Privacy Policy

This Privacy Policy explains how Questcorp Ltd, trading as Malakai, collects, uses, shares and protects personal data in connection with the Malakai website, platform, AI voice agent services, telecommunications functionality, APIs, integrations, customer support, billing and related services.

Malakai is an AI voice agent and automation platform. The Services may be used by businesses to configure AI agents, manage voice interactions, route calls, process transcripts, generate AI responses, connect workflows, use APIs and integrate with third-party systems. Because of the nature of these Services, personal data may be processed in a number of different ways, including through account administration, call handling, call recordings, transcripts, AI prompts, AI Outputs, usage logs, billing activity and support communications.

The Services are provided by Questcorp Ltd, a company incorporated in England and Wales with company number 13834909, whose registered office is at 16–18 West Street, Rochford, Essex, United Kingdom, SS4 1AJ. Questcorp Ltd trades as Malakai. In this Privacy Policy, references to Malakai, we, us and our mean Questcorp Ltd trading as Malakai.

This Privacy Policy applies where Malakai decides why and how personal data is processed, meaning that Malakai acts as controller. This will usually include personal data relating to Customers, authorised users, prospective customers, website visitors, business contacts, suppliers and people who contact us directly.

In many cases, however, Malakai processes personal data on behalf of its Customers. For example, where a Customer uses the Services to run AI voice agents, process caller information, store call recordings, create transcripts, upload knowledge-base materials, connect contact lists or trigger workflows, the Customer will usually decide why that data is processed and how the Services are configured. In those circumstances, the Customer will usually act as controller and Malakai will usually act as processor. That processing is governed by the Malakai Data Processing Addendum and the Customer’s own privacy notices.

This Privacy Policy should therefore be read together with the Malakai Terms of Service, Data Processing Addendum, Cookie Policy, subprocessor list and any additional privacy notices that may apply to particular features or services.

For the personal data covered by this Privacy Policy, the controller is:

Questcorp Ltd trading as Malakai 16–18 West Street Rochford Essex SS4 1AJ United Kingdom

Privacy contact: [PRIVACY EMAIL]

Support contact: [SUPPORT EMAIL]

If you are an authorised user of a Malakai Customer, or if you have interacted with an AI voice agent operated by one of our Customers, the relevant Customer may be the controller of your personal data. In that case, you should refer to that Customer’s privacy notice for information about how your personal data is used. Malakai may still process limited information as controller where necessary for its own purposes, such as service security, fraud prevention, billing, troubleshooting, compliance and protection of the Services.

If Malakai appoints a data protection officer, UK representative, EU representative or other privacy representative, their details will be made available at [INSERT LINK OR DETAILS].

The personal data we collect depends on how you interact with Malakai and how the Services are used. We may collect information directly from you, from the organisation you work for, from our Customers, from callers and end users, from third-party integrations, from payment providers, from telecommunications providers, from AI and speech processing providers, from analytics and security tools, and from publicly available or commercial sources.

When you create an account, administer a workspace or use the Platform, we may collect account and profile information such as your name, business name, role, work email address, telephone number, username, authentication credentials, account settings, user permissions and communication preferences. We use this information to create and manage accounts, authenticate users, provide the Services, manage permissions and communicate with you about the Services.

When you purchase Services, subscribe to a plan, buy Credits or request paid support, we may collect customer and billing information. This may include billing contacts, invoice details, payment status, Subscription details, Credit purchases, usage allowances, transaction references, tax or VAT information, payment-related metadata and commercial correspondence. Where payment cards or similar payment methods are used, full payment details will usually be processed by our payment provider rather than stored directly by Malakai.

When the Platform is used, we collect usage and technical information. This may include login history, user activity, feature usage, workflows, API calls, integration activity, Credit consumption, account configuration, audit logs, system events, error logs, device information, IP addresses, approximate location data and other technical metadata. This information helps us operate the Platform, maintain security, calculate usage, enforce technical limits, investigate issues and improve the Services.

