Skip to content
VoltKit
Get Started
VoltKit

Data Processing Terms

Last updated: 7 October 2026

These terms apply when you (“the customer”) use VoltKit RTC in your own app, and they form part of the Terms of Service. You accept them when you create a VoltKit RTC project. They cover the personal data of the people who use your app (“your users”). Our own handling of your account data is described in the Privacy Policy instead.

1. Roles

Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act), you are the Data Fiduciary for your users' personal data: you decide why and how it is processed. We are your Data Processor: we process it only on your behalf, to provide VoltKit RTC. Where other laws apply to your users, such as the GDPR, the same split applies as controller and processor.

2. What we process

  • Purpose: carrying your app's live audio, video, screen sharing and chat between your users; running rooms, broadcasts and webhooks; measuring usage for billing, limits and analytics; and keeping the service secure.
  • Personal data: the identities and display names your app gives us; IP addresses and network details needed to connect; audio, video and screen content in transit; chat messages and their metadata; connection times and usage counters; and anything your app puts in room or participant metadata.
  • Duration: while your project exists, and afterwards only for the periods in the Privacy Policy's retention section.
  • Recordings: live audio and video are not recorded by default. If you turn on our optional, paid recording service for a project (when it is offered in your console), we record the sessions you choose and store the recordings for the period you choose, then delete them. Turning it on is your instruction to us, and you must have the consent described in section 3.

3. Your duties as Data Fiduciary

  • Give your users a notice of what personal data your app collects and why, and get their consent, or rely on another lawful ground, as the DPDP Act requires, before sending their data through VoltKit RTC.
  • Get verifiable consent from a parent or lawful guardian before processing the personal data of anyone under 18, and do not use VoltKit RTC for tracking, behavioural monitoring or targeted advertising directed at children.
  • Get any consent the law requires before recording, broadcasting or rebroadcasting your users.
  • Send us only the personal data needed: use opaque identifiers rather than real names, phone numbers or email addresses where you can, and keep sensitive data out of metadata.
  • Answer your users' requests to see, correct or erase their data and their grievances. We help where the request concerns data we hold (section 4).
  • Notify the Data Protection Board and your users of personal data breaches, as the law requires of a Data Fiduciary.

4. Our duties as Data Processor

  • We process your users' personal data only to provide VoltKit RTC, following your instructions given through the API, the SDKs, your project settings and your dashboard, and as the law requires.
  • We do not sell it, use it for advertising, or use it to build profiles of your users.
  • Only staff who need access to run and support the service get it, and they are bound to confidentiality.
  • We help you respond to your users' requests and to the Data Protection Board, for data we hold, when you ask us at contact@voltkit.in.
  • We give you the information reasonably needed to show that these terms are being met. Formal audits need a written agreement.

5. Security

  • Media and signalling are encrypted in transit (DTLS-SRTP for media, TLS for signalling and the API).
  • Access tokens are short-lived and signed; API secrets are stored hashed and shown to you only once.
  • Servers are reached only over encrypted channels, with access limited to the people who run them.
  • We keep security logs, as the law requires, to detect and investigate misuse.

6. Sub-processors and location

We use these sub-processors for VoltKit RTC:

  • Amazon Web Services: hosting of the RTC servers and databases, in the United States. We may add hosting providers and locations, including in India.

We will update this list at least 15 days before a new sub-processor starts handling your users' data, and bind each one to protections at least as strong as these terms. The DPDP Act allows transfers outside India except to countries the Government restricts; we will not transfer data to a restricted country.

7. Personal data breaches

If we become aware of a personal data breach affecting your users' data, we will tell you without undue delay, and in any case within 48 hours, with what we know: what happened, the data and users likely affected, and what we are doing. We will then keep you updated and help you meet your own duty to inform the Data Protection Board and your users.

8. Deletion at the end

When you delete a project, its keys stop working at once and its rooms close. Your users' data is then deleted or anonymised on the timetable in the Privacy Policy, except where the law requires us to keep it. Export anything you need before you delete a project.

9. General

If these terms conflict with the Terms of Service about your users' personal data, these terms apply. Liability is governed by the Terms of Service. For a signed data processing agreement, contact contact@voltkit.in.