Shapzo

document: data-processing-agreement title: Data Processing Agreement version: 1.0.2 effectiveDate: 2026-10-12 status: published

Data Processing Agreement

This agreement forms part of the Terms of Service between:

  • Adhishva Tech, a sole proprietorship registered as a micro, small or medium enterprise (MSME) in India and based in Ahmedabad, Gujarat. It is not an incorporated company, so it has no CIN, and it is not currently registered for GST ("Shapzo", the Processor / Data Processor under DPDP s.2(k)); and
  • the Tenant — the business that operates a Shapzo workspace (the "Controller" / Data Fiduciary).

It is written to satisfy GDPR Art. 28(3) and to record the contract required by DPDP Act 2023 s.8(2), which makes the Data Fiduciary responsible for processing carried out on its behalf and requires it to be under a valid contract.

1. Roles

The Tenant is the Data Fiduciary / controller of its Salon Customers' personal data and of its own staff's data. Shapzo is the Data Processor, processing only on the Tenant's documented instructions.

Where Shapzo processes the Tenant's own account holders' data for its own purposes — authenticating them, securing the Platform, billing the Tenant, meeting its own legal obligations — Shapzo acts as a Data Fiduciary / controller in its own right, and the Privacy Notice rather than this agreement governs that processing.

2. Subject matter, duration, nature and purpose

Subject matter. Processing of personal data contained in the Tenant's workspace, in order to provide the Shapzo platform.

Duration. For as long as the Tenant's subscription is live, plus the post-termination period in section 12.

Nature of the processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, use, encryption, transmission to the sub-processors listed in Annex B, erasure, anonymisation and destruction — all by automated means.

Purpose. Solely to deliver the Platform's functions to the Tenant: appointment booking and scheduling; customer records; point-of-sale billing and GST invoicing; memberships, packages, gift vouchers and loyalty; inventory and purchase orders; payroll, attendance and leave; reporting; notifications; and — where the Tenant has not disabled it — the AI assistant and receipt scanning.

3. Types of personal data and categories of Data Principals

Categories of Data Principals / data subjects:

  1. The Tenant's owners, managers and staff (Authorised Users of the Platform).
  2. The Tenant's Salon Customers, whose details are entered by the Tenant's staff.
  3. The Tenant's suppliers' contact persons.

Types of personal data — set out in full in Annex A.

Special categories / sensitive data: health information (customer allergy and sensitivity notes; staff blood group) and financial identifiers (Aadhaar, PAN, UAN, ESIC, bank account details). Section 5 describes the additional safeguards applied to these. The Tenant is responsible for having a lawful basis for any health data it records — see section 4.4.

4. The Tenant's instructions and obligations

  1. Shapzo processes personal data only on the Tenant's documented instructions. The Terms of Service, this agreement, and the Tenant's use of the Platform's features together constitute those instructions.
  2. Shapzo will tell the Tenant if, in its opinion, an instruction infringes applicable data protection law, and may decline to act on it (GDPR Art. 28(3), final paragraph).
  3. Where Shapzo is required by law to process beyond the Tenant's instructions, it will inform the Tenant first unless that law prohibits it.
  4. The Tenant warrants that it has a lawful basis for the personal data it puts into the Platform; that it has given its Salon Customers the notice required by DPDP s.5 and GDPR Art. 13/14; that it holds consent where consent is the basis, in particular for marketing and for health information; and that it complies with TRAI's DLT and commercial- communications rules for messages sent through the Platform.

5. Confidentiality and security measures

Confidentiality. Shapzo ensures that every person authorised to process personal data under this agreement is bound by a duty of confidentiality, and grants access only on a need-to-know basis.

Technical and organisational measures (GDPR Art. 32; DPDP s.8(5)). The following are implemented in the Platform today, not planned:

| Measure | How it is implemented | |---|---| | Password protection | bcrypt hashing in a model hook, so no code path can store a plaintext password | | Session authentication | Signed JWT access tokens with a server-held secret | | Multi-factor authentication | TOTP or one-time code; the TOTP secret is AES-256-GCM encrypted under a key held separately from other secrets, and backup codes are stored as HMAC hashes | | Access control | Role-based access control on every protected endpoint, with a permission scope hierarchy (all → tenant → branch → own) | | Tenant isolation | Every query is scoped by tenantId; one Tenant cannot read another's data | | Encryption at rest, field level | AES-256-GCM on staff Aadhaar, PAN, UAN, ESIC and bank details; supplier PAN and bank details; and customer health notes | | Encryption at rest, storage level | Managed database and object-storage encryption provided by the hosting platform | | Encryption in transit | TLS, terminated at the hosting platform | | Audit logging | Sensitive and administrative actions are logged with actor, action, resource, timestamp and IP. Personal data is redacted at write time, and health fields are on the sensitive-field deny-list so an edit records that it changed, never the value. Retained 400 days | | Abuse and brute-force protection | Rate limiting on every endpoint, with stricter tiers on login, OTP, password reset, invitations and workspace switching | | Bulk-export control | Customer exports require an elevated permission, are branch-scoped, and every call is written to the audit log with the row count | | AI payload minimisation | Before any content reaches OpenAI, keys matching passwords, tokens, bank/IFSC/UPI details, Aadhaar/PAN, health notes, salary and card numbers are recursively stripped; rows are capped; and the available tools are filtered to the calling user's own permissions | | Data minimisation on erasure | Erasure anonymises rather than deletes where a statutory retention floor applies, so identity is removed while the financial record survives | | Availability | Daily automated backups of the managed database, retained for seven days by the hosting platform (DigitalOcean). A restore from backup is rehearsed as part of our release checks |