Because Malakai provides AI voice agent and telephony functionality, the Services may also process voice, call and telecommunications data. Depending on how a Customer configures the Services, this may include caller and recipient telephone numbers, call times, call duration, routing information, call status, carrier information, recordings, voicemail content, transcripts, call summaries, opt-out information, complaint records and operational metadata. The content of a call may include whatever information the caller chooses to provide or whatever information the Customer has configured the AI agent to collect.

The Services may also process AI interaction data. This may include AI agent instructions, prompts, AI Outputs, model usage, speech-to-text outputs, text-to-speech outputs, conversation logs, workflow instructions, knowledge-base retrievals, call summaries, classifications, sentiment or intent signals where enabled, and related processing metadata. AI interaction data may include personal data where the prompt, response, call transcript, knowledge-base material or workflow contains information relating to an identifiable person.

Customers may upload or connect Customer Content to the Services. Customer Content may include call scripts, FAQs, knowledge-base documents, training materials, contact lists, CRM data, customer records, workflow data, uploaded files, business documents, emails, notes or other materials. Depending on the Customer’s use case, Customer Content may include personal data relating to callers, employees, prospects, customers, suppliers or other individuals.

When you visit our website or interact with our online materials, we may collect website and device data. This may include your IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, time spent on pages, cookie identifiers, analytics events and similar technical information. We use this information to operate and secure the website, understand how visitors use it, improve our marketing and measure the effectiveness of our communications.

When you communicate with us, we may process communications data. This may include emails, support tickets, chat messages, meeting notes, call notes, feedback, survey responses, demo requests and other correspondence. We use this information to respond to enquiries, provide support, maintain business records, improve the Services and manage our relationship with you.

We may also process marketing and business development information. This may include your marketing preferences, newsletter subscriptions, event attendance, campaign engagement, lead source, CRM notes and records of your interactions with our sales or marketing teams. We use this information to send relevant communications, manage commercial opportunities and understand the effectiveness of our marketing.

Finally, we may process compliance and security information. This may include access logs, audit trails, fraud indicators, abuse reports, blocked numbers, opt-out records, complaint records, security alerts, verification records, sanctions or screening results where applicable, and information required for legal, regulatory, tax, accounting, telecommunications, carrier or provider compliance.

We collect personal data in several ways.

We collect personal data directly from you when you visit our website, request a demo, create an account, administer a workspace, purchase Services, buy Credits, configure an AI agent, upload Customer Content, connect an integration, contact support, submit a billing query, subscribe to marketing communications, attend a meeting or event, complete a survey or otherwise communicate with us.

We may collect personal data from the organisation you work for where that organisation is a Customer, prospective Customer, supplier or business partner. For example, your employer may provide your name, email address and role so that we can create an account for you, add you as an authorised user, manage billing, provide support or communicate about the Services.

We may collect personal data from callers and other individuals who interact with AI voice agents, call flows or communications systems operated through the Services. In many cases, that information is collected on behalf of the Customer that has configured and deployed the AI voice agent.

We may also collect personal data automatically when the Services are used. This includes technical information generated by browsers, devices, APIs, integrations, telecommunications systems, AI processing systems, monitoring tools and security systems.

In addition, we may receive personal data from third parties. This may include payment providers, telecommunications providers, cloud infrastructure providers, AI model providers, speech recognition and voice synthesis providers, analytics providers, CRM providers, customer support providers, integration providers selected by Customers, public sources and other service providers that support our business or the operation of the Services.

We use personal data only where we have a lawful basis to do so. The lawful bases we rely on will depend on the purpose of the processing and the context in which the personal data is used. The UK GDPR requires organisations to identify a lawful basis for collecting and using personal data, and the ICO notes that privacy information should explain the lawful basis relied on.

We use account and profile data to create accounts, authenticate users, administer workspaces, manage permissions, provide Platform access and communicate with users about the Services. This processing is usually necessary for the performance of our contract with the Customer or is carried out for our legitimate interests in operating and securing the Platform.

We use customer and billing data to manage subscriptions, Orders, Credits, renewals, invoices, payments, tax records, refunds, service credits and commercial correspondence. This processing may be necessary for the performance of a contract, compliance with legal obligations relating to tax and accounting, and our legitimate interests in managing billing and recovering sums due.

