Data Processing Agreement

This Data Processing Agreement (the "DPA") applies whenever SOLIFEIN SOLUTIONS PRIVATE LIMITED, trading as SoLifeIN ("we", "us"), processes personal data on behalf of a client ("you") while providing our services — for example your customers' details in your store, the conversations your AI agents or WhatsApp automation handle, or the lists we use to run your marketing. It forms part of our Terms of Service and of every engagement under them. How we handle data about visitors to our own website is covered separately in our Privacy Policy.

Under India's Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP law"), you are the Data Fiduciary for your customers' personal data, and we act as your Data Processor.

01What we process, and why

• Whose data: your customers, prospects, subscribers and others who interact with your brand.
• What data: typically names, phone numbers, email addresses, delivery addresses, order and payment status (never full card details), and the messages and conversations they have with your website, store, AI agents or WhatsApp.
• Why: only to deliver the services in your package or quote — running your website or store, marketing and reporting, and operating your AI agents and messaging.

02We act only on your instructions

• We process your customers' personal data only to provide our services to you and as you instruct, never for our own purposes, and we never sell it.
• You remain responsible, as Data Fiduciary, for having a lawful basis to collect your customers' data and for the notices and consents the DPDP law requires you to give them.
• If we believe an instruction would break the DPDP law, we will tell you rather than follow it.

03AI agents and your data

• Your agents run on your own content — your products, policies and FAQs — and on the conversations they handle for you.
• Your data never trains AI models for anyone else. We do not use your customers' personal data, your content or your conversations to train, fine-tune or improve any model or agent for another client, for ourselves, or for anyone other than you.
• We use AI model providers only on their business API terms, under which the data we send is not used to train their models.
• Conversation logs and knowledge bases are kept only as long as your agents need them, and are deleted as set out in section 09.

04Security

• We apply reasonable security safeguards to prevent personal data breaches, as the DPDP law requires.
• Access is limited to the people working on your account, each with their own login, and removed when they no longer need it.
• Data is encrypted in transit, and we use two-factor authentication on the accounts that hold your data wherever the service supports it.
• Everyone on our team who handles your data is bound to keep it confidential.

05Sub-processors

We use a small number of service providers ("sub-processors") to deliver our services. You authorise us to use these:

• Netlify — website hosting and form handling.
• GoDaddy — our business email.
• Rewind — backups of the Shopify stores we run for you, where your package includes Shopify backups.
• Google Workspace — the business email mailboxes included in your package.
• Anthropic, OpenAI and Google — AI models that power your agents.
• Meta — the WhatsApp Business Platform, where your package includes WhatsApp automation.

We hold each sub-processor to data protection obligations no weaker than this DPA, and we remain responsible to you for their work. Before adding or replacing a sub-processor that will handle your data, we will tell you. If you object on reasonable grounds, we will discuss alternatives; if none works, you may end the affected service.

06Where your data is processed

Some sub-processors process data outside India. We will not transfer your customers' personal data to any country or territory the Government of India has restricted under the DPDP law.

07If there is a breach

• If we become aware of a personal data breach affecting your customers' data, we will notify you within 24 hours, with what we know at that point, and keep you updated as we learn more.
• We will help you meet your own duties to inform the Data Protection Board of India and the people affected, and take reasonable steps to contain the breach.

08Helping you with your customers' rights

If one of your customers asks to access, correct or erase their data, or raises a grievance, we will help you respond. If a request reaches us directly, we will pass it to you promptly rather than answer it ourselves.

09When the engagement ends

• On request, we will export your customers' personal data to you in a common format.
• Within 30 days of the engagement ending, we delete it — including AI agent knowledge bases and conversation logs — unless the law requires us to keep it. Copies in backups are deleted as those backups expire.

10Showing that we comply

We will give you the information you reasonably need to show that this DPA is being followed, and answer reasonable questions about how we handle your data.

11Liability and changes

The limitation of liability in section 08 of our Terms of Service applies to this DPA. We may update this DPA from time to time; when we do, we will change the "Last updated" date above, and for an engagement already under way the change takes effect from your next billing month.

12Contact