Data Processing Agreement

This summary applies when you process personal data of your own customers through PdfPilot24. It forms part of the Terms of Service.

Roles

You are the data fiduciary; WebGrow24 LLP acts as a data processor for the limited purpose of rendering a document you send.

Processing instructions

We process document content only to produce the output you request. We do not analyse, index, train models on, or share document content. Content is discarded immediately after the response is sent.

Security measures

• TLS in transit, encryption at rest for databases and backups.
• Hashed API keys, least-privilege access, audit logging.
• Network isolation between the application and rendering engine.
• Security patches applied on a monthly cadence, critical patches within 72 hours.

Sub-processors

WebHost24 (hosting, India) and Razorpay (payments, India). We notify customers before adding a sub-processor that touches personal data.

Breach notification

We notify affected customers without undue delay and within 72 hours of becoming aware of a personal data breach, with the information required under the DPDP Act.

Deletion

On termination we delete account data within 30 days, except records required for tax and accounting obligations.