript alone, or ends if you have configured it that way.
- 03
Outbound lists are scrubbed against do-not-call registries.
Every outbound list is checked before the first call and again before each retry. Numbers on a national registry, on your own suppression list, or belonging to an account in dispute are removed, not skipped quietly.
- 04
It calls only inside permitted hours for the caller region.
Permitted windows are enforced in the dialer itself, using the caller region rather than yours. A list that would spill past the window waits for the next one. Public holidays are respected where they are defined.
- 05
If someone says do not call again, it stops and records the opt-out.
The opt-out is honoured on that call, written to the account, and applied across every campaign immediately. No confirmation call, no win-back attempt, no exceptions buried in a setting.
- 06
It hands over to a person whenever asked. No second ask.
There is no retention script, no "I can help with that too", and no requirement that the caller explain why. The transfer carries the summary so the caller does not start again from the beginning.
- 07
It never pressures, threatens or negotiates on payments.
The reminder script states the invoice and the amount, offers a payment link, and ends. It cannot imply consequences, cannot discuss legal action, and cannot agree a discount or a plan. A dispute ends the script and routes to a person.
- 08
Every decision it makes is logged and reviewable.
Intent, confidence, the action taken, the systems it read or wrote, and the reason for a handoff are all on the call record. If you cannot explain to a customer why a call went the way it did, we have not done our job.
A product that can be configured to refuse a human is not a product worth shipping.
Rules one, two and six have no off switch in the product. If a buyer needs them removed, we are the wrong supplier and we will say so on the first call.
How long anything is kept, and who decides.
Recordings are the most sensitive thing we hold, so the defaults are short and the controls are yours. Audio and text are stored separately, which means you can keep the transcript for a year and delete the voice in a week.
- Call recordings
- Default 90 days. Set anywhere from 7 days to 2 years, or off entirely
- Transcripts
- Default 12 months, kept separately from recordings so you can delete audio and keep the text
- Call summaries
- Kept with the customer record in your own system, under your own retention policy
- Payment details
- Never captured on a call. Payment happens on a link, away from the line
- Deletion
- Permanent when the window closes, including backups, within 30 days
- Export
- Recordings, transcripts and logs exportable at any time, in open formats
Who on your team can hear what.
Access is by role, set by you, and changed by you. Our own engineers have no standing access to your recordings, and any support access is time boxed and logged against a ticket you opened.
- Owner
- Billing, retention windows, user management and the rules configuration
- Supervisor
- All recordings and transcripts, the decision log, and handoff reports
- Agent
- Only calls handed to them, and only for as long as the issue is open
- Analyst
- Aggregated reports with caller identifiers removed, and no recording access
- Our engineers
- No standing access. Time boxed, logged, and only on a ticket you raised
Encryption and residency
The boring controls, stated anyway.
Nothing exotic here, and that is the point. Standard controls, applied consistently, with an audit trail you can read.
- Recordings and transcripts encrypted at rest with AES-256, and in transit with TLS 1.2 or above
- Call audio encrypted on the media path between your telephony provider and us
- Single sign-on and enforced two factor authentication on every account that can hear a recording
- Every access to a recording is logged with the person, the time and the reason
- Data residency in India by default, with other regions available on the Exchange plan
- Independent penetration testing, with the summary shared under NDA on request
Our compliance team will want to read all of this.
Good. Send them this page first, then ask us for the data processing agreement and the penetration test summary.