Data Processing Addendum

This Addendum forms part of the Terms of Service between Ektasi Technology (OPC) Private Limited, Chiraigaon, Varanasi, Uttar Pradesh 221112, India(“Ektasi”, the Processor) and the customer operating a workspace (the “Client”, the Controller / Data Fiduciary). It applies whenever Ektasi processes personal data inside the Client’s workspace on the Client’s behalf.

Ektasi is the Controller (Data Fiduciary) only for the Client’s administrative and billing data, which is governed by the Privacy Policy, not by this Addendum.

Ektasi processes workspace personal data only to provide, secure and support the platform, and on the Client’s documented instructions — the Terms, this Addendum, and the configuration the Client makes in the product. Ektasi does not monetise workspace data, does not use it for advertising, and does not train shared or third-party AI models on it.

Subject matter: the personal data the Client and its users enter or upload. Duration: the life of the workspace plus the erasure period in section 8. Data subjects: the Client’s staff, customers, leads, suppliers and contacts. Categories: identity and contact details, commercial and transaction data, communications, and any other content the Client chooses to store.

• Tenant isolation enforced by PostgreSQL Row-Level Security under a non-superuser, non-bypass database role.
• AES-256-GCM encryption of stored credentials (integration passwords, OAuth tokens, AI-provider keys). Most are keyed per workspace via HKDF from a per-workspace salt; the Client’s Google and Zoom meeting credentials (client secrets and the Google refresh token) and two-factor secrets are encrypted under a platform key. Other workspace data is protected by tenant isolation, access control and encryption in transit, not by per-workspace encryption.
• TLS in transit; edge JWT verification; MFA available to every user; rate limits and abuse controls.
• An append-only audit ledger of administrative actions that cannot be edited or deleted by application code.
• Telemetry scrubbed of tokens, keys, salts and payload variables before transmission.
• Database backups taken every six hours and kept on a rolling retention schedule.

Only designated Ektasi platform administrators can access workspace payload data. They do so only to provide support the Client requests, to investigate a security incident or abuse, or where the law requires it, and limit access to what that purpose needs. Personnel with access are bound by confidentiality obligations.

The Client authorises the sub-processors listed at /legal/subprocessors — Cloudflare; Amazon Web Services (SES, Mumbai; object storage where enabled); Upstash (rate limiting); Razorpay and Stripe; Sentry, PostHog and Dropbox where enabled; 8x8 (Jitsi Meet) where a workspace uses the default meeting server; and the AI model providers in section 6. Each is bound by written terms no less protective than this Addendum.

Ektasi gives workspace administrators at least 30 days’ notice by email before engaging a new sub-processor for workspace data. The Client may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Client may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period.

Where the Client or its users invoke an AI feature, the prompt and the content submitted to that feature are transmitted to the model provider selected for it and the output returned to the workspace. Providers available are Ektasi’s own AI model server (open models on servers Ektasi administers), Microsoft (Azure OpenAI Service), Anthropic, OpenAI, Google (Gemini), OpenRouter (a broker that forwards to a downstream provider the Client selects), Stability AI (images) and Replicate (specialised image and video models). Nothing is transmitted to any provider except in response to such a request.

Ektasi uses each provider’s business API on terms under which the provider does not use the Client’s inputs or outputs to train its models. OpenRouter is the exception Ektasi cannot warrant: it forwards to a downstream provider of the Client’s choosing, whose terms vary, so the Client selects OpenRouter routes at its own assessment. Where the Client stores its own provider API key in the encrypted vault (bring-your-own-key), requests made with that key are processed under the Client’s own agreement with the provider, and the provider is the Client’s processor for those requests rather than Ektasi’s sub-processor.

The Client is responsible for the lawfulness of the personal data it chooses to submit to AI features and for informing its own data subjects where required.

Workspace data is stored in India. Transfers to sub-processors outside India occur only as described at /legal/subprocessors (edge metadata, non-INR payments, rate-limiting keys, error telemetry, product usage events, files and backup copies where Dropbox is enabled, AI prompts) and are made in compliance with the DPDP Act, 2023 and, for personal data subject to the GDPR or UK GDPR, on the basis of the applicable standard contractual clauses or equivalent safeguards. Clients requiring in-country processing for all categories may specify it under a Master Services Agreement.

On termination, or on a verified request from a workspace administrator, Ektasi deletes every table that holds the workspace’s data from the live database, in one transaction — if any step fails nothing is deleted, so there is no partial erasure — and destroys the workspace’s key salt, so credentials keyed to the workspace can no longer be decrypted from the live system. Erasure from the live database is completed within 30 days of a verified request and Ektasi confirms completion to the Client. Two categories of record are retained because a statute requires it, and are the only Client-scoped records that survive: (a) the GST tax invoices Ektasi issued to the Client, and (b) the record of who accepted the Terms for each charge — the version accepted, the time, the price shown, and the IP address and browser user-agent it was sent from. Both are retained for eight financial years (CGST Act, 2017 s.36 — seventy-two months from the due date of that year’s annual return; Companies Act, 2013 s.128(5)), which s.8(7) of the Digital Personal Data Protection Act, 2023 permits because the retention is necessary for compliance with law; the invoice cannot be anonymised because Rule 46 of the CGST Rules requires the recipient’s name, address and GSTIN on the document. The Client’s billing profile and tax profile are not retained. Copies in backups are deleted as those backups expire under Ektasi’s rolling retention schedule, and until then are used only to recover the platform after an incident. A content-free tombstone and the audit ledger are retained as the compliance record. Before requesting erasure the Client may export its data from the product. Procedure: /legal/data-deletion.

Ektasi assists the Client in responding to data-subject requests (access, correction, erasure, nomination) concerning workspace data, and in any data-protection impact assessment the Client must carry out, taking into account the nature of the processing.

Enterprise clients may self-serve forensic review of their workspace’s audit ledger from the dashboard. On written request, and no more than once a year unless required by a regulator, Ektasi provides the information reasonably necessary to demonstrate compliance with this Addendum.

Ektasi notifies the Client without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting workspace data, with the information the Client needs to meet its own notification duties.

Notices under this Addendum go to rajan@ektasi.io (Grievance Officer: Rajan Singh). These terms are governed by the laws of India. Courts at Varanasi, Uttar Pradesh, India have exclusive jurisdiction. Where this Addendum conflicts with the Terms on a data-protection matter, this Addendum prevails.