Certifications and testing. No ISO 27001 or SOC 2 certification is held, and none is claimed. Dependencies are scanned for known vulnerabilities on every build. No independent penetration test has been commissioned yet; when one is, its summary will be made available to Tenants on request.

6. Sub-processors

  1. The Tenant gives general written authorisation for Shapzo to engage the sub-processors listed in Annex B.
  2. Shapzo will give the Tenant 30 days' notice before adding or replacing a sub-processor. The Tenant may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Tenant may terminate the affected service without penalty.
  3. Shapzo imposes on each sub-processor data protection obligations no less protective than those in this agreement, and remains fully liable to the Tenant for their performance (GDPR Art. 28(4)).
  4. Each sub-processor is engaged under its own published data-processing terms. The current list, with what each receives, is Annex B and the public sub-processor register served by the Platform at /legal/sub-processors.

7. Assistance with Data Principal rights

Taking account of the nature of the processing, Shapzo assists the Tenant in meeting its obligations to Data Principals (GDPR Art. 28(3)(e); DPDP ss.11–13).

In practice, the Platform already lets the Tenant do this itself:

| Right | How | |---|---| | Access / portability | GET /api/customers/{id}/data-export returns a structured bundle of everything held about one customer. Each call is audit-logged | | Rectification | Edit the customer record in the portal | | Erasure | POST /api/customers/{id}/erase nulls the personal fields, including the encrypted health notes, and anonymises the identity on statutory financial records. Idempotent | | Withdraw marketing consent | A signed, login-free unsubscribe link on every marketing message, with re-subscribe from the same link |

Where a Data Principal contacts Shapzo directly, Shapzo will not respond substantively on the Tenant's behalf. It will redirect them to the Tenant and notify the Tenant promptly.

8. Personal data breaches

  1. Shapzo will notify the Tenant without undue delay after becoming aware of a personal data breach affecting the Tenant's data, and in any event within 72 hours.
  2. The notification will describe the nature of the breach, the categories and approximate number of Data Principals and records affected, the likely consequences, the measures taken or proposed, and a contact point.
  3. Shapzo will assist the Tenant with its own notification obligations — GDPR Arts. 33–34, and DPDP s.8(6), which requires notice to the Data Protection Board and to each affected Data Principal.
  4. Shapzo will not notify the Tenant's Data Principals or a supervisory authority on the Tenant's behalf unless required by law or instructed by the Tenant in writing.
  5. Shapzo will also assist the Tenant with data protection impact assessments and prior consultation under GDPR Arts. 35–36. Note that no DPIA has yet been completed for the health-data processing described in the Privacy Notice.

9. International transfers

The core of the Platform — database, object storage and cache — runs in DigitalOcean's Bangalore (blr1) region in India. SMS goes through MSG91 in India, and payment through Razorpay in India.

Transfers to the United States occur for email, push notifications, WhatsApp and fallback SMS, address autocomplete, and the optional AI features — the providers are named in Annex B.

  • DPDP s.16: transfers are permitted except to countries restricted by Central Government notification. None currently applies.
  • GDPR Chapter V: where the Tenant or its Data Principals are in the EU/EEA or UK, each US transfer requires an adequacy decision, the recipient's participation in the EU–US Data Privacy Framework, or Standard Contractual Clauses with a transfer impact assessment.

The Platform is offered to businesses in India only, so those GDPR mechanisms are not relied on: no Standard Contractual Clauses have been executed with these providers and no Data Privacy Framework coverage is claimed for them. A Tenant that is itself subject to the GDPR must not put EU or UK Data Principals' data into the Platform without first agreeing a transfer mechanism with Shapzo in writing.

The Tenant can eliminate the OpenAI transfer entirely by disabling AI processing for its workspace in Settings. All other product functions continue.

10. Audit rights

  1. Shapzo will make available to the Tenant the information necessary to demonstrate compliance with GDPR Art. 28, and will allow for and contribute to audits, including inspections, conducted by the Tenant or an auditor it mandates (GDPR Art. 28(3)(h)).
  2. Audits are limited to once in any 12-month period unless a personal data breach has occurred, on 30 days' written notice, with the scope agreed in advance. A completed security questionnaire, or the measures table in section 5 with supporting evidence, satisfies the right in the first instance. Each party bears its own costs.
  3. Shapzo may require that an auditor is not a competitor and signs a confidentiality undertaking, and may redact information relating to other Tenants — audits must not themselves become a route to another Tenant's data.

