Draft — this page has not yet been reviewed by a lawyer and may change.

Data processing agreement

This agreement is part of the Ivoric Billing Terms of service. It applies to the personal data in the business records you keep in Ivoric Billing — your customers, suppliers and staff. For that data your business is the Data Fiduciary (you decide why and how it is used) and [company name], [registered address], is your Data Processor. It does not cover your own account details, which our Privacy policy covers.

What we process and why

Whose data: your customers, suppliers, staff and other people you record.
What data: names, mobile numbers, email and postal addresses, GSTINs, and the bills, payments, balances, documents and photos you enter or upload.
Why: only to provide the service you use — keeping your books, making and sharing documents, reminders you switch on, reports, backups and support you ask for.

Our commitments

We process the data only on your instructions, given through the app and these terms, and never for our own purposes (we do not sell it, market to your customers or train AI models on it).
People who can reach the data are bound to confidentiality. Our support team opens your business only when the owner allows it, view-only and for a limited time, and every page they open is recorded in your activity log.
Security: each business's data is kept apart and tested to stay apart, connections are encrypted, saved secrets are encrypted, sign-in attempts are limited, every change is recorded in an audit log that cannot be edited, and backups are taken every night (copies kept off the server are encrypted).
We help you answer requests from the people whose data you hold: you can look up, correct and export their records yourself, and we assist when you ask.
If we become aware of a breach affecting your data, we tell you without undue delay — we aim for within 24 hours — with what we know, so you can meet your own duties, and we help you respond.
When you leave, you can export everything first; we then delete or anonymise the data, except what the law requires to be kept, and backups expire on their normal cycle.
We give you the information you reasonably need to show that these commitments are met.

Who helps us (sub-processors)

Hosting and storage: our hosting provider, and — if switched on — our off-site backup storage provider.
Messages: email, SMS or WhatsApp providers, only for messages you or the features you switch on send.
AI features, only if you switch them on: an AI model provider receives only what a feature needs (for example a bill photo you ask the app to read).
Each is bound to protect the data and to use it only to provide its part of the service. We will tell you in the app before we add a new kind of sub-processor.

Your part

You make sure you are allowed to record the personal data you put into Ivoric Billing and that you tell the people concerned what you do with it, as the Act requires of a Data Fiduciary.

Contact

[grievance officer] — [support email]. Write to us at [support email].