Data Processing Addendum
Last updated: 19 October 2026
Draft — pending legal review. Text in [square brackets] is still to be confirmed.
1. Scope and parties
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between UnitOne AI [Private Limited — confirm exact registered name], [Registered office address], [Hyderabad, Telangana], India (“Processor”, “UnitOne AI”) and the business using Beyond Replying (“Business”). It applies to personal data of the Business’s customers, prospects, group members and staff that UnitOne AI processes on the Business’s behalf (“Customer Personal Data”). If this DPA conflicts with the Terms on data protection, this DPA prevails.
Terms such as Data Fiduciary, Data Processor, Data Principal and personal data breach have the meanings in the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules; for data subject to the GDPR, “controller”, “processor” and “data subject” apply equivalently.
2. Roles
The Business is the Data Fiduciary (controller) and decides the purposes of processing. UnitOne AI is the Data Processor. The Business is responsible for having a lawful basis (including any consent and notice under sections 5–6 of the DPDP Act) for the data it collects through Beyond Replying and for the accuracy of its instructions.
3. Details of processing
| Item | Description |
|---|---|
| Subject matter and purpose | Answering the Business’s customers with an AI assistant, taking orders and bookings, managing stock, alerting staff, and the related dashboard, support and security. |
| Data Principals | The Business’s customers and prospects, members of WhatsApp groups it connects, and its staff. |
| Personal data | Names/profile names, phone numbers or chat-app IDs, widget visitor IDs, chat messages, delivery addresses and notes, orders and bookings, opt-out status, staff contact numbers. |
| Sensitive data | Not intended. The Business should not instruct the collection of financial account, health, biometric or government ID data through chat. |
| Duration | For the term of the Terms, then until deletion under section “Return and deletion”. Chats follow the retention period the Business sets (7 days – 5 years; default 180 days). |
4. Processing on instructions
UnitOne AI processes Customer Personal Data only on the Business’s documented instructions — the Terms, this DPA, and the Business’s configuration and use of the dashboard — unless the law requires otherwise (in which case we will inform the Business first unless the law prohibits it). We will tell the Business if we believe an instruction breaks applicable data-protection law. We do not sell Customer Personal Data or use it for our own purposes, including advertising or training AI models.
5. Confidentiality
Only personnel who need access to provide or support the service may access Customer Personal Data, and they are bound by confidentiality obligations. UnitOne platform admins see aggregate usage only; named super-admins may view chats or customer records only for support the Business requested, security or legal reasons, and every view is logged in a platform access log available to the Business on request.
6. Security measures
UnitOne AI maintains reasonable security safeguards as required by section 8(5) of the DPDP Act and the SPDI Rules, including:
- encryption in transit (TLS 1.2+) and at rest (database and backups), plus field-level AES-256-GCM encryption of customer addresses, notes, channel tokens and two-step login secrets;
- logical separation of each Business’s data enforced by PostgreSQL row-level security and application checks;
- role-based access control, mandatory two-step login for owners and admins, session time-outs, argon2id password hashing and attempt limits;
- an audit log of dashboard actions and a log of all UnitOne staff access to Business data;
- hosting in AWS Mumbai (India) on private networks, secrets held in a secrets manager, backups with point-in-time recovery;
- automatic deletion of chats after the retention period, and minimisation (phone numbers are not sent to AI providers; media is not downloaded).
7. Sub-processors
The Business gives general authorisation for the sub-processors below. UnitOne AI imposes data-protection obligations on each that are no less protective than this DPA and remains responsible for their performance.
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services India Pvt. Ltd. (AWS) | Hosting of the application, worker, database and encrypted backups | India (Mumbai, ap-south-1) | All service data |
| OpenAI, L.L.C. | AI language models (via API) to understand messages and draft replies | United States | Chat text, catalog and order details (no phone numbers) |
| Anthropic, PBC | AI language models (via API) to understand messages and draft replies | United States | Chat text, catalog and order details (no phone numbers) |
| Meta Platforms, Inc. / Meta Platforms Ireland Ltd. | WhatsApp Business Platform (Cloud API), Instagram and Messenger message delivery | United States, EU and other Meta locations | Messages, phone numbers / account IDs, profile names |
| Telegram Messenger Inc. (Telegram FZ-LLC) | Telegram bot message delivery | UAE and other Telegram locations | Messages, Telegram user IDs and names |
| [Email provider — e.g. Amazon SES / other SMTP provider] | Account and security emails (sign-up, password reset, alerts) | [Location] | Staff names and email addresses |
| [Payment gateway — e.g. Razorpay] | Subscription payments | India | Billing contact and payment details (business accounts only) |
We will give at least [30] days’ notice of a new or replacement sub-processor through the sub-processors page and by email. The Business may object on reasonable data-protection grounds; if we cannot reasonably accommodate the objection, the Business may terminate the affected service and receive a pro-rata refund of prepaid fees.
8. International transfers
Customer Personal Data is stored in India. Sub-processors may process it outside India as listed above. Transfers are made only to countries not restricted by the Government of India under section 16 of the DPDP Act and, for data subject to the GDPR, under Standard Contractual Clauses or another valid transfer mechanism.
9. Personal data breach
UnitOne AI will notify the Business without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data, at the account owner’s email. The notice will describe, as far as known, the nature and likely impact of the breach, the data and Data Principals affected, measures taken or proposed, and a contact person, and will be updated as more is learned. We will cooperate so the Business can notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act and rules, and we will report to CERT-In where its Directions require.
10. Assistance
- Data Principal requests: the dashboard lets the Business access, export, correct and erase a customer’s data and see opt-outs. If we receive a request directly, we will forward it to the Business without undue delay and not answer it ourselves unless instructed.
- Grievances and compliance: we will reasonably assist the Business with grievance redressal, data protection impact assessments, and responses to the Data Protection Board or other authorities, taking into account the nature of processing.
11. Return and deletion
The Business can export its data at any time. On termination, UnitOne AI deletes Customer Personal Data within [90] days, or earlier on written request, unless the law requires us to keep it. Data in encrypted backups is overwritten on the normal backup cycle ([35] days) and is not restored except for disaster recovery. On request we will confirm deletion in writing. During the term, chats are deleted automatically at the end of the retention period the Business chooses, and erasure requests made in the dashboard take effect immediately.
12. Audits and information
On written request (no more than once a year, unless after a breach or at an authority’s demand), UnitOne AI will provide information reasonably necessary to demonstrate compliance with this DPA, such as security documentation, a completed security questionnaire, and any available third-party audit or penetration test summaries. If that is not sufficient, the Business may conduct an audit with an independent auditor bound by confidentiality, on [30] days’ notice, during business hours, without disrupting the service and at the Business’s cost.
13. Liability and term
Each party’s liability under this DPA is subject to the limitation of liability in the Terms, to the extent the law allows. This DPA lasts as long as UnitOne AI processes Customer Personal Data for the Business.
14. Contact
Data protection contact: privacy@unitoneai.com. Grievance Officer: grievance@unitoneai.com. A countersigned copy of this DPA is available on request.