Data Processing Agreement

This agreement is between the customer company (the Data Fiduciary) and ClanHQ Private Limited, Amrapali Grand, Greater Noida 201306, Uttar Pradesh, India (the Data Processor), and forms part of the Terms of Service. It applies to personal data the customer puts into Gratio, under India's Digital Personal Data Protection Act, 2023 and its rules.

Data about the customer's employees and the people they invite: names, work emails, organisation details (department, location, manager, title, date of joining, birthday if provided), profiles, content and activity in Gratio, and the records needed to run it securely.

We process it only to provide Gratio, on the customer's documented instructions, which are these terms and the settings the customer chooses in Gratio.

The customer is responsible for having a lawful basis for the personal data it provides, for giving its people any notice the law requires, and for answering their requests, with our help.

• Process the data only for Gratio, never for our own purposes, never sold and never used to train AI models
• Keep it confidential; our staff are bound to confidentiality and see only operational details unless the law or the customer requires more
• Keep it secure: stored in Mumbai, India, encrypted in transit and at rest, each company sealed off in the database, permissions checked on our servers, staff using two-factor sign-in, and a log of every admin and staff action
• Help the customer respond to people's requests to access, correct or erase their data
• Tell the customer without undue delay after we become aware of a personal data breach affecting its data, with what we know and what we are doing, so it can meet its own duties

The customer agrees that we use these sub-processors, each under terms that protect the data at least as well as this agreement:

• Supabase (database, file storage and sign-in, Mumbai, India)
• Vercel (hosting)
• Resend (email)
• Razorpay (payments, when used)
• the AI provider the customer's Owner chooses, only while AI help is on, with names removed first

We will tell the customer before adding or replacing a sub-processor, and the customer may object.

When the agreement ends, we give the customer a copy of its data on request and then delete it, including files. Backups age out within 30 days. We keep invoices for 8 years as tax law requires, and a short record that the deletion happened.

We answer the customer's reasonable written questions about how we protect its data. Write to contact@gratiohq.com.

Grievance Officer, ClanHQ Private Limited. Email grievance@gratiohq.com.