Privacy Policy

Nidaa Technologies ("Nidaa", "we", "us", or "our"), operating the domain nidaa.io and associated applications, provides enterprise Voice-as-a-Service (VaaS), automated outbound dispatch, interactive voice response (IVR), Cash on Delivery (COD) confirmations, voice one-time password (OTP) verification, and multimodal ledger OCR extraction.

This Privacy Policy outlines the types of personal and organizational data we collect, our lawful bases for processing, how such information is secured, and your rights as a registered client, API consumer, or call recipient.

For clients and users residing in Algeria, processing conforms to Law No. 18-07 of June 10, 2018 relative to the protection of physical persons in the processing of personal data. For European and international operations, processing adheres to the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

To ensure absolute transparency regarding responsibilities under global data protection laws, Nidaa operates in two distinct legal capacities:

A. Data Controller: We act as the Data Controller for direct account registration details, corporate billing data, direct communications with our sales and technical support staff, and technical telemetry collected from visits to nidaa.io.

B. Data Processor: When our business clients upload recipient contact lists, customer ledgers, order records, or audio variable parameters to execute automated voice calls, Nidaa acts strictly as a Data Processor. The client remains the primary Data Controller responsible for obtaining lawful recipient opt-in and consent.

We collect information across distinct functional tiers to deliver and secure our voice telecom infrastructure:

We only collect and process personal data when permitted by applicable legal frameworks:

1. Performance of a Contract: Processing is essential to set up your account, terminate SIP voice calls, deliver OTP authentication tokens, and generate service billing.

2. Compliance with Legal Obligations: Telecommunications regulations require the retention of anonymized or pseudo-anonymized Call Detail Records (CDRs) for network integrity, fraud deterrence, and statutory lawful interception rules.

3. Legitimate Interests: Detecting telecom toll fraud, preventing illegal robocalling and harassment campaigns, securing our private WireGuard VPN gateways, and continuously training latency-optimization algorithms.

4. Consent: Where explicit consent is mandated by local law (such as opt-in marketing broadcasts, client recording notifications, or voluntary participation in preview AI voice models).

Nidaa does not sell, rent, or trade your data. We share information only with trusted enterprise partners who are bound by rigorous data processing agreements (DPAs):

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory retention laws:

- Client Account Data: Retained throughout the duration of active commercial engagement and archived for up to 5 years following account closure to satisfy corporate financial audit standards.

- Campaign Contact Lists: Stored within the client dashboard and retained until explicitly deleted or updated by the client.

- Call Audio Recordings: Retained according to client-defined lifecycle rules (defaulting to 30 days), after which they are permanently deleted from object storage.

- Multimodal Ledger OCR Images: Temporary image files uploaded from the mobile application are permanently destroyed within 7 calendar days after human verification and contact extraction.

- Telecommunications CDRs: Retained for 12 months in compliance with mandatory telecom fraud prevention and regulatory traceability requirements.

We apply defense-in-depth architectural safeguards to defend customer data against unauthorized access, destruction, or interception:

- Encryption in Transit: All dashboard interactions, API queries, and webhooks require TLS 1.3 with modern cryptographic cipher suites.

- Encryption at Rest: Databases, object storage buckets, and cached variable audio fragments are protected by AES-256 disk encryption.

- Isolated Telecom Tunneling: Cloud PBX servers communicate with local Algerian telecom hardware exclusively through authenticated, encrypted WireGuard VPN tunnels.

- Access Control & Auditing: Least-privilege role-based access control (RBAC), multi-factor authentication (MFA) enforcement for operational staff, and immutable access logging.

- Continuous Vulnerability Management: Automated dependency auditing, static application security testing (SAST), and regular system penetration testing.

Subject to the laws of your jurisdiction (including Algerian Law 18-07 and the GDPR), you hold fundamental rights regarding your data:

- Right to Access: You may request a complete export of the personal information we hold about you.

- Right to Rectification: You may correct inaccurate or incomplete profile and billing records directly through your dashboard.

- Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and related records. Please see our dedicated Data Deletion page for step-by-step instructions.

- Right to Restrict or Object to Processing: You can limit how we process specific subsets of data or decline non-essential telemetry.

- Call Recipient Opt-Out: If you are an individual end-user who received an automated voice notification from a company using Nidaa and wish to be permanently removed, you can submit your phone number to our Global Blacklist via contact@nidaa.io, ensuring no client on Nidaa can call your number.

We may periodically update this policy to mirror technological advancements, telecom regulatory changes, or new platform features. When changes are published, the "Last Updated" and "Version" timestamps at the top of this document will reflect the revision date.

Material alterations affecting your rights will be communicated through email notifications or prominent banners on the Nidaa Web Dashboard prior to their effective date.