Data processing agreement

This agreement is part of the terms of use between Twishiv Platforms Private Limited (“Claravo”) and each business customer (“you”). It covers personal information in the content you upload and make, and about the viewers of your share links and published pages, which Claravo handles for you (“your personal data”). Your account and billing information are covered by the privacy notice instead. If this agreement and the terms differ on personal data, this agreement applies; the EU standard contractual clauses (section 6) apply over both. Accepting the terms accepts this agreement; write to us for a signed copy.

1. Roles

You are the controller (in India, the data fiduciary; under US state laws, the business) of your personal data, and Claravo is your processor (service provider). You are responsible for having a lawful reason to use it and for the notices you give people, including the viewers of your pages.

2. What Claravo processes, and why

• Purpose: providing Claravo to you: storing, writing with AI, recognising text in scans, editing, sharing, publishing and exporting your decks and documents, counting views, and sending the emails you trigger.
• People: your users; people named or pictured in your files and content; viewers of your share links and published pages, and the addresses a page's email gate collects.
• Information: whatever personal information your files and content hold, and viewers' visit records as the privacy notice describes. This can include voice recordings and their transcripts (with the speakers told apart), meeting transcripts with the names of the people who attended or spoke, the email addresses that visitors to a data room type, and, if you connect your own Stripe or HubSpot account to Reports, what that service returns when Claravo reads the account for a report (customer, subscription, payment or deal records, which can carry your customers' names, email addresses and amounts), of which Claravo keeps only the totals it works out. Do not upload sensitive information (such as health data) unless you have a lawful reason; no extra safeguards apply to it.
• How long: while your account exists, then deleted as in section 3.

3. What Claravo promises

• To process your personal data only on your documented instructions (the terms, this agreement and how you use Claravo's features), including on transfers abroad, unless a law requires otherwise; then we tell you first unless that law forbids it. We tell you if we think an instruction breaks data protection law.
• To use it only for the limited and specified purposes in section 2, within our direct business relationship with you; never to sell or share it (as US state laws use those words), use it for advertising or to train AI models, or combine it with other personal information except as the law allows a service provider. We certify that we understand and will follow these limits, and we give it the protection the CCPA and similar laws require.
• That everyone who can access it is bound to keep it confidential.
• To keep it secure with the measures in section 7.
• To help you answer people's requests (with the export, correction and deletion features, and otherwise as reasonably needed). A request sent to us about your personal data is passed to you.
• To help you with security, breach notices and data protection impact assessments, using the information we have.
• To delete or return it at your choice: you can download everything (Settings → Your data) and delete it (“Delete forever”, or Settings → Delete account). Deleted data leaves our live systems within 30 days and our backups within their period in the privacy notice. Archiving is not deleting. Tax records the law requires are kept only for that purpose.
• To give you the information needed to show we keep this agreement: we answer a reasonable security questionnaire once a year, or after a security incident. If that is not enough, a regulator requires it or there is a reasonable sign we are not keeping this agreement, you may audit us, normally once a year, on 30 days' notice, at your cost, by an auditor bound to confidentiality and without access to other customers' data.
• To tell you within 5 business days if we decide we can no longer keep these promises; you may then stop the processing, take reasonable steps to stop any misuse, and end the terms.

4. Security incidents

If a security incident affects your personal data, we tell you without undue delay, and at most 48 hours after we become aware of it, by email to your account's address: what happened, the kinds and rough number of people and records affected, the likely consequences, what we have done and will do, and whom to contact. We add details as we learn them, and act to contain it.

5. Outside services (sub-processors)

You authorise the outside services listed in the privacy notice's table, for the purposes shown there; a service marked “off” receives nothing. We give at least 30 days' notice, by email and on that page, before adding or replacing one. You may object on reasonable data-protection grounds in that time; if we cannot meet the objection, you may end the affected service with a refund of what you prepaid for the time left. Each service is bound by the same data-protection obligations as these, and we remain responsible for it.

6. Transfers abroad

Your personal data is stored in India (Microsoft Azure, Central India) and some outside services are in the United States and other countries. Where the GDPR applies to a transfer to Claravo, the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) are part of this agreement: Module 2 where you are a controller, Module 3 where you are a processor; clause 7 included; clause 9(a) option 2 with 30 days' notice; clause 11's optional wording left out; under clause 13, the authority of the Member State where you are established (or where your EU representative is); under clauses 17 and 18, the law and courts of Ireland. Their annexes are sections 2, 5 and 7 of this agreement, with the parties being you (data exporter) and Twishiv Platforms Private Limited (data importer). Where the UK GDPR applies, the UK Information Commissioner's International Data Transfer Addendum (version B1.0) is part of this agreement, with the same details; either party may end it as its section 19 allows. For outside services abroad we use the same clauses, and a service's Data Privacy Framework certification where it has one. Transfers out of India follow India's data protection law as it comes into force.

7. Security measures

• Hosting on Microsoft Azure in India; connections encrypted (TLS, with HSTS); authenticator secrets and Google and Microsoft tokens encrypted by the app.
• Every read and write filtered by the account or team that owns the deck; team members and holders of a live share link see only what is shared with them; another account's document is “not found”; downloads only through signed-in routes.
• Passwords hashed with scrypt; sessions stored only as keyed hashes; two-step sign-in; sign-in limits per account and per address.
• A content security policy, origin checks, upload allow-lists and size limits, generated file names, XML entity expansion off, PDF rendering with JavaScript off and the network blocked, and file content passed to AI only as labelled data.
• Secrets only in server settings. Security events and server logs kept 180 days in India. Database backups kept 35 days and file snapshots 30 days.
• Automated security tests on every change. No penetration test has been run yet.

8. Liability and changes

Liability under this agreement is subject to the limits in the terms, except where data protection law or the standard contractual clauses do not allow limits. We may update this agreement to follow the law, or with 30 days' notice; an update never lowers the protection of your personal data without your agreement, and never changes the standard contractual clauses. This agreement is governed by the law that governs the terms.

Contact

Data protection questions and requests: grievance@claravo.ai (Grievance Officer, Nirav Soni).