11. Retention

Shapzo applies the retention periods in its published data retention schedule, summarised in the Privacy Notice. Statutory floors — Companies Act 2013 s.128 (8 years), GST rules (72 months), the Income Tax Act (6 years) and applicable wage/shops-and-establishments legislation (typically 3 years; Shapzo keeps payroll registers for 8 years) — take precedence, and are met by anonymising identity while retaining the financial record.

12. Deletion or return on termination

  1. On termination, and at the Tenant's choice, Shapzo will delete or return all personal data processed on the Tenant's behalf, and delete existing copies — unless applicable law requires storage (GDPR Art. 28(3)(g)).
  2. The Tenant may export its data for 30 days after termination. After that window, data is deleted or anonymised.
  3. Records subject to a statutory retention floor are anonymised and retained for the remainder of that period, then destroyed. Anonymised records are no longer personal data.
  4. Routine backups expire on their own cycle; Shapzo will not restore deleted data from a backup except to recover from an incident. Backups are retained for seven days.

13. Liability and general

Liability under this agreement is governed by the Terms of Service, subject to section 10.5 of those terms (nothing limits either party's obligations under data protection law, or a Data Fiduciary's statutory liability to a Data Principal). This agreement is governed by the laws of India; the dispute forum is the one stated in the Terms of Service. Where this agreement conflicts with the Terms of Service on a data protection matter, this agreement prevails.

Grievance Officer (DPDP s.8(9)): Darshan Chavda, [email protected].

Annex A — Types of personal data

Authorised Users (salon owners, managers, staff) Name; email address; phone number and its verification status; password (bcrypt hash); two-factor secret (encrypted) and backup codes (hashed); role and permissions; branch assignment; language, date-format and time-zone preferences; login IP address and browser user-agent; audit-log entries; attendance and punch-clock records; shifts and rosters; leave requests and balances; salary, pay-run lines, advances, commissions and tips; Aadhaar, PAN, UAN, ESIC and bank account details (encrypted); blood group (health data); performance reviews.

Salon Customers Name; phone number; email address; date of birth; gender; address; appointment and visit history; services taken and the staff member who performed them; invoices, payments, taxes, refunds; memberships, packages, gift vouchers and loyalty balances; preferences and free-text staff notes; marketing consent state and unsubscribe history; family/household links, tags and segments; Razorpay customer reference; allergy and sensitivity notes (health data, encrypted).

Supplier contacts Name; contact details; PAN and bank details (encrypted).

Annex B — Authorised sub-processors

Derived from the codebase, with the calling file named so each row can be verified.

| Sub-processor | Purpose | Data | Location | Called from | |---|---|---|---|---| | DigitalOcean | Hosting: managed MySQL, Spaces object storage, Redis | All Platform data | Bangalore, India | src/config/database.js, src/utils/objectStorage.js, src/services/reports/reportStorage.js, src/config/redis.js | | MSG91 | Transactional SMS and OTP | Phone numbers, message bodies | India | src/services/notifications/channels/msg91.js | | Razorpay | Subscription billing | Billing details; a customer reference stored on the customer row | India | src/utils/razorpayService.js | | Twilio | WhatsApp messaging; SMS fallback only | Phone numbers, message bodies | United States | src/services/notifications/channels/twilio.js, channels/whatsapp.js | | Google (Gmail SMTP) | Transactional email | Email addresses, message bodies | United States | src/utils/email.js | | Google (Firebase Cloud Messaging) | Push notifications | Device tokens, notification payloads | United States | src/services/notifications/channels/push.js; portal src/lib/push.js | | Google Maps | Address autocomplete (called by the user's browser) | Addresses typed by portal users | United States | Portal, VITE_GOOGLE_MAPS_API_KEY | | Sentry (Functional Software, Inc.) | Error and crash reporting | Error messages and stack traces with numbers and emails masked; route or screen; device and app version; user and business ids | Frankfurt, Germany (EU) | src/config/sentry.js; portal, admin and mobile src/lib/sentry.js | | OpenAI | Optional — receipt/menu scanning and the AI assistant | Uploaded images; assistant prompts and the bounded, key-scrubbed rows its read-only tools return | United States | src/utils/openaiClient.js, src/services/ai/, src/services/expenses/receiptOcr.js |

Not sub-processors: Bitbucket/Atlassian are used for source code and issue tracking by our developers. The Platform sends no personal data there. Listed so the absence reads as a decision rather than an oversight.

OpenAI terms. The Platform uses the OpenAI API under OpenAI's published API terms, which state that API inputs and outputs are not used to train OpenAI's models and may be retained for up to 30 days for abuse monitoring. No zero-data-retention arrangement has been agreed. A Tenant that does not accept this can disable AI processing in Settings, which stops any content reaching OpenAI.