Data Processing Addendum

In this DPA, capitalised terms have the following meanings:

• DPDP Act means the Digital Personal Data Protection Act, 2023, and any rules, regulations, or directions issued thereunder (as amended from time to time).
• Data Fiduciary means MarshallRidge Consulting Private Limited, which determines the purpose and means of processing your personal data.
• Data Principal means you, the individual to whom the personal data relates.
• Data Processor means any person (including a sub-processor) who processes personal data on behalf of the Data Fiduciary.
• Personal Data has the meaning given in the DPDP Act and includes all data described in § 2 of the Privacy Notice.
• Processing means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, sharing, alteration, transmission, or deletion.
• Sub-Processor means any third-party service provider engaged by the Data Fiduciary to process Personal Data on its behalf.

Roles under this DPA: MarshallRidge Consulting Private Limited acts as the Data Fiduciary with respect to all Personal Data processed through the Platform. Where MarshallRidge Consulting Private Limited processes Personal Data on behalf of a business customer (e.g., a company that has purchased a Team or multi-seat plan and is the account holder for its employees), MarshallRidge Consulting Private Limited may also act as a Data Processor for that business customer acting as a Data Fiduciary in its own right — in which case a separate DPA between the parties may be required.

The Company processes the following categories of Personal Data on behalf of Data Principals for the purposes specified:

• Identity and contact data (name, email, phone, timezone) — Purpose: account authentication, service delivery, and support communications.
• Usage and log data (daily tracker entries, body data, business ledger entries, task data, mood and reflection data) — Purpose: providing the core tracking and analytics features of the Platform.
• AI query data (Wisdom Corner questions and responses) — Purpose: generating AI-powered guidance and storing query history for the Data Principal.
• Community content (posts, messages, profile content) — Purpose: enabling community and networking features where available.
• Security and audit data (IP address, user-agent, operation timestamps) — Purpose: fraud prevention, security monitoring, and audit log provision to the Data Principal.
• Billing data (subscription status, plan, payment timestamps) — Purpose: subscription management and GST invoice generation. Payment credentials are processed directly by Razorpay and never processed by the Company.
• Push notification data (browser endpoint, keys — only if opted in) — Purpose: delivering the reminders and notifications you have elected to receive.

The Company will not process Personal Data for any purpose other than those described above and in the Privacy Notice, unless required by applicable law, in which case the Company will inform the Data Principal of that legal requirement before processing (unless prohibited by law from doing so).

The Company ensures that all persons authorised to process Personal Data are subject to appropriate confidentiality obligations (whether by employment contract, professional duty, or separate non-disclosure agreement) and are trained on data protection requirements applicable to their role.

The Company will not disclose Personal Data to any third party except: (a) to its Sub-Processors in accordance with § 5 of this DPA; (b) as required by applicable law, court order, or regulatory direction; or (c) with the Data Principal’s prior, informed consent.

The Company implements and maintains appropriate technical and organisational measures (“TOMs”) to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. The TOMs include, at minimum:

• Encryption in transit:All data transmitted between the Data Principal’s device and the Platform is encrypted using TLS 1.2 or higher (HTTPS-only). Plaintext transmission of Personal Data is not permitted.
• Encryption at rest: Personal Data stored in the database is encrypted at rest using AES-256 encryption provided by Supabase (Mumbai region). Sensitive fields (e.g., financial identifiers) are additionally encrypted at the application layer using a separate field-level encryption key.
• Access control and authentication: Access to production systems requires multi-factor authentication and is restricted to authorised personnel on a need-to-know basis. All production access is logged and reviewed.
• Database row-level security: Database-level row security policies ensure that each authenticated user can access only their own data. Administrative access to individual user data is restricted to incident response scenarios.
• Password security: User passwords are hashed using bcrypt with a sufficient cost factor. The Company does not store plaintext passwords.
• Token security: Authentication tokens are signed JWTs with short expiry windows. Refresh tokens are rotated on each use.
• Audit logging: All sensitive operations are logged with timestamp, IP address, user-agent, and operation type. Audit logs are retained for 12 months.
• Vulnerability management: The Company conducts periodic security reviews and applies security patches to production systems in a timely manner.
• Incident response: The Company maintains an incident response plan and designated security contacts to respond to data breaches and security incidents promptly.

