Data processing agreement

This data processing agreement (“DPA”) is part of the terms of service between Zero Glitch Technologies Private Limited [[OWNER: confirm the exact name on the certificate of incorporation (invoices say “Private Limited”, the site footer says “Pvt. Ltd.”)]] (“Pixl”) and the business using Pixl Agents (“you”). It applies whenever Pixl processes personal data on your behalf in providing the service, and it takes effect when you accept the terms. If you need a signed copy, write to hello@pixlagents.com [[OWNER: confirm the contact address and its domain (the product also uses support@pixlstudio.ai, sales@pixlstudio.ai and hello@pixlagents.ai; decision D1)]].

For the personal data described in Annex 1, you are the data fiduciary (the party who decides why and how it is processed) and Pixl is your data processor, as those terms are used in the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Where the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply, Pixl processes the data as a service provider to you under a lawful contract. [[OWNER: lawyer — processor wording under SPDI, which has no processor concept]]

For your own account data and billing, Pixl acts on its own behalf under its privacy policy; this DPA doesn’t cover that.

Pixl processes the personal data only to provide the service, on your documented instructions. Your instructions are these terms, and the way you set up and use the service: your agents’ instructions, the channels you connect, your campaigns, automations and settings. Pixl will tell you if it believes an instruction breaks the law, and may decline to follow it.

Pixl won’t sell the personal data, use it for advertising, or use it to train AI models.

Pixl gives access to the personal data only to staff and contractors who need it to run or support the service, who are bound by confidentiality. Staff access to a workspace is recorded in an audit log.

Pixl keeps reasonable security practices appropriate to the data, including the measures in Annex 2, and may improve them over time without lowering the overall level of protection.

• You authorise Pixl to use the sub-processors listed on our sub-processors page.
• Pixl binds each sub-processor by contract to protect the data at least as well as this DPA requires, and remains responsible for their work.
• Before adding or replacing a sub-processor, Pixl updates that page and tells account owners by email at least 15 days in advance. If you object on reasonable data-protection grounds, we will try to resolve it; if we can’t, you may end the affected service and get a refund of fees prepaid for the remaining period. [[OWNER: lawyer — notice period and the objection remedy]]
• Platforms you connect yourself (such as Meta, Google or Shopify) are not Pixl’s sub-processors. They process data under their own terms with you.

Pixl stores the personal data on servers in India (Google Cloud in Mumbai, India (asia-south1) [[OWNER: confirm the regions of the storage buckets (media, call recordings), the knowledge-search database and the backups; the code fixes only the servers’ region]]). Some sub-processors, such as AI model and speech providers, process it outside India, mainly in the United States, as the sub-processors page shows. You authorise these transfers. Pixl will not transfer the data to a country the Government of India restricts under section 16 of the DPDP Act.

Where the SPDI Rules require consent for transferring sensitive personal data, such as health information, you are responsible for obtaining it from the people concerned. [[OWNER: lawyer — the cross-border consent position for health information sent to US AI and voice providers]]

Pixl will help you meet your obligations, taking into account the nature of the processing:

• Requests from people. The service lets you find a person’s contact record and conversations, correct their details, record an opt-out (WhatsApp messages stop automatically when someone replies STOP), and erase a contact together with their conversations, messages and call recordings. Opt-out records are kept after an erasure, holding only the number or email address, so the person is not contacted again. If Pixl receives a request directly from one of your patients or customers, Pixl will pass it to you and not answer it itself unless you ask.
• Assessments and regulators. Pixl will give you the information you reasonably need about the processing for any data protection assessment or a regulator’s enquiry.

If Pixl becomes aware of a personal data breach affecting your data, it will tell you without undue delay, and in any case within [[OWNER: lawyer — hours (so you can meet the DPDP Rules’ 72-hour report to the Board)]]. The notice will say what happened, what data and how many people may be affected, what Pixl is doing about it, and who to contact. Pixl will keep you updated and help you notify the Data Protection Board and the people affected.

You can erase contacts, and delete whole workspaces, at any time. When your account is deleted, Pixl deletes the workspaces only you own, including their recordings, files and knowledge, about 30 days later, so you have time to change your mind or download what you need. Invoices and other records Pixl must keep by law are kept, without the rest of the workspace. Copies in backups are deleted when those backups expire. [[OWNER: backup retention period]] Pixl may keep data the law requires it to keep, protected and used only for that purpose.

Pixl will answer reasonable written questions about its processing and security. Pixl holds no third-party security certifications today. Once a year, with 30 days’ notice, you (or an independent auditor bound by confidentiality) may review Pixl’s relevant records and controls, at your cost, during business hours and without access to other customers’ data. [[OWNER: lawyer — audit clause]]

You confirm that:

• you have a lawful basis for the personal data you put into Pixl, and for asking Pixl to process it as you instruct;
• you give the people concerned the notices the law requires (including that they may be talking to an AI and that calls are recorded), and obtain their consent where needed, including before collecting health information;
• you will not use Pixl to collect passwords, payment card numbers or government ID numbers, and will collect health information only as far as your service needs it.

Each party’s liability under this DPA is subject to the limits in the terms of service. This DPA lasts as long as Pixl processes personal data for you. If this DPA conflicts with the terms of service on data protection, this DPA wins.

In place today

• Encryption in transit: all traffic to the service uses HTTPS.
• Encryption at rest of the credentials for accounts you connect (access tokens, mailbox passwords).
• Passwords stored only as bcrypt hashes; API keys and sign-in refresh tokens stored hashed.
• Two-factor sign-in available for every account; sign-in sessions can be revoked.
• Role-based access within your workspace (owner, admin, member, viewer, guest).
• An audit log of sensitive actions, kept for one year (three for destructive actions), including staff access to a workspace.
• The database is not exposed to the internet.
• Call recordings are played only through links that expire after one hour, to people with access to conversations.
• Phone numbers in service logs are cut to their last four digits; error reports are sent with personal details turned off.
• Servers hosted on Google Cloud in India; daily backups.
• Opt-out handling: WhatsApp messages stop automatically for anyone who replies STOP.