We use Platform usage data to provide the Services, calculate usage, monitor Credit consumption, apply technical limits, investigate errors, maintain audit logs, troubleshoot issues, analyse performance and improve the Platform. This processing is usually necessary for the performance of the contract or for our legitimate interests in operating, maintaining and improving the Services.

We use voice, call and telephony data to provide AI voice agent and telecommunications functionality. This may include routing calls, enabling AI voice interactions, creating transcripts, generating call summaries, supporting opt-outs, monitoring performance, calculating usage, investigating complaints and complying with telecommunications or carrier requirements. Where this processing is carried out on behalf of a Customer, Malakai usually acts as processor. Where Malakai processes limited call or usage information for its own purposes, we rely on contract, legitimate interests or legal obligation, depending on the context.

We use AI interaction data to operate AI agents, process prompts, generate AI Outputs, provide speech recognition, provide voice synthesis, retrieve knowledge-base content, run workflows and support Customer configurations. Where this processing relates to Customer Content or caller interactions controlled by a Customer, Malakai usually acts as processor. We may also use limited AI interaction metadata as controller for billing, security, troubleshooting, abuse prevention, service monitoring and service improvement.

We use communications and support data to respond to enquiries, investigate support issues, manage incidents, provide technical assistance, maintain service records and improve our support processes. This is usually necessary for contract performance or for our legitimate interests in supporting Customers and managing our business.

We use website and analytics data to operate and secure our website, understand how visitors use it, improve user experience, measure marketing performance and develop our services. Some processing is necessary for the operation of the website, while other analytics or marketing-related processing may rely on consent or legitimate interests depending on the technology used and applicable law.

We use marketing data to send product updates, newsletters, event invitations and other communications about Malakai. We may rely on consent where required by law. In some business-to-business contexts, we may rely on legitimate interests, provided that you have the ability to opt out.

We use compliance and security data to protect the Services, detect misuse, prevent fraud, investigate suspicious activity, enforce the Terms of Service, comply with legal obligations, respond to lawful requests and protect Malakai, Customers, callers and third parties. This processing may be necessary for legal obligation or for our legitimate interests in maintaining secure, reliable and lawful services.

Where we rely on legitimate interests, those interests include operating and improving the Services, securing the Platform, preventing fraud and abuse, supporting Customers, managing our commercial relationships, recovering sums due, enforcing agreements, developing products and protecting our legal rights. We rely on legitimate interests only where we consider that those interests are not overridden by the rights and freedoms of affected individuals.

Where we rely on consent, you may withdraw consent at any time. Withdrawal of consent does not affect processing carried out before consent was withdrawn. It may also not affect processing that we carry out on another lawful basis.

Malakai’s Services may allow Customers to deploy AI voice agents that speak with callers, understand speech, generate responses, ask questions, route calls, book appointments, capture information, create summaries, trigger workflows and connect to third-party systems.

The personal data processed during a call will depend on how the Customer has configured the AI agent and what the caller says during the interaction. A call may include basic contact information such as a name, telephone number, email address or business name. It may also include the subject of the call, appointment information, customer queries, preferences, call recordings, transcripts, summaries, workflow outputs and other information provided by the caller or retrieved from a connected Customer system.

Customers are responsible for deciding whether and how they use call recording, transcription, AI summaries, outbound calling, contact lists, opt-outs, workflow automation and integrations. Customers are also responsible for ensuring that their use of the Services has an appropriate lawful basis and that callers receive appropriate information about how their personal data will be used. This may include call notices, privacy notices, consent mechanisms, opt-out options or other safeguards required by law.

Malakai does not generally decide the content of Customer calls, the wording of Customer scripts, the individuals to be contacted, the purposes for which caller information is collected, or the retention period selected by the Customer. Where we process that information on behalf of a Customer, we do so as processor and in accordance with the Customer’s documented instructions, the Terms of Service and the Data Processing Addendum.