The Company will not materially reduce the level of security set out above during the term of the relationship. The Company may update or enhance security measures over time in response to changes in technology, risk environment, or legal requirements.

The Company currently engages the following Sub-Processors to assist in delivering the Platform. By accepting these Terms, you authorise the engagement of these Sub-Processors for the purposes stated:

• Supabase, Inc.
  Purpose: Database, authentication, file storage.
  Data region: Mumbai (ap-south-1), India.
• Vercel, Inc.
  Purpose: Web application hosting & edge delivery.
  Data region: Global edge with primary in Mumbai.
• Anthropic PBC
  Purpose: AI model that powers Wisdom Corner answers.
  Data region: United States (data not used for training per Anthropic's API policy).
• Google FCM / Apple APNS
  Purpose: Web push notification delivery (when you enable notifications).
  Data region: Global.
• Razorpay Software Pvt. Ltd.
  Purpose: Payment processing (only when you upgrade to a paid plan).
  Data region: India.
• Google LLC (Google Analytics)
  Purpose: Website usage analytics — loads only after you accept cookies.
  Data region: United States / Global.
• Meta Platforms, Inc. (Meta / Facebook Pixel)
  Purpose: Website analytics & ad measurement — loads only after you accept cookies.
  Data region: United States / Global.

Sub-processor changes.The Company will provide at least 14 days’ prior written notice (via in-app notification or email) before engaging a new Sub-Processor or materially changing the role of an existing Sub-Processor. If you reasonably object to the new Sub-Processor on legitimate data-protection grounds within 14 days of notice, the Company will use reasonable efforts to implement a solution that addresses your objection. If no solution can be agreed, you may terminate your account.

Sub-processor obligations.Before engaging any Sub-Processor, the Company will enter into a written agreement that imposes data-protection obligations substantially equivalent to those in this DPA. The Company remains responsible to the Data Principal for the Sub-Processor’s compliance with its obligations under that agreement.

The Company will, taking into account the nature of the processing, assist the Data Principal in exercising their rights under the DPDP Act by:

• providing self-service tools in the Platform for access (data export as JSON), correction (edit any logged entry or profile field), and erasure (account deletion) of Personal Data;
• acknowledging and responding to rights requests submitted to the Grievance Officer within the SLA specified in § 8 of the Privacy Notice;
• providing a mechanism for nominating a person to exercise rights in the event of the Data Principal’s death or incapacity (contact the Grievance Officer); and
• implementing any correction or erasure of Personal Data upon a valid and verified request, subject to mandatory legal retention obligations.

The Company will retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law. Full retention schedules are set out in § 6 of the Privacy Notice. In summary:

• On account deletion: all Personal Data is permanently deleted within 24 hours, except for data subject to mandatory legal retention.
• GST invoices and billing records: retained for 8 years as required by Indian tax law.
• Security and fraud audit logs: retained for 12 months.
• Inactive trial accounts: automatically purged after 90 days of inactivity.
• Encrypted backups: deleted within 30 days following account deletion (rolling backup rotation).

The Company does not “return” Personal Data in a separate file to business customers — the self-service data-export tool in Settings provides the Data Principal with a complete, machine-readable JSON export of all their Personal Data at any time. On request to the Grievance Officer, additional export formats may be considered.

In the event of a personal data breach, the Company will, without undue delay and in any case within the timeframes required by applicable law:

• Notify the Data Protection Board of India within the prescribed timeframe under the DPDP Act, 2023 and its rules.
• Notify CERT-In within 6 hours of becoming aware of a qualifying cybersecurity incident under the CERT-In Directions (April 2022).
• Notify affected Data Principals of the breach including: the nature of the breach; the categories and approximate number of individuals and Personal Data records affected; the likely consequences; and the measures taken or proposed to address the breach.
• Maintain internal records of all breaches, including those that do not trigger a mandatory notification obligation.

