Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Loktara Ventures Private Limited (CIN U62099PB2026PTC069238), operating Niyoos ("Niyoos", "Processor"), and the customer that accepted those Terms ("Customer", "Data Fiduciary"). It applies automatically, on every plan including the Free plan, from when the Customer accepts the Terms. A Customer that needs a signed copy can email privacy@niyoos.com.

1. Definitions

1.1 Applicable Data Protection Law means the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (the "DPDP law") as and when their provisions come into force, and any other Indian law on personal data that applies to the processing.

1.2 Customer Personal Data means personal data in Customer Data (as defined in the Terms) that Niyoos processes on the Customer's behalf in providing the Service, as described in Annex 1.

1.3 Data Principal, Data Fiduciary, Data Processor, personal data, processing and personal data breach have the meanings given in the DPDP law.

1.4 Sub-processor means a third party Niyoos engages to process Customer Personal Data.

1.5 Customer-Selected Provider means an AI model provider, or other service, that the Customer chooses and connects to the Service using its own account or key.

1.6 Other capitalised terms have the meanings given in the Terms.

2. Roles and scope

2.1 For Customer Personal Data, the Customer is the Data Fiduciary and Niyoos is its Data Processor. Niyoos processes it only on behalf of the Customer.

2.2 Personal data that Niyoos processes for its own purposes (Member accounts, billing and receipts, support, security records, website analytics) is outside this DPA. Niyoos is the Data Fiduciary for that data, and the Privacy Policy applies.

2.3 Niyoos may use Usage Metadata to keep the Service secure, prevent abuse, count billable requests and produce aggregated statistics that identify no Customer, Member or Data Principal. This is part of providing the Service.

3. The Customer's instructions

3.1 Niyoos processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, the Customer's configuration of the Service (including agents, keys, limits, loop settings, alert recipients, the Tool Details setting, the kill switch and deletion) and requests made through the Service's interfaces and APIs are the Customer's complete instructions.

3.2 Niyoos will tell the Customer if, in its opinion, an instruction breaks Applicable Data Protection Law, and may decline to follow it.

3.3 Niyoos may also process Customer Personal Data where Indian law requires it. In that case it will tell the Customer before processing unless the law forbids that.

4. The Customer's responsibilities

4.1 The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including:

• having a lawful basis, and giving any notice the law requires, for processing its Data Principals' personal data through the Service, including its transfer to Customer-Selected Providers;
• not sending children's personal data or sensitive personal data through the Service unless it has a lawful basis and it is necessary;
• deciding whether to turn on Tool Details for each agent, knowing that it stores tool-call arguments for 30 days;
• the retention it needs for its own legal obligations, including any obligation under rule 8(3) of the DPDP Rules, 2025 to retain processing logs.

4.2 Customer-Selected Providers. The Customer chooses each Customer-Selected Provider, contracts with it directly and supplies its own key. Niyoos forwards the Customer's requests to it on the Customer's instruction. A Customer-Selected Provider is not a Sub-processor of Niyoos, and Niyoos is not responsible for its processing. The Customer is responsible for its agreement with each Customer-Selected Provider and for any transfer of personal data to it, including outside India.

5. Confidentiality

Niyoos ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and has access only as needed to provide the Service.

6. Security

6.1 Niyoos maintains the technical and organisational measures in Annex 2, appropriate to the risk, to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure.

6.2 Niyoos may update these measures over time, provided the overall level of protection does not decrease.

7. Personal data breaches

7.1 Niyoos will notify the Customer without undue delay, and in any case within 48 hours of confirming a personal data breach affecting Customer Personal Data. It will email the Customer's Admins and give, as it becomes available: a description of the breach; the categories and approximate number of Data Principals and records affected; the likely consequences; the measures taken or proposed to contain it and reduce harm; and a contact for more information.

7.2 Niyoos will reasonably help the Customer meet its own obligations to notify the Data Protection Board of India and affected Data Principals, including providing the information needed for a detailed report within 72 hours.

7.3 Niyoos's own legal duty to report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of noticing them is separate and is not delayed by this clause. Such reporting is not a breach of confidentiality.

7.4 A notification under this clause is not an admission of fault.

8. Sub-processors

8.1 The Customer gives general authorisation for Niyoos to engage the Sub-processors listed on the Sub-processors page (Annex 3).

8.2 Niyoos will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA, and remains responsible to the Customer for each Sub-processor's performance.

8.3 Niyoos will announce a new Sub-processor of Customer Personal Data at least 30 days before it starts processing, on the Sub-processors page and by email to Customers who have asked to be notified. If the Customer objects on reasonable data-protection grounds within those 30 days, the parties will discuss a solution in good faith. If none is found, the Customer may cancel the affected paid plan and receive a pro-rata refund of fees prepaid for the period after the change.