Malakai may, however, process limited call-related data as controller where necessary for its own purposes. For example, we may process call metadata, usage volumes, routing logs, carrier information, error records, support records, fraud indicators, complaint records or opt-out information where necessary for billing, security, abuse prevention, troubleshooting, legal compliance, carrier compliance or protection of the Services.

AI systems are probabilistic, which means their outputs may not always be accurate, complete or consistent. Customers should ensure that AI Outputs, transcripts, summaries and workflow results are appropriately reviewed where they are used in important contexts. Customers should not configure AI agents to make decisions with legal or similarly significant effects on individuals unless appropriate safeguards are in place and the relevant legal requirements have been satisfied.

Customers may upload, generate, transmit or connect Customer Content through the Services. Customer Content may include personal data. Examples include contact lists, customer records, CRM entries, documents, scripts, FAQs, call recordings, transcripts, call summaries, workflow data, support information, uploaded files and information retrieved from Customer-selected integrations.

As between Malakai and the Customer, the Customer is responsible for determining the purposes and means of processing Customer Content. This includes deciding what data to upload, what information an AI agent should collect, whether calls should be recorded, whether transcripts should be created, what integrations should be connected, how long information should be retained and who should have access.

Where Malakai processes Customer Content as processor, Malakai will process it only in accordance with the Customer’s documented instructions, the Agreement, the Data Processing Addendum and applicable data protection law. Malakai will also use appropriate technical and organisational measures designed to protect Customer Content and will engage subprocessors in accordance with the DPA.

Individuals whose personal data is included in Customer Content should usually direct privacy rights requests to the relevant Customer. If Malakai receives a request relating to personal data we process on behalf of a Customer, we may refer the request to that Customer or act on the Customer’s instructions, unless we are legally required to respond directly.

The Services are not designed for the routine processing of special category data, criminal offence data, payment card data, government identity documents or other highly sensitive personal data unless this has been expressly agreed with Malakai and appropriate safeguards are in place.

Special category data includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, sex life or sexual orientation. Criminal offence data includes information relating to criminal allegations, offences, proceedings or convictions.

Customers must not intentionally upload, collect or process such information through the Services unless they have ensured that doing so is lawful, necessary, proportionate and permitted by the Agreement. Customers are responsible for configuring AI agents, scripts, workflows and knowledge bases to avoid collecting unnecessary sensitive information.

It is possible that a caller may voluntarily disclose sensitive information during a call. Where that happens in a Customer-controlled interaction, the Customer remains responsible for determining how that information should be handled and whether additional safeguards, deletion, restriction or notices are required.

We may use personal data to send marketing communications about Malakai products, services, updates, events, webinars, resources and related opportunities. In business-to-business contexts, we may contact individuals using their business contact details where permitted by law and where the communication is relevant to their role or organisation.

Where consent is required for marketing, we will seek consent. Where we rely on legitimate interests, we will only do so where we consider that our interest in promoting our services is not overridden by your rights and freedoms. You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us at [PRIVACY EMAIL].

Opting out of marketing does not prevent us from sending service, billing, legal, security or operational communications. Those communications are necessary for the administration and use of the Services.

We use cookies and similar technologies on our website and Platform. Some cookies are necessary to operate the website, keep sessions secure, remember preferences and provide Platform functionality. Other cookies and similar technologies may help us understand how visitors use our website, improve performance, measure marketing campaigns and personalise content.

Where required by law, we will ask for consent before using non-essential cookies or similar technologies. You can manage your cookie preferences through [COOKIE SETTINGS LINK] or through your browser settings. Further information about the cookies and similar technologies we use is set out in our Cookie Policy at [COOKIE POLICY LINK].

We share personal data only where necessary for the purposes described in this Privacy Policy, where required by law, or where the relevant Customer has instructed or authorised the sharing.

We may share personal data with cloud hosting and infrastructure providers that help us host and operate the Platform. We may share personal data with telecommunications providers and carriers where necessary to route calls, provide numbers, transmit messages, manage call connectivity, comply with carrier rules or investigate abuse. We may share personal data with AI model providers, speech recognition providers, voice synthesis providers and retrieval or processing providers where needed to deliver AI voice agent functionality.