Where you are a business user with a Team plan or a separately negotiated enterprise agreement, and you have a legitimate compliance need, you may request:

• Written confirmation that the Company is processing Personal Data in accordance with this DPA (available by email to contact@marshallridgeconsulting.inwith subject “DPA Compliance Confirmation”); or
• A summary of the most recent third-party security assessment or penetration test (to the extent shareable without compromising security).

The Company is not required to grant on-site audit access unless specifically required by applicable law or a competent regulatory authority. Any audit or inspection shall be conducted at the requesting party’s cost, on at least 30 days’ prior written notice, during normal business hours, and in a manner that does not unreasonably disrupt the Company’s operations.

The Company transfers Personal Data outside India only to the Sub-Processors listed in § 5 of this DPA and § 5 of the Privacy Notice, and only for the purposes specified. The Company ensures appropriate safeguards for cross-border transfers in accordance with Section 16 of the DPDP Act and any regulations or notifications issued thereunder, including:

• Anthropic PBC (US):Wisdom Corner queries are processed under Anthropic’s enterprise API terms, which include commitments that API inputs are not used to train models and that data is processed only for the purpose of returning inference responses. All data is encrypted in transit (TLS).
• Google FCM / Apple APNS (Global): Only non-sensitive notification content is transmitted. No health, financial, or tracker data is included.
• Vercel (Global edge): Only static application assets are served from global edge nodes; Personal Data remains stored in Supabase Mumbai (ap-south-1).

The Company will comply with any restrictions or conditions on cross-border transfers that are imposed by the Government of India under the DPDP Act, including any list of countries to which transfers are restricted.

Liability cap.The Company’s maximum aggregate liability for any claims arising under or in connection with this DPA shall be subject to the same liability cap set out in § 16 of the Terms of Use — the greater of: (a) the total fees paid by the Data Principal to the Company in the 12 months preceding the claim; or (b) ₹10,000 (Indian Rupees Ten Thousand only).

Mandatory carve-outs — the above cap does not apply to: (i) the Company’s fraud or fraudulent misrepresentation; (ii) the Company’s gross negligence or wilful misconduct; (iii) death or personal injury caused directly by the Company’s negligence; or (iv) non-excludable liability under the DPDP Act, 2023 or any other non-derogable applicable law, including any penalties imposed by the Data Protection Board of India.

Precedence. In case of conflict between this DPA and the Terms of Use on any data-protection matter, this DPA prevails. In all other matters, the Terms of Use prevail over this DPA.

Penalties under DPDP Act. The Company acknowledges that the DPDP Act, 2023 may impose financial penalties on Data Fiduciaries for breaches of their obligations. Contractual liability caps do not limit, modify, or exclude any penalty that the Data Protection Board of India may impose on the Company under applicable law.

This DPA is governed by the laws of India. Any dispute arising under or in connection with this DPA shall be resolved in accordance with the dispute-resolution provisions in §§ 18–21 of the Terms of Use (informal resolution, arbitration for paid/business users, and preservation of consumer forum rights).

The parties acknowledge that the Data Protection Board of India has jurisdiction over complaints relating to violations of the DPDP Act. The dispute-resolution provisions of the Terms of Use do not limit or replace the Data Principal’s right to approach the Data Protection Board of India.

• Incorporation. This DPA is incorporated into and forms part of the Terms of Use. Terms defined in the Terms of Use have the same meaning in this DPA unless otherwise defined here.
• Updates.The Company may update this DPA to reflect changes in applicable law, guidance from the Data Protection Board of India, or the Company’s data-processing practices. Material changes will be notified in accordance with § 25 of the Terms of Use.
• Severability. If any provision of this DPA is found invalid or unenforceable, the remaining provisions continue in full force and effect.
• Entire agreement on data. This DPA and the Privacy Notice constitute the entire agreement between the parties relating to the processing of Personal Data and supersede all prior understandings on that subject.

For all data-processing queries, rights requests, and DPA-related communications:

Grievance Officer: Narendra Pratap Singh Tomar
Email: contact@marshallridgeconsulting.in
Postal address: MarshallRidge Consulting Private Limited, A Unit No 52, 2nd Flr, P No C-39A, Gami Ind. Park, MIDC, Thane 400705, Maharashtra, India

See also: Privacy Notice · Terms of Use · Disclaimer