# Data and privacy

> What Kheelona Voice keeps and what it never keeps, how long, where it is processed, and what you are responsible for.

Source: https://docs.voice.kheelona.com/policies/data-and-privacy/

Kheelona Voice is built for conversations with children, so it keeps as little as it can. This page lists what is kept
about the people who talk to the voices, and what your own team's accounts add.

## What Kheelona never keeps

**No audio and no conversation text is ever stored or logged.** That covers:

- what the person says, as sound and as text;
- what the voice says, as sound and as text;
- the text you send with `input.text`;
- the `instructions` you send for a session, in readable form.

Kheelona holds these only while the conversation is happening. Nothing readable is written to a database, a file or a
log, and the code that handles them is built to stop that happening by accident.

`instructions` are the one exception to "nothing is written". They wait for the connection to start in a short-lived
hand-off record, **encrypted** with a key Kheelona does not keep. The record is deleted within about two minutes. A copy
of it can remain, still encrypted and unreadable, in a database backup for up to 14 days.

## What Kheelona keeps

For each session, Kheelona keeps a record made of counts and times instead of words:

- **Who and how:** your partner and API key, your `end_user_ref` and `metadata`, the client kind, the transport, the
  voice and its version, the declared languages and the languages heard, and the session's settings, including whether you
  sent `instructions` and how long they were.
- **When and how long:** the times the session was created, connected and ended, and its duration.
- **How it went:** the number of turns and interruptions, response times, audio seconds, token counts, and counts of safety
  actions (by category) and errors (by code).
- **Each turn:** its timings, the language, a voice-energy level (low, medium or high), whether the speaker was laughing
  or interrupted, and any safety action with its category. No words.
- **Why it ended:** the reason.
- **The connection:** the IP address, the user agent and the web origin, if any, and the country and region the IP address
  comes from (see [Location](#location)).

A connection that is refused (for example a wrong or used client secret) is also recorded, with the IP address, the user
agent and the reason. Usage totals per day are kept for your invoices and your console.

### Location

Each session record holds the **country and region** of the connecting IP address, for example `IN` and `IN-KA`. They are
looked up in an offline database when the session is created and again when it connects, so no request leaves Kheelona to
find them and nothing about the person is sent to anyone. It is never an exact location: no city, no coordinates, only the
country and, where the database has one, the region. Regions are recorded for India only for now, so for a session
from elsewhere only the country is kept. An address that belongs to no place, such as a private network, has
none. The database is credited on the [Credits](https://docs.voice.kheelona.com/policies/credits.md) page.

With **server-to-server** sessions, where your server (or a toy's relay) creates and connects the session, the address is
your server's, so the location recorded is your server's, not the end user's.

The firewall in front of the service also logs each request with the country our cloud provider sees it coming from. See
the table below.

## How long it is kept

| What | What it holds | How long |
|---|---|---|
| Session and turn records | The counts and times above | 12 months. Whole months are removed at a time, so a record can stay about a month longer. |
| Country and region of a session | Two codes, from the IP address (see Location) | As long as the session record: 12 months, as above. |
| IP addresses in session and connection records | The address of the device | About 30 days in full. Within a day after that they are shortened to a `/24` (IPv4) or `/48` (IPv6) network: three parts or groups, not a single device. |
| Refused connections | IP address, user agent, reason. No content. | 12 months, with the IP shortened as above. |
| Firewall and network logs | IP address, user agent, country, the address requested. No content. | 30 days. |
| Daily usage totals | Counts per partner per day | 7 years. |
| Database backups | A copy of the records above | 14 days. A deleted record can stay in a backup that long. |
| Operational logs, traces and metrics | Timings, counts and labels. No conversation content. | Logs 30 days, metrics 15 days, traces 7 days. |

You can read your session records with `GET /v1/sessions` and `GET /v1/sessions/{id}`, and in your console. See
[Sessions](https://docs.voice.kheelona.com/concepts/sessions.md#what-kheelona-stores).

## Where it is processed

Processing happens in **India**: the voice, speech recognition, the safety checks, and the database, with one exception.

The step that writes the reply runs in **a US region of our cloud provider**, or, for voices set up to write replies in India, in the provider's
**Mumbai region in India**. If the service in India is unavailable, the reply is written in the US instead. To write a reply,
these are sent to whichever of those regions writes it:

- the text of the conversation so far, including words said while the voice is speaking and anything else the microphone
  picks up, such as someone else in the room;
- a short note on how each spoken turn sounded, for example its energy and whether the speaker was laughing (never the
  audio);
- your `instructions`, including any personal detail you put in them, such as a child's first name.

The provider states that this service does not store these and does not use them to train models. It returns the reply
text, which is spoken in India. A reply written in a US region adds a little time. A voice set up to write replies in India
can start a little sooner or later than the others, depending on how it is set up. See [Latency](https://docs.voice.kheelona.com/concepts/latency.md).

## What you are responsible for

- **Consent.** Get the consent you need from your users, including a parent's approval for children, and tell them that
  conversations are handled by AI services.
- **`instructions`.** Put in only what the voice needs. They are processed in the region above, so for a voice that uses a US
  region, or whose reply falls back to the US because the service in India is unavailable, a first name or an age band
  leaves India.
- **`end_user_ref`.** Use an opaque ID of your own, such as a random string. Never a name, an email address or a phone number.
- **`metadata`.** It is stored, so keep personal data out of it.
- **What you receive.** Kheelona keeps no conversation, so the captions and text you receive are the only copy. What you
  store, and for how long, is your responsibility. See [Captions](https://docs.voice.kheelona.com/guides/captions.md).
- **Your own logs.** Keep conversation text and `instructions` out of your server logs.

## Team accounts (console users)

The people on your team who sign in to the console are not end users, and a different record applies to them:

- their sign-in details, including the email address they sign in with;
- an audit log of what they and your API keys do in the console and the API (what changed, when, from which IP address
  and browser), kept **24 months**, with the IP address in full;
- request logs of the documentation and console websites, which are served worldwide, kept 30 days in a US region.

## Questions

For anything this page does not answer, or to ask about your records, write to the Kheelona team at
[apoorva@kheelona.com](mailto:apoorva@kheelona.com).