Data Processing Terms (for business customers)

Draft v0.1, 2026-10-16. Lawyer review pending. Applies when you, as a business, use the Service to process personal data of others (for example an agency enriching leads for clients).

1. Roles. You are the Data Fiduciary (controller) for personal data in your inputs and results. We are your Data Processor and act only on your documented instructions, which are the calls you make.
2. Purpose and scope. We process the data only to run the tool you called, bill you, prevent abuse and keep the Service secure.
3. Sub-processors. The Providers behind each tool (listed in the tool documentation), our upstream partner, hosting, email and monitoring providers listed in the Privacy Policy. We will give 15 days' notice before adding a sub-processor that handles your inputs.
4. Security. Measures described on the Security page, including hashing of personal data in logs and non-retention of results beyond 24 hours.
5. Assistance. We will help you respond to data-subject requests and breach notifications to the extent the data is in our systems, within the timelines the DPDP Act sets.
6. Deletion. On account closure or request we delete or anonymise your personal data, except what we must keep by law.
7. Audit. Once a year, on reasonable notice, you may request a written description of our security measures and the results of our latest restore drill.
8. Liability follows the Terms of Service.