Data Processing Agreement
DPA, processor terms.
This Data Processing Agreement ("DPA") supplements the Terms of Service for any customer using Saarthi. It governs how we process personal data on your behalf as a Data Processor under India's Digital Personal Data Protection Act, 2023 ("DPDPA").
1. Roles
You are the Data Fiduciary ("Controller" in GDPR terms) for the marketplace data you upload or authorise us to fetch, orders, returns, customer ship-to addresses, contact phone numbers, etc. SMEMINDS LLP (which operates the Saarthi service) is the Data Processor acting only on your documented instructions, which are: (a) the configurations you set in /settings, (b) the explicit instructions you give Saarthi, and (c) what these terms allow.
2. Scope of processing
- Categories of data: seller account info, marketplace orders, returns, inventory, settlements, ad reports, conversation transcripts, voice clips (transcribed; deleted on account erasure), and — only if you install the browser extension and enable page reading — the visible text of a web page sent with a question you ask from the extension's side panel (any website; its tables, headings and the labels of its fields and buttons, never what is typed into a field), a screenshot of the visible part of that tab when the page is drawn as a picture (not stored), the product or order identifiers on a marketplace page you open the extension on (matched against your own records and not stored), the contents of a file you attach to a question, read in memory on our server for that question and not stored (unless you import it), and the extension's sign-in records (a one-way hash of its token, a browser label, the issuing IP address and timestamps).
- Categories of data subjects: the seller-business owner / staff (you); incidentally, end-customers whose order ship-to data appears in marketplace exports.
- Purposes: running the dashboards, alerts, GSTR-1 generation, Saarthi replies, answering questions about a page or file you explicitly ask it to read (including transcribing a screenshot of it, and outlining on the page where to click), billing.
- Duration: for the lifetime of the subscription, plus 30 days for deletion / anonymisation, plus statutory minimum (GST: 6 years).
3. Sub-processors
The current list of sub-processors:
- Microsoft Corporation — web hosting, database, file storage, error monitoring (Application Insights) and transactional email (Communication Services), all in the Central India region (Pune); plus Azure OpenAI for Saarthi's reasoning, on a resource in South India.
What reaches the AI model: the message you typed and the query results needed to answer it. That includes your business identifiers — GSTIN, legal name, registered address, ASINs, order ids, rupee amounts. It does not include the end-customer data inside your marketplace reports: no buyer names, no shipping addresses, no buyer phone numbers are exposed to the model by any Saarthi tool.
With the browser extension, one more thing can reach the same model in the same region: the text of the page a question was sent from, when the side panel's page chip was switched on for it. That page may be a third party's — a marketplace console, a search result, a competitor's listing — so we treat its content as untrusted data rather than as instructions, and Saarthi is explicitly told not to act on anything written inside it. Nothing is read unless the panel is open on that page and no page is read in the background. The summary of a file attached to a question reaches the same model on the same terms, fenced as untrusted in the same way.
Screenshots of the visible tab (for pages drawn as pictures, such as Google Sheets or a PDF) and images attached to a question are transcribed by a separate vision deployment (gpt-4.1-mini) on the same South India resource. It is a Global deployment: data at rest stays in the resource's geography, but Microsoft may run the inference in another Azure region, inside or outside India. We never store the image — not in the conversation, logs or file storage — and it is not used for training.
Voice Saarthi (live voice conversations) streams microphone audio to our voice service in Azure Central India and on to Microsoft Azure AI Speech in Central India for speech-to-text and text-to-speech; the question text goes to the Azure OpenAI service above. Audio is processed in memory and not recorded or stored; text transcripts are kept as conversation history. - Deepgram Inc. — speech-to-text for in-app voice clips. United States. Apart from the screenshot and image transcription above (which may run in another Azure region), this is the one flow where content leaves India, it only happens when you press the microphone, and it is behind its own consent toggle you can switch off in Settings.
- Razorpay Software Private Limited — subscription payments. India. Receives the amount, the plan and your email to pre-fill checkout. Card, UPI and bank details are entered in Razorpay's own window and never reach us.
- Google LLC — authentication, only if you use “Sign in with Google”. Receives nothing from us; we receive your email and a Google account id.
- Meta Platforms (WhatsApp Business Cloud API), multi-region. Not currently active — built but switched off. Listed here so the list is complete on the day it is turned on.
We do not use Google Analytics, Meta Pixel, Google Tag Manager or any advertising or marketing tracker, and we do not sell or share data with data brokers.
Each sub-processor is contractually bound to (a) confidentiality, (b) processing only on SMEMINDS LLP' instructions, and (c) appropriate technical and organisational security measures. We'll give you 30 days notice before adding a new sub-processor; you may object in writing. The list above is a complete restatement as of the date at the top of this page — earlier versions named only three, which understated it rather than reflecting a later addition.
4. Security measures
- Encryption in transit (TLS 1.2+) for all API and storage I/O.
- Encryption at rest at the Microsoft Azure storage + database layer.
- Tenant isolation enforced in the application layer: every query is scoped to a seller id derived from the authenticated session, never from anything the client sends.
- Service-role keys segregated and only used in server-side API routes / cron jobs.
- Audit log of every sensitive change (settings, GSTIN, recommendations, etc.).
- Per-route rate limiting + CSRF + signed-bearer-token cron auth.
- HMAC-signed WhatsApp webhook verification.
5. Data subject requests
If a data subject contacts us directly (e.g. an end-customer asking about their ship-to address in your seller account), we forward the request to you within 5 working days. You respond as the Data Fiduciary; we assist by extracting / deleting the relevant data when you instruct us to.
6. Personal data breach
If we discover or are notified of a personal-data breach affecting your data, we notify you in writing without undue delay (target: within 24 hours of confirmation). Notification includes the nature of the breach, categories and approximate volume of records involved, likely consequences, and the measures we've taken or propose to take. You report to the Data Protection Board of India per DPDPA s.8(6), we provide whatever evidence you need.
7. Audit + cooperation
Once per year, with 30 days notice, you may request an independent audit of our processing activities at our cost. We'll cooperate with the Data Protection Board and any supervisory authority as required.
8. Return + deletion
On termination, you may export your data via the dashboard or by emailing ecommerce@smeminds.com. After 30 days, we delete or irreversibly anonymise the data, except records we're legally required to retain.
9. Liability
Each party's liability under this DPA is subject to the limits in the main Terms of Service. Statutory rights under the DPDPA are not waived.
10. Order of precedence
Where this DPA conflicts with the Terms of Service, this DPA prevails for matters of data protection. The DPDPA prevails over both.
Contact
Grievance Officer: Maheshwariba Yadav · ecommerce@smeminds.com · SMEMINDS LLP, Surat, Gujarat