Data Processing Addendum
In force from 1 November 2026 · Naatchaal (OPC) Private Limited
The short version
- Your firm is the data fiduciary for what it puts in NaatOps. We are your data processor and act only on your instructions.
- We keep it secure, tell you about breaches without delay, give you 30 days' notice before adding a sub-processor, and help you answer people's requests.
- It applies automatically to every workspace. Write to us if you need a signed copy.
This summary helps you read the page. The full text below is what applies.
1. Scope
This Data Processing Addendum ("DPA") is part of the Terms of Service between Naatchaal (OPC) Private Limited ("NaatOps", "we") and the Customer. It applies to personal data in Customer Data that we process for the Customer when providing the Service ("Customer Personal Data"). It meets section 8(2) of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), which requires a data fiduciary to engage a data processor under a valid contract.
It applies automatically to every workspace. If the Customer needs a countersigned copy, write to us and we will sign it as it stands. If this DPA and the Terms conflict on data protection, this DPA wins.
2. Roles
The Customer is the data fiduciary for Customer Personal Data, and NaatOps is its data processor. Where the Customer itself processes personal data for its own clients, NaatOps acts as the Customer's sub-processor and the Customer is responsible for passing on the right terms to its clients.
The Customer is responsible for having a lawful basis for the data it puts into NaatOps, giving the notices the DPDP Act requires, and for the instructions it gives us.
3. Details of the processing
| Subject matter | Providing the NaatOps Service under the Terms |
|---|---|
| Duration | While the Terms are in force, and until deletion under section 10 |
| Nature and purpose | Hosting, storing, organising, displaying, sending and backing up data so the Customer can plan, test and deliver its projects; and, when the Customer turns them on, AI features, integrations and email notifications |
| Data principals | The Customer's staff and contractors; its clients' staff who use the client portal, open shared reports or sign off releases; and any other people the Customer writes about in its workspace |
| Personal data | Names, work email addresses, job titles, profile pictures, IP addresses, sign-off records, and any personal data in issues, comments, documents, test data, API requests and files |
| Sensitive data | The Service is not designed for health, financial account, biometric or children's data. The Customer should not put such data in it, or should mask it first |
4. Our commitments
NaatOps will, using commercially reasonable efforts:
- process Customer Personal Data only to provide the Service and on the Customer's documented instructions, which are the Terms, this DPA and the Customer's settings and use of the Service, unless Indian law requires otherwise (and then we will tell the Customer first unless the law forbids it);
- not sell Customer Personal Data, use it for advertising, or use it to train AI models;
- make sure everyone who can access it is bound to keep it confidential and only accesses it when needed to run, support or secure the Service;
- keep reasonable security safeguards in place, as section 8(5) of the DPDP Act requires (section 5 below);
- help the Customer respond to data principals who exercise their rights, mainly through the product's own export, edit and delete features, and pass on any request we receive directly within 5 working days; and
- give the Customer the information it reasonably needs to show it complies with the DPDP Act.
5. Security
Our safeguards include:
- HTTPS for every connection, and strict security headers;
- passwords stored as bcrypt hashes; API tokens and refresh tokens stored hashed; API client secrets encrypted with AES-256-GCM;
- role and project access checked on the server for every request, with optional two-step sign-in and single sign-on;
- an audit log of access changes, exports and token changes that owners can read;
- nightly database backups, kept for up to 30 days in storage separate from the live service;
- rate limits, an allowlist of attachment types, and a size cap on uploads; and
- access to production systems limited to the staff who need it, protected by strong authentication.
We may improve these measures over time but will not reduce the overall level of protection.
6. Sub-processors
The Customer agrees that NaatOps may use the sub-processors on the Sub-processors page. We bind each one by contract to protect the data at least as well as this DPA requires, and we remain responsible for them.
We will email workspace owners and update that page at least 30 days before we add or replace a sub-processor. If the Customer objects on reasonable data protection grounds, we will try to find a solution. If we cannot, the Customer may cancel and get a refund for the unused part of any prepaid period.
AI providers receive data only when the Customer has AI turned on. Owners can turn it off in Settings › Billing › AI.
7. Transfers outside India
The application and its database are hosted in India. Some sub-processors process data outside India, as listed on the Sub-processors page, including DeepSeek in China for AI features on the Free plan and trial. We will only transfer Customer Personal Data to countries the Government of India has not restricted under section 16 of the DPDP Act, and we will stop a transfer if a restriction is notified.
If the Customer is subject to other laws on international transfers, such as the EU or UK GDPR, write to us and we will discuss the additional terms needed.
8. Personal data breaches
If we become aware of a personal data breach affecting Customer Personal Data, we will tell the workspace owners without undue delay. We will share what happened, the data and people likely affected, what we are doing about it, and a contact person, and keep the Customer updated as we learn more, so that the Customer can inform the Data Protection Board of India and affected people within the time the DPDP rules require.
We will also report the incident to CERT-In where its directions require. Telling the Customer about a breach is not an admission of fault.
9. Information and audits
Once a year, or after a breach, the Customer may send us a reasonable security questionnaire, and we will answer it within 30 days. If the Customer reasonably needs more, for example because a regulator asks, we will agree on a review with at least 30 days' notice, during business hours, at the Customer's cost, and under confidentiality, in a way that does not expose other customers' data.
10. Return and deletion
Owners and admins can export all Customer Data at any time from Settings › Workspace, as CSV and JSON, and download any attached file.
When a paid plan ends the workspace moves to the Free plan and nothing is deleted, so the Customer keeps control of its data. When an owner deletes the workspace, we remove Customer Personal Data from the live service at once and from backups within 35 days. We keep paid GST invoices as the law requires.
If the Customer wants us to delete a workspace it can no longer reach, it can ask us in writing and we will do so within 30 days.
11. Liability
All liability under or in connection with this DPA, including for any breach of data protection law, is subject to the exclusions and the overall cap in section 14 of the Terms of Service, and counts towards that cap. It is not in addition to it.
As data fiduciary, the Customer is responsible for meeting its own duties under the DPDP Act, and for any penalty or claim that results from its instructions, the data it chose to put in NaatOps, or its settings, such as turning on AI or sharing a report link.