Does your bot actually work?

Yes! Arrowhead's bot has achieved up to 45%+ higher conversions than human agents, with some companies fully replacing their human agent teams with the bot.

Which languages do you support?

Arrowhead supports 10+ languages including English, Hindi, Tamil, Malay, Malayalam, Bengali and more. If a required language isn't currently supported, it can be added in under 3 weeks.

What happens if the bot cannot answer a question?

The bot won't hallucinate or make up an answer. If it doesn't know an answer, calls can be transferred live to a human agent or the customer can be informed that a human callback will be arranged.

What do you need to get the bot up and running and how long does it take?

All that's needed are call flows and call recordings. Arrowhead can deliver a fully customized bot in less than 2 weeks.

Can you integrate with our systems?

Yes — Arrowhead integrates with all major CRMs, dialers, and systems via custom APIs, and can build custom integrations for niche systems too.

Where does your data reside?

Arrowhead provides deployment options in Indian or Singaporean data centres depending on requirements.

Do you provide on-premise deployment?

Yes — on-premise deployment is available if required.

Arrowhead

Data Processing Agreement (DPA)

Under the Digital Personal Data Protection Act, 2023 (DPDP Act)

This Data Processing Agreement ("DPA") forms part of the Master Services Agreement / Terms of Use ("Agreement") between the Data Fiduciary and Arrowhead (the "Data Processor"). Except as modified herein, the Agreement remains in full force and effect.

1. Definitions

Unless otherwise defined herein, terms shall have the meaning assigned under the DPDP Act.

"Personal Data" means any data about an identifiable individual processed by the Data Processor on behalf of the Data Fiduciary.

"Sub-Processor" means a third party engaged by the Data Processor to process Personal Data on its behalf.

2. Scope and Purpose of Processing

The Data Processor shall process Personal Data solely for the purpose of providing the Services under the Agreement and in accordance with documented lawful instructions of the Data Fiduciary.

Nothing in this DPA shall grant the Data Fiduciary any rights in the Data Processor's underlying platform, models, software, tools, algorithms, or methodologies.

3. Categories of Personal Data

Details of Data Principals, categories of Personal Data, and nature of processing are described in Annex I.

4. Duration

Personal Data shall be processed for the duration of the Agreement, subject to retention provisions set out herein.

5. Obligations of the Data Fiduciary

The Data Fiduciary shall:

ensure lawful basis and valid consent under the DPDP Act;

provide required notices to Data Principals;

remain responsible for compliance with laws applicable to its business operations; and

communicate erasure, correction, or consent withdrawal requests in writing.

6. Obligations of the Data Processor

The Data Processor shall:

process Personal Data only on documented lawful instructions;

implement appropriate technical and organizational measures;

notify the Data Fiduciary if an instruction appears to violate applicable law;

provide reasonable assistance for Data Principal requests;

ensure personnel confidentiality; and

bind Sub-Processors to substantially similar obligations.

7. Use of Anonymized and Aggregated Data

The Data Processor may use anonymized and aggregated data derived from Personal Data for analytics, service improvement, benchmarking, security enhancement, and product development purposes, provided such data does not identify any Data Principal or the Data Fiduciary.

Outputs generated specifically for the Data Fiduciary from its Personal Data shall belong to the Data Fiduciary; however, the Data Processor retains ownership of the underlying software, models, algorithms, and analytical methodologies used to generate such outputs.

8. Sub-Processors

Sub-Processors listed in Annex III are authorized.

The Data Processor shall remain responsible for ensuring Sub-Processors comply with obligations substantially similar to those contained herein.

9. Cross-Border Transfers

The Data Processor shall comply with applicable cross-border transfer requirements under the DPDP Act, as applicable to Data Processors.

10. Security Measures

The Data Processor shall implement technical and organizational measures including:

access controls;

encryption in transit and at rest;

role-based access;

periodic security testing;

employee confidentiality training; and

multi-factor authentication.

11. Personal Data Breach

The Data Processor shall notify the Data Fiduciary without undue delay after confirming a Personal Data Breach affecting Personal Data processed under this DPA and provide reasonable assistance in investigation and regulatory notification.

Notification shall not imply admission of fault.

12. Audit

Upon reasonable prior written notice, the Data Processor shall provide information necessary to demonstrate compliance.

Audits shall be conducted no more than once annually, during business hours, and shall not disrupt operations.

Independent certifications may be provided in lieu of on-site audits where applicable.

13. Return and Deletion

Upon termination, the Data Processor shall return or delete Personal Data upon written request.

Deletion shall occur in accordance with the Data Processor's standard retention and backup policies.

Archival backups may be retained for a limited period as part of disaster recovery processes and shall remain protected.

14. Liability

The Data Processor's liability under this DPA shall be subject to the limitations of liability set out in the Agreement.

ANNEX I – Data Categories

Data Principals: Users designated by the Data Fiduciary.

Categories of Personal Data: Name, phone number, email, address, call recordings, transcripts, interaction data, and related metadata.

Purpose: Delivery of Services as per the Agreement.

ANNEX II – Technical and Organizational Measures

Access control and role-based permissions.

Encryption at rest and in transit.

Secure API integrations.

Regular security audits and monitoring.

ANNEX III – Sub-Processors

Sub-Processor Name	Description of Processing	Location
Amazon Web Services	Cloud hosting services	India or as per allowed cross-border transfer rules
Eleven Labs	Cloud based processing services	India or as per allowed cross-border transfer rules
Deepgram	Cloud based processing services	India or as per allowed cross-border transfer rules
Open AI	Cloud based processing services	India or as per allowed cross-border transfer rules
Groq	Cloud based processing services	India or as per allowed cross-border transfer rules