Rubricon handles two very different kinds of data: the few details you give us through this website, and the call recordings a customer asks us to process. They are covered separately below, because our role and our obligations differ.
Last updated 1 September 2026
Rubricon builds voice AI agents and call-quality software. We are based in Gurgaon, Haryana, India. For any question about this notice, or to exercise a right described in it, write to [email protected]. That address also reaches the person responsible for grievances under India's Digital Personal Data Protection Act, 2023.
The site is static HTML. It sets no cookies, loads no third-party fonts, and carries no advertising and no cross-site tracking. Nothing is stored in your browser by us.
We do use Cloudflare Web Analytics to count page views. It is
served by our host, Cloudflare, from static.cloudflareinsights.com, and
it is cookie-free: it does not fingerprint your device, does not
build a profile of you, and cannot follow you to other sites. What it reports is
aggregate — pages viewed, referrer, country, browser and device type — and we cannot
identify you from it. It is the only third-party script the site loads.
The only personal data the site collects is what you type into the contact form: your name, email address, company and message. It is delivered to our own inbox through a transactional email provider and is used to reply to you and to keep a record of the enquiry. We do not sell it, and we do not add it to a marketing list without asking you first.
Our host keeps standard server logs, including IP addresses, for a short period for security and abuse prevention.
Legal basis, where the GDPR applies: our legitimate interest in responding to business enquiries. Under the DPDP Act, you provide this data voluntarily for the purpose of being contacted.
We keep enquiry emails for as long as the conversation is live and for up to 24 months afterwards, then delete them. Ask sooner and we will delete sooner.
When a customer engages us, they remain the controller — the data fiduciary under the DPDP Act — of the call recordings, transcripts and related records. Rubricon acts as a processor and works only on that customer's documented instructions. The specifics are set by the agreement and the data processing agreement signed with that customer, which take precedence over this notice.
Call audio frequently contains personal data spoken by the caller, and can contain special-category or otherwise sensitive detail. We treat all of it as sensitive.
Storage and processing are pinned to the region the customer's calls originate in, and are agreed in writing before onboarding. Where a model or infrastructure provider is used, we use its region-bound endpoint. Any cross-border transfer is a decision the customer makes, documented in the data processing agreement.
Retention is configured by the customer, per call type. Deleting a call deletes what was derived from it — transcript, embeddings and score — not only the audio. Backups age out on a defined cycle. On termination, data is returned or deleted at the customer's election.
We use a small number of providers to deliver the service, each under a written agreement with confidentiality and security obligations:
The current named list, with locations, is provided to customers before onboarding and is available on request from [email protected]. Customers are notified before a sub-processor is added.
TLS on every API and control path, SRTP for call media where the carrier supports it, and encryption at rest for audio and derived text. Access is role-based and least-privilege; access by Rubricon staff to customer audio is logged. Secrets are held in a managed secret store, and changes to scoring logic go through review and regression tests before release. No system is perfectly secure, and we will notify affected customers without undue delay if a breach affecting their data occurs.
Depending on where you are, you may have the right to access the personal data we hold about you, to have it corrected or erased, to object to or restrict its processing, to receive a copy in a portable form, and to complain to a supervisory authority.
If your data reached us because you called a business that uses Rubricon, that business is the controller and your request should go to them — we cannot identify you within their recordings on our own, and we act on their instruction. We will assist them in responding to you promptly.
For data you gave us directly, write to [email protected] and we will respond within 30 days.
The service is sold to businesses and is not directed at children. We do not knowingly solicit personal data from children through this website.
If this notice changes materially we will update the date above and, where the change affects customer data handling, tell affected customers directly.
Rubricon — Gurgaon, Haryana, India. [email protected]