We may share personal data with payment processors, billing providers, banks and financial systems to process payments, manage invoices, collect Fees, process refunds and maintain financial records. We may share personal data with analytics, monitoring, logging and security providers to understand usage, detect incidents, prevent abuse, secure the Platform and improve performance.

We may share personal data with customer support, CRM, email, communications and productivity providers to manage enquiries, support tickets, customer relationships, commercial communications and internal operations. Where a Customer enables an integration, we may share personal data with the relevant third-party service selected or authorised by that Customer.

We may also share personal data with professional advisers such as lawyers, accountants, auditors and insurers, and with regulators, courts, law enforcement agencies, public authorities or other third parties where required or permitted by law. In the context of a business sale, investment, financing, restructuring, merger, acquisition or similar transaction, we may share personal data with prospective purchasers, investors, advisers and other transaction participants, subject to appropriate safeguards.

Where Malakai uses subprocessors to process Customer Content on behalf of Customers, further details will be made available in our subprocessor list at [SUBPROCESSOR LIST LINK].

We do not sell personal data.

The Services may allow Customers to connect Malakai to third-party tools, systems and platforms, such as CRM systems, calendar tools, messaging services, workflow tools, databases or other business applications. When a Customer enables an integration, personal data may be transferred between Malakai and the relevant third-party service.

The Customer is responsible for deciding which integrations to enable and for ensuring that those integrations are lawful, appropriate and consistent with its own privacy obligations. The Customer is also responsible for reviewing the privacy and security practices of third-party services it chooses to connect.

Malakai is not responsible for the privacy practices of third-party integrations selected or authorised by a Customer. Once personal data is transferred to a third-party service, that service may process the data in accordance with its own terms and privacy notices, unless it acts as a processor or subprocessor under arrangements put in place by Malakai.

We are based in the United Kingdom, but some of our service providers, infrastructure providers, telecommunications providers, AI providers, support providers and other recipients may be located outside the United Kingdom or the European Economic Area. As a result, personal data may be transferred internationally.

Where required by applicable data protection law, we will use appropriate safeguards for international transfers. These may include adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or another lawful transfer mechanism.

Where we transfer personal data internationally as processor on behalf of a Customer, the relevant transfer arrangements will be addressed in the Data Processing Addendum and, where applicable, the subprocessor list.

You may contact us at [PRIVACY EMAIL] if you would like further information about the safeguards used for international transfers, where such information is required to be provided by law.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected. The specific retention period will depend on the type of data, the reason we collected it, whether we are acting as controller or processor, the Customer’s configuration, the terms of the Agreement, legal requirements, security needs and whether the data may be needed to resolve disputes or establish, exercise or defend legal claims.

Account information is usually kept for as long as the account remains active and for a reasonable period after closure so that we can manage account history, resolve disputes, comply with legal obligations and maintain business records. Billing, tax and accounting records are usually retained for up to six years, or longer where required by law. Support records are retained for as long as reasonably necessary to manage support history, investigate incidents, improve services and resolve disputes.

Usage logs, audit logs and security records are retained for periods appropriate to their purpose. Some logs may be kept for a short period for troubleshooting, while others may be retained for longer where needed for security, fraud prevention, compliance, billing or audit purposes.

Call recordings, transcripts, summaries and Customer Content are usually retained in accordance with the Customer’s settings, the applicable Order Form, the Terms of Service and the Data Processing Addendum. Customers are responsible for selecting appropriate retention periods for Customer-controlled content where the Services allow them to do so.

Marketing data is retained until you opt out or until we determine that the information is no longer reasonably required for marketing or relationship management. Legal, complaint and dispute records may be retained for as long as necessary to protect our legal rights and comply with legal obligations.

We may retain anonymised or aggregated information for longer periods where it no longer identifies an individual.

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction. These measures may include access controls, authentication, encryption, logging, monitoring, supplier due diligence, backup arrangements, internal policies, security testing, incident response procedures and role-based access controls.

The measures used may vary depending on the nature of the data, the risks involved and the Services being provided. No system can be guaranteed to be completely secure. Customers are responsible for keeping login credentials confidential, managing user access, configuring permissions appropriately, maintaining the security of their own systems and ensuring that connected integrations are secure.

