Data Processing Agreement
Plain-language draft published for transparency. Have this reviewed by your legal advisor before relying on it; the version accepted inside your workspace's compliance record is the one that applies to you.
1. Who is who
Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the business that subscribes to ZevroCRM (the "Customer") is the Data Fiduciary for the personal data of its leads, buyers and staff. ZevroCRM acts as a Data Processor: we process that data only to provide the CRM service, only on the Customer's instructions, and for no purpose of our own.
2. What we process
The personal data the Customer's team records in its workspace: lead and customer names, contact numbers, email addresses, enquiry notes, booking and payment records, uploaded documents, and staff account details. Each workspace is stored in its own separate database; sensitive identifiers recorded in the CRM (such as Aadhaar or PAN references) are encrypted at rest.
3. Security measures
- One isolated database per workspace — never a shared table across customers.
- Role-based access control, optional enforced two-factor authentication and passkeys.
- An audit log attributing every change to a signed-in user.
- Encrypted transport (HTTPS) everywhere; encrypted storage of sensitive identifiers.
- Routine backups, with export and deletion available on request or termination.
4. Sub-processors
ZevroCRM uses the following service providers to run the platform. Each receives only what its function needs:
| Provider | Purpose |
|---|---|
| DigitalOcean LLC | Cloud infrastructure that hosts the platform and workspace databases. |
| Amazon Web Services, Inc. | Domain name (DNS) services. |
| Resend, Inc. | Delivery of transactional email (sign-in codes, notifications, reports). |
| Meta Platforms, Inc. | Delivery of WhatsApp messages, where the workspace uses WhatsApp features. |
| MSG91 (Walkover Web Solutions Pvt. Ltd.) | Delivery of SMS, where the workspace uses SMS features. |
5. AI sub-processors — engaged only with your recorded authorisation
Where a workspace has switched on AI features and its compliance record explicitly authorises AI processing, the text needed for that feature (for example, lead notes for scoring or summaries) may be processed by one or more of the following, exactly as named in that workspace's record:
| Provider | Purpose |
|---|---|
| Anthropic PBC | AI text processing — lead scoring, summaries, analysis. |
| Google LLC | AI text processing — lead scoring, summaries, analysis. |
| X.AI LLC | AI text processing — lead scoring, summaries, analysis. |
A workspace that has not authorised AI processing sends nothing to any AI provider — the platform refuses such calls rather than assuming consent. The specific vendors authorised for a workspace are visible in that workspace's compliance record, and no vendor outside its record is ever used for it.
6. Our commitments
- We process personal data only to provide and support the service — never to sell, advertise with, or profile beyond the Customer's instructions.
- We assist the Customer in honouring data principals' rights under the DPDP Act (access, correction, erasure, grievance).
- We notify the Customer without undue delay of any personal data breach affecting its workspace.
- On termination, workspace data is exported to the Customer on request and then deleted.
- We will update this page before adding a sub-processor, so the list above is always current.
7. Contact
Questions about this agreement or our processing: hello@zevrocrm.com.