Legal
Data processing agreement
Last updated 7 November 2026
Draft, under legal review
This agreement explains how Arjun Raj, trading as Digital Architect ("OptProof"), a sole proprietorship with GSTIN 29DOHPR6992Q1ZH and its principal place of business at No 2 & 03, Ashrivadam, Opposite 5th Cross, Sidedahalli, near NMH Convention Hall, Bengaluru, Bengaluru Urban, Karnataka 560073, India, handles personal data on behalf of a business that uses OptProof (the "customer"). It forms part of our terms of service. If the two conflict on how personal data is handled, this agreement applies.
1. Roles#
- The customer is the data fiduciary. It decides why and how the personal data of its customers, patients, students or other data principals is processed.
- OptProof is the data processor. We process that personal data only to provide OptProof to the customer, and only on the customer's documented instructions.
- OptProof is a consent management tool used by the customer. It is not a Consent Manager under Rule 4 of the DPDP Rules, and it does not act for data principals.
2. What we process#
| Item | Details |
|---|---|
| Data principals | The customer's website visitors, app users, patients, students, members, leads and other people whose consent the customer records. |
| Personal data | Pseudonymous references (principal_ref, device_ref), consent decisions, phone numbers and email addresses used for one-time codes and receipts (encrypted), rights requests and their messages, and any data the customer sends in API calls or imports. |
| Purposes | Capturing and recording consent, issuing receipts, running the preference centre and rights portal, sending consent changes to the customer's tools, and producing evidence exports. |
| Duration | For as long as the customer uses OptProof, then as set out in section 9. |
The consent ledger and receipts contain no names, phone numbers or email addresses. They hold a keyed pseudonymous reference instead.
3. Instructions#
We act on the customer's instructions, which are given through these terms, the settings and actions in the OptProof console, and API calls. If we think an instruction breaks the DPDP Act or another law, we will tell the customer and may pause that instruction.
4. Confidentiality#
Everyone at OptProof who can access customer personal data is bound by confidentiality. Staff access is limited to what they need, uses separate sign-in with two-factor authentication, and is recorded. Support staff can view a customer workspace only with a recorded reason, for a limited time, with a visible banner.
5. Security measures#
| Area | What we do |
|---|---|
| Location | The customer's personal data is stored in India, in AWS Mumbai (ap-south-1). Section 11 covers email delivery and AI features. |
| Hosting | OptProof runs on one server in AWS Mumbai. The database and job queue run on that server. The database is backed up every night, encrypted, to storage in AWS Mumbai. There is no standby server yet, so recovering from a server fault means restoring from the latest backup. |
| Encryption | HTTPS for data in transit. Backups and stored files are encrypted. Phone numbers, email addresses and integration credentials are additionally encrypted with envelope encryption under AWS KMS in Mumbai. |
| Ledger | Consent events, receipts, daily anchors and audit logs are append-only. The application cannot edit or delete them. Daily anchors are written to write-once storage. |
| Isolation | Each customer's data is separated with row-level security in the database. |
| Keys | Secret API keys are stored only as hashes. Receipt signing keys are held in AWS Secrets Manager in Mumbai. |
| Logging | Application logs remove phone numbers, email addresses, names, IP addresses and tokens. |
| Testing | An external penetration test is planned before public launch; high and critical findings will be fixed before launch. |
More detail is on our security page.
6. Sub-processors#
The customer authorises OptProof to use the sub-processors listed on our sub-processors page. We will give at least 30 days' notice before adding or replacing a sub-processor, and the customer may object on reasonable data-protection grounds. We remain responsible for our sub-processors and bind each of them to data-protection terms at least as protective as these.
7. Personal data breaches#
If we become aware of a personal data breach affecting the customer's data, we will tell the customer without undue delay, and in any case within a number of hours still to be agreed. We will share what we know about what happened, the data and people affected, and what we are doing about it, and update the customer as we learn more.
The customer, as data fiduciary, decides on and makes any intimation to the Data Protection Board and to affected data principals. OptProof never sends these on the customer's behalf without the customer's approval.
8. Helping the customer#
We will help the customer meet its own duties, mainly through features of OptProof:
- Rights requests: the rights portal, request desk and due dates help the customer answer requests for access, correction, update, erasure, nomination and grievances.
- Withdrawal: the preference centre lets data principals withdraw as easily as they consented, and webhooks and connectors carry the change to the customer's other tools.
- Evidence: evidence exports and chain verification help the customer show what was collected and when.
- Breaches and assessments: we will give reasonable information the customer needs for breach handling and any data-protection assessment.
9. Deletion and return at the end#
When the customer leaves, it can export its data for 30 days. After that we delete the customer's personal data, except:
- consent evidence the customer has configured us to keep for a retention period, which we keep until that period ends and then delete; and
- data we must keep by law, such as invoices.
Daily anchors in write-once storage cannot be deleted before their retention period ends. They contain no personal data.
10. Audits#
We will make information available that the customer reasonably needs to check we are meeting this agreement, including our security documentation and, once completed, a summary of our external penetration test. Where that is not enough, the customer may request an audit on reasonable notice, at its own cost, no more than once a year, subject to confidentiality.
11. Transfers outside India#
We do not store or replicate the customer's personal data outside India. Two services handle some data elsewhere, or in a location we are still confirming:
- Email. One-time codes, request confirmations and reminders are sent through our email provider, Hostinger. It handles the recipient's email address and the message text. Hostinger stores mailboxes and their backups in the European Union (France or Germany); it assigns the data centre and may move mailboxes between the two.
- AI features. Names, phone numbers and email addresses are removed before any text is sent to the model provider, Anthropic, which processes that redacted text outside India. A person at the customer reviews the output.
12. Contact#
Questions about this agreement: privacy@optproof.in.