8.4 Niyoos may replace a Sub-processor without 30 days' notice where urgently needed for security or continuity of the Service, and will notify the Customer as soon as possible.

9. Helping with Data Principals' requests

9.1 Taking into account the nature of the processing, Niyoos will help the Customer respond to requests from Data Principals to exercise their rights (to information, correction, completion, updating, erasure, grievance redressal and nomination), mainly through the Service's own features, such as deleting agents or the workspace.

9.2 If Niyoos receives such a request directly about Customer Personal Data, it will pass it to the Customer without undue delay and will not respond itself except to say it has done so, unless the Customer authorises it or the law requires.

9.3 Where the Service's features are not enough, Niyoos will provide reasonable help within 10 business days of the Customer's written request.

10. Retention, return and deletion

10.1 Niyoos retains Customer Personal Data as set out in Annex 1, section 5.

10.2 The Customer can view and export its data through the Service while its workspace exists, within the features of its plan, and should do so before deleting the workspace.

10.3 When the Customer deletes its workspace, Niyoos erases Customer Personal Data from its production database straight away. Residual copies are deleted as follows: database backups within 7 days; application and security logs within 365 days; audit ledger copies already archived when their 90-day lock ends; email delivery records at the email provider under that provider's retention period. Until deletion, residual copies are kept secure and are not used.

10.4 Niyoos may keep Customer Personal Data where Indian law requires it, for as long as required, and will keep it confidential and secure.

10.5 On request, Niyoos will confirm in writing that deletion has been carried out.

11. Audits and information

11.1 Niyoos will make available the information reasonably necessary to show its compliance with this DPA, including answers to reasonable security questionnaires (no more than once a year unless a breach has occurred) and, when it has them, summaries of independent audit reports.

11.2 If that information is not enough to show compliance, or a regulator requires it, the Customer may carry out an audit, on at least 30 days' written notice, during business hours, at its own cost, by an independent auditor bound by confidentiality, no more than once a year, and in a way that does not disrupt the Service or expose other customers' data.

12. Location and transfers

12.1 Niyoos stores Customer Personal Data in India, in Amazon Web Services' Mumbai region.

12.2 The Sub-processors in Annex 3 that are located outside India process limited categories of personal data (sign-in data, email addresses and email content) under written contracts that protect it to a standard at least equal to Applicable Data Protection Law.

12.3 If the Government of India restricts transfers to a country where a Sub-processor operates, Niyoos will comply and, where needed, replace that Sub-processor.

13. Government requests

If Niyoos receives a request from a government authority for Customer Personal Data, it will check that the request is lawful, disclose only what is legally required, and notify the Customer first unless the law forbids it.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, as they apply to this DPA.

15. Term and precedence

15.1 This DPA applies for as long as Niyoos processes Customer Personal Data.

15.2 If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

15.3 Niyoos may update this DPA to reflect changes in law or in the Service, with at least 30 days' notice for changes that reduce the Customer's protection.

16. Customers outside India

Niyoos currently sells paid plans only to buyers in India. If Niyoos agrees in writing to serve a Customer that is subject to the European Union's General Data Protection Regulation or a similar law, the parties will sign the additional terms that law requires (for example, Article 28 terms and Standard Contractual Clauses) before Customer Personal Data subject to it is processed.

---

Annex 1: Details of the processing

1. Subject matter and duration. Providing the Service to the Customer, for as long as the Customer's workspace exists, plus the residual periods in clause 10.3.

2. Nature and purpose. Receiving the Customer's agents' AI requests, forwarding them to Customer-Selected Providers, returning responses, recording usage metadata, enforcing the Customer's controls (kill switch, spending limits, loop detection, plan limits), generating alerts, analytics and emails, maintaining the audit ledger, and, where the Customer turns it on, storing tool-call arguments.

3. Data Principals. The Customer's end users, customers, employees and any other people whose personal data is contained in the Customer's AI requests, responses or tool calls; and the Customer's Members as they appear in workspace records.

4. Categories of personal data. Determined by the Customer and its agents, and may include:

Special categories. The Customer should not send sensitive personal data or children's personal data unless it has a lawful basis and it is necessary (clause 4.1).

5. Retention.

Annex 2: Technical and organisational measures

Annex 3: Sub-processors

As listed on the Niyoos Sub-processors page at the time of processing, which forms part of this DPA. At the effective date, the Sub-processors of Customer Personal Data are: Amazon Web Services (hosting, India), Clerk, Inc. (sign-in, United States) and Resend (email, Japan).