DPA

Data Processing Addendum

Last updated May 6, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between VartaForge ("Processor") and the Customer ("Controller") under which VartaForge processes personal data on behalf of the Controller. It supplements and is governed by the Terms of Service.

This DPA is offered as a standard form. Negotiated DPAs for enterprise customers are available on request to [email protected].

1. Scope

This DPA applies to the processing of personal data carried out by VartaForge in the course of providing the Service. It applies to all customers regardless of plan tier.

2. Definitions

  • "Personal data": any information relating to an identified or identifiable natural person, as defined under applicable data-protection law (Indian Digital Personal Data Protection Act, 2023; GDPR where applicable).
  • "Processing": any operation performed on personal data (collection, storage, use, transmission, deletion).
  • "Controller" / "Processor": have the meanings set out in the DPDP Act and GDPR.
  • "Sub-processor": any third party that processes personal data on behalf of VartaForge to deliver the Service.

3. Roles

The Controller (the Customer's organization) is the controller of personal data submitted to the Service. VartaForge is the processor. VartaForge processes personal data only on documented instructions from the Controller.

4. Categories and purposes

Categories of data subjects

  • Controller's employees and authorised users.
  • Subjects mentioned in articles, prompts, or corpora processed via the Service.

Categories of personal data

  • Account data: name, work email, role, organization.
  • Editorial inputs and outputs: prompts, generated drafts, corpus content.
  • Operational logs: timestamps, IP, user-agent, generation metadata.

Purposes of processing

  • Delivering the Service.
  • Billing and account administration.
  • Abuse prevention and security.
  • Compliance with applicable law.

5. Sub-processors

The current sub-processors are:

  • Google (Gemini API) - LLM inference. Processing occurs in Google data centres, predominantly Asia-Pacific regions where available. Google's enterprise data terms apply (no training on API customer data).
  • Hosting - cloud infrastructure. India-region hosting where supported.
  • Transactional email - account-related notifications.

Controller authorises VartaForge to engage sub-processors. We notify Controllers in writing at least 30 days before adding a new sub-processor that materially affects data handling. Controllers may object to a new sub-processor on reasonable grounds; failure to reach agreement is a termination event under the Terms.

6. Security measures

  • Encryption: TLS 1.2+ in transit; encryption at rest for primary databases and storage volumes.
  • Access control: Role-based access; production access requires MFA; audit logging on all production reads / writes.
  • Network security: Bastion / VPN access only; no public database exposure.
  • Tenant isolation: Per-org row-level scoping enforced at the application layer; cross-tenant queries are prohibited by architecture.
  • Vulnerability management: Dependency scanning on every build; static analysis in CI; quarterly review of access logs.
  • Personnel: Background checks for production-access engineers; written confidentiality obligations.

7. Data subject rights

VartaForge will assist the Controller, by appropriate technical and organisational measures, with responding to data-subject requests for access, correction, deletion, portability, or objection. Controllers can self-serve most requests through the studio. Bulk or programmatic requests can be raised to [email protected].

8. Breach notification

VartaForge will notify the Controller without undue delay - and in any event within 72 hours - upon becoming aware of a personal data breach affecting Controller data. Notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to mitigate.

9. International transfers

Where personal data is transferred outside India to a sub-processor (e.g. Gemini compute regions), VartaForge ensures appropriate safeguards are in place: Standard Contractual Clauses where applicable, sub-processor binding terms equivalent to this DPA, or transfer to jurisdictions with an adequacy determination.

10. Audits

Once per calendar year, on at least 30 days' written notice, Controllers on the Daily and Network plans may audit VartaForge's compliance with this DPA, either directly or through an independent auditor. Audits are conducted at Controller's expense and during business hours, and must not unreasonably interfere with VartaForge's operations or breach the confidentiality of other customers.

11. Termination and return of data

On termination of the Agreement, VartaForge will, at the Controller's option:

  • Return all personal data to the Controller in a portable format, OR
  • Delete all personal data and certify deletion in writing.

Backups containing personal data are purged within 30 days of deletion. Logs may be retained for up to 24 months for security and audit purposes; these are excluded from the deletion scope.

12. Contact

Data protection officer: [email protected]. Postal address available on request.