Data Processing Addendum

Last updated: 6 November 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between 18th Digitech Private Limited (“Processor”, “we”) and the organization using MetryFlow (“Customer”). It applies whenever we process personal data on the Customer’s behalf, and is written to meet section 8 of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, and, where they apply, the EU/UK GDPR.

1. Roles

For personal data in the Customer’s connected accounts that is processed through the Service, the Customer is the Data Fiduciary (controller) and 18th Digitech Private Limited is the Data Processor (processor). We process that data only to provide the Service to the Customer and never for our own purposes.

2. What we process

• Purpose: fetching the Customer’s connected-account data live when the Customer’s users request it, returning it to the Customer’s AI assistant, and producing the dashboards and reports the Customer sets up, plus the security and operational processing needed to run the Service.
• Data Principals (data subjects): whoever appears in the Customer’s connected accounts, such as the Customer’s customers, buyers, reviewers, contacts, suppliers, employees and staff users.
• Types of personal data: mostly aggregated figures with no personal data. Where specifically requested and held by the source: names, email addresses, phone numbers, postal addresses, customer and order identifiers, and, for accounting and payroll sources, contact, tax, bank and pay details.
• Masking: by default, names, email addresses, phone numbers, street addresses, birth dates, bank and tax identifiers and free-text notes are masked before any data leaves the Service, including in AI-assistant answers, scheduled reports and dashboards. We switch masking off for a Customer only on the Customer’s request.
• Storage: retrieved data is passed through and not stored. Stored data is limited to what is listed in our Privacy Policy.
• Duration: for as long as the Customer uses the Service, then as set out in section 8.

3. Our commitments

• Process personal data only on the Customer’s documented instructions, including through the Service’s features and settings.
• Never sell the data, use it for advertising, or use it to train AI models.
• Ensure everyone authorized to process the data is bound by confidentiality, and limit access to those who need it.
• Maintain the security safeguards in section 5.
• Stop processing when the Customer tells us a Data Principal has withdrawn consent, and erase data when the Customer instructs us to.
• Keep logs of processing for as long as the DPDP rules require, protected in the same way as other data.
• Help the Customer respond to Data Principal requests and meet its security and breach-reporting duties.
• Provide the information reasonably needed to show we comply with this DPA.

4. Sub-processors

The Customer authorizes us to use the following sub-processors:

Each sub-processor is bound by data-protection obligations no less protective than this DPA, and we remain responsible for them. We will update this list and email the Customer’s account owners before adding or replacing a sub-processor, so the Customer can raise any objection. The AI assistant the Customer connects (for example Claude, ChatGPT or Copilot) is chosen by the Customer and works under the Customer’s own agreement with that provider.

5. Security safeguards

We maintain reasonable security safeguards, including: encryption in transit (TLS); encryption of stored credentials and secrets at rest (AES-256-GCM) with key rotation; database row-level security isolating each organization; least-privilege, role-based and per-member access controls; strong password hashing and optional two-factor authentication with immediate session revocation; read-only connectors that cannot change connected accounts; activity and audit logging with monitoring; regular backups; browser security headers; secret management; and rate limiting and abuse controls.

6. Data Principal requests

If a Data Principal contacts us about data in the Customer’s connected accounts, we will pass the request to the Customer without delay and help the Customer respond. We will not respond directly unless the Customer asks us to or the law requires it.

7. Personal data breach

We will notify the Customer within 24 hours of becoming aware of a personal data breach affecting the Customer’s data. Our notice will describe, as far as known at the time: what happened and when, the data and Data Principals affected, the likely consequences, and the steps taken and planned to contain it. We will keep the Customer updated and provide the information it needs to notify the Data Protection Board of India and affected Data Principals, including the detailed report due within 72 hours.

8. Deletion

Disconnecting a source deletes its stored credentials immediately. When the Customer’s account ends, or on the Customer’s instruction, we delete the Customer’s personal data within 30 days, except where the law requires us to keep it. Copies in backups are overwritten within our backup period.

9. Customer responsibilities

• Have a lawful basis, including any required notice and consent, for the personal data in the accounts it connects.
• Obtain verifiable parental consent where its data includes children’s personal data, as the DPDP Act requires.
• Decide which of its users can access which connections, and request personal-level details only when needed.

10. Data location and transfers

The Service is hosted in India. Personal data leaves India only through the sub-processors listed in section 4 and the AI assistant the Customer chooses, as permitted under section 16 of the DPDP Act and, where the GDPR applies, under an appropriate transfer mechanism.

11. Contact

Data-protection queries: support@metryflow.ai (18th Digitech Private Limited).