Act 01Data safety
Calls and data that stay on the right side of the rules
Brand Bakery's AI employees call only people who asked to be contacted, open every call by saying they are an AI and announce that calls are recorded. Outbound automated calls start only after they are declared to your telecom provider. Personal data is handled under the DPDP Act, with Brand Bakery as your processor under a written agreement.
On every call
- Calls only people who asked: a form, a portal enquiry, a missed call or a callback request
- Announces at the start of every call that it is recorded
- Tells callers it is an AI assistant at the start of every call
- Hands over to a person the moment a call goes past its written limits
- Logs every call and message, so you can see exactly what was said
Act 02TRAI
Automated calls, declared first
TRAI's September 2026 amendment treats calls placed by software, including AI voice agents, as their own category. They have to be declared to the telecom provider, from declared numbers, to people who enquired or consented.
Read the guide: TRAI's new rules for AI and automated calls: what your business needs to change
- Outbound automated calls start only once your declaration and calling numbers are in place with your telecom provider
- Promotional calls go out on the series your operator allots, never from a personal mobile SIM
- Every enquiry is kept with its time and source, so a callback inside the enquiry window can be shown to be one the person asked for
- No purchased lists and no cold calling, ever
- Inbound calls to the AI Receptionist need no declaration, and the same disclosure and recording rules still apply
Act 03DPDP Act
Your customers' data, handled for you
The Digital Personal Data Protection Act applies to every call and chat your AI employee handles. You decide what is collected and why; Brand Bakery processes it on your behalf.
Read the guide: DPDP rules and your website enquiry form: a practical checklist for small businesses
- A data processing agreement goes into every contract
- It collects only what the job needs, such as the questions a booking or a quote requires
- Recordings, transcripts and logs belong to you
- Each AI employee has its own credentials and only the permissions its job needs
Act 04WhatsApp
Official WhatsApp Business API only
WhatsApp runs through an official WhatsApp Business API provider. No unofficial tools that put your number at risk.
- Replies inside the 24-hour window that the customer opened
- Approved templates for anything sent after that window
- Bulk messages only to people who opted in, never cold
Act 05Your control
You stay in charge
Every AI employee works inside limits you set, and you can see everything it did.
Sensitive actions wait in an approval queue until a person on your team says yes
An audit log of everything each employee did, with heartbeats that show it is working
Written limits for what it may promise, discount ceilings and refund rules
This page is a plain-language summary of how we work, checked on 21 October 2026. It is not legal advice. Your telecom provider has its own onboarding steps, and your lawyer should review anything specific to your business.
Act 06Questions
The ones owners ask
Is AI calling legal in India?
Yes, when it follows the rules. Automated calls must be declared to your telecom provider and made from declared numbers, to people who enquired or consented. Calling purchased lists is what the rules target, and we do not do it. This is a plain reading of the rules, not legal advice.
Do people know they are talking to an AI?
Yes. Every call starts with the AI saying it is an AI assistant, and a notice that the call is recorded.
Who owns the call recordings and transcripts?
You do. Brand Bakery processes them on your behalf under the data processing agreement in your contract.
Can it call leads from an old list?
Only if you can show they agreed to be contacted, with a record of when and how. If the consent was never recorded, treat the list as unusable. We will not call it.
Does the AI Receptionist need TRAI registration?
Customers calling your number and reaching the AI Receptionist is inbound, so the outbound declaration rules are not the main concern. Disclosure, recording notices and the DPDP Act still apply, and it follows them.
20 minutes
Ask us the hard questions
Bring your compliance questions to a 20-minute call. Abhishek walks you through how calls, consent and data would work for your business before anything goes live.