1. Roles
The customer ("you") is the data fiduciary for personal data contained in uploaded registers, portal files and supplier contacts ("Customer Data"). Parakh Software processes Customer Data only as your data processor under section 8(2) of the DPDP Act, 2023.
2. Instructions
We process Customer Data only to provide Parakh (parsing, reconciling, reporting, sending the emails you trigger) and on your documented instructions. We do not use Customer Data for any other purpose, including training models or marketing.
3. Confidentiality
Personnel with access are bound by confidentiality and access is limited to what support and operations require.
4. Security
We maintain the safeguards described on our security page, including encryption in transit and at rest, tenant isolation, access control and audit logging.
5. Sub-processors
Hosting (India), email delivery and payments (Razorpay, which receives no Customer Data). We will give 30 days' notice of new sub-processors and you may object by ending the service.
6. Breaches
We notify you without undue delay, and in any case within 24 hours of becoming aware of a breach affecting Customer Data, with the information you need for your own notifications to the Data Protection Board and data principals.
7. Data principal requests
We help you respond to access, correction and erasure requests: you can export, edit and delete Customer Data in the app at any time.
8. Retention and deletion
Uploaded files are deleted within 7 days. Reconciliation data is deleted when you delete it, under your retention setting, or within 30 days of the workspace's deletion (backups age out within 30 days).
9. Location
Customer Data is stored in India. We do not transfer it outside India except to the extent a sub-processor's service requires it, and never to a country restricted by the Central Government under section 16.
10. Audits
On reasonable notice, once a year, we will answer written security questionnaires and provide available third-party reports.