Legal · DPDP Act, 2023
Data processing addendum
Effective date — pending legal review
Draft for review. These terms have not yet been reviewed by a lawyer — do not rely on them until they have. Questions meanwhile: ayush@capeasy.in.
Roles
This addendum forms part of the agreement between your company and CapEasy for the Saral service. For personal data your company records in Saral about its own stakeholders (for example, employees, shareholders, or option holders), your company is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP), and we are the Data Processor, acting only on your instructions.
Purpose and scope of processing
We process personal data solely to provide the Saral service to your company: running the cap table and ESOP ledger, generating compliance filings, and supporting the workflows you use the product for. We do not process this data for any other purpose, including marketing or analytics unrelated to the service.
Categories of data and data principals
- Data principals:your company’s stakeholders — shareholders, employees with ESOP grants, directors, and other individuals your company records in the product.
- Categories of data: name, contact details, holdings and grant records, and identifiers required by statute for filings (for example, PAN and DIN, where a filing requires them).
Security measures
- Row-level security in the database, keyed on company, so one company’s data is never visible to another.
- Encryption in transit (TLS) and at rest for all stored data.
- Role-based access control inside each company’s account (founder, CS, CA, investor, employee).
- An append-only audit trail of ledger events, so changes to equity records are traceable.
Sub-processors
We use the following sub-processors to provide the service:
| Sub-processor | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | Mumbai, India (ap-south-1) |
| Vercel | Application hosting | Global edge network, request-routed |
| Resend | Transactional email delivery | United States |
We will notify your company before adding a new sub-processor that will handle your company’s data.
Data residency
The Saral database and file storage are hosted in Mumbai, India (ap-south-1). Personal data your company records in the product is stored in India.
Breach notification
If we become aware of a personal data breach affecting your company’s data, we will notify your company without undue delay, with what we know at the time about the nature and likely impact of the breach.
Assisting with data principal rights
If a data principal contacts us directly about their data inside your company’s account, we will route the request to your company and assist you in responding to access, correction, or erasure requests from your company’s stakeholders.
Retention and deletion
We retain your company’s data for as long as your company uses the service. On termination, we will give your company a reasonable window to export its data before we delete it, except where a statute requires us to retain specific records.
Audit rights
Your company may request information reasonably needed to confirm we are meeting the commitments in this addendum. We will respond to reasonable audit requests, subject to confidentiality of our other customers’ data and systems.