If you believe that your account, credentials or data may have been compromised, you should contact us immediately at [SECURITY EMAIL OR SUPPORT EMAIL].

Depending on where you are located and how your personal data is processed, you may have rights under applicable data protection law. These may include the right to access your personal data, request correction of inaccurate personal data, request deletion of personal data, object to certain processing, request restriction of processing, request portability of personal data and withdraw consent where processing is based on consent.

You may also have the right to object to processing based on legitimate interests. Where you object, we will stop processing the relevant personal data unless we have compelling legitimate grounds to continue or the processing is needed for legal claims.

You can exercise your rights by contacting us at [PRIVACY EMAIL]. We may need to verify your identity before responding. Some rights are subject to legal conditions, limitations and exemptions, and we may not always be required or able to comply with a request in full.

Where your request relates to personal data that Malakai processes on behalf of a Customer, we may refer your request to that Customer or act on the Customer’s instructions. This is because the Customer will usually be responsible for deciding how to respond to rights requests relating to Customer Content or Customer-controlled call data.

The Services may involve automated processing. This may include AI-generated responses, speech recognition, transcription, summarisation, categorisation, call routing, workflow automation, knowledge-base retrieval, analytics and similar processing.

Malakai does not use personal data for solely automated decisions that produce legal or similarly significant effects on individuals unless this is expressly stated in a separate notice or agreed with the relevant Customer. Customers are responsible for assessing whether their configuration or use of the Services involves automated decision-making that requires additional transparency, human review, consent or other safeguards under applicable law.

AI Outputs may be inaccurate, incomplete or inconsistent. Customers should apply appropriate human review where AI Outputs are used in important business, legal, financial, employment, healthcare, eligibility, access, complaint-handling or similarly significant contexts.

The Services are designed for business use and are not directed at children. We do not knowingly collect personal data from children through our website or Platform for our own purposes.

Customers must not use the Services to knowingly collect personal data from children unless they have a lawful basis, have provided appropriate notices and have implemented appropriate safeguards. Where a Customer uses the Services in a context involving children, the Customer is responsible for ensuring that the use is lawful and appropriate.

If you speak with an AI voice agent, call system or communications workflow operated through Malakai on behalf of one of our Customers, the Customer will usually be responsible for deciding why and how your personal data is processed. The Customer may use the Services to record calls, transcribe conversations, generate summaries, collect information, route enquiries, update records or trigger follow-up actions.

Malakai may process your call data, recording, transcript and related information as processor for that Customer. You should therefore refer to the relevant Customer’s privacy notice for information about how they use your personal data, why the call is being recorded or transcribed, how long the information is kept and how you can exercise your rights.

Malakai may also process limited call-related information as controller where necessary for service security, fraud prevention, billing, troubleshooting, legal compliance, carrier compliance and protection of the Services.

If Malakai is involved in a merger, acquisition, investment, financing, restructuring, sale of assets, due diligence exercise or similar corporate transaction, personal data may be disclosed to potential purchasers, investors, lenders, advisers and other relevant parties.

Where this happens, we will take appropriate steps to ensure that personal data is protected and used only for purposes connected with the transaction, unless otherwise permitted by law.

If you have concerns about how Malakai handles personal data, please contact us at [PRIVACY EMAIL] so that we can investigate and respond.

You also have the right to complain to the UK Information Commissioner’s Office, which is the UK supervisory authority for data protection matters.

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom

Website: ico.org.uk

We may update this Privacy Policy from time to time to reflect changes to the Services, our business, technology, suppliers, data processing practices or applicable law.

Where changes are material, we will take reasonable steps to notify Customers, such as by email, Platform notice or website update. The updated version will apply from the effective date stated at the top of the Privacy Policy.

Questions about this Privacy Policy or Malakai’s handling of personal data should be sent to:

Questcorp Ltd trading as Malakai 16–18 West Street Rochford Essex SS4 1AJ United Kingdom

Privacy email: [PRIVACY EMAIL]

Support email: [SUPPORT EMAIL]