Data processing agreement

1. Parties and roles

This agreement is between your business (the data fiduciary) and Code Trays Information Technology Pvt Ltd, which runs waca.ai (the data processor). It applies to personal data of your customers, leads and contacts that waca.ai processes for you, and forms part of the terms of service.

2. What we process and why

• Data: names, phone numbers, emails, addresses, custom fields, chat messages and media, call recordings, transcripts, AI summaries, consent and opt-out records.
• People: your customers, leads, callers and the people in lists you import.
• Purpose: only to provide waca.ai to you — messaging, calling, AI agents, journeys, reports, integrations you switch on — for as long as your account is active.

3. Your instructions

We process the data only on your documented instructions — your settings, journeys, agents and API calls are those instructions. If we believe an instruction breaks the DPDP Act or another law, we will tell you and may refuse to carry it out. You confirm you have a lawful basis (normally consent) for every person you add, and that you give them your own privacy notice.

4. Confidentiality and our staff

Only people who need access to run or support the service can reach your data, under confidentiality duties. waca.ai support opens your workspace only when the owner grants time-limited support access, and every visit is recorded in your audit log.

5. Sub-processors

You allow us to use these categories of sub-processors, each bound by written terms at least as protective as these:

We will tell account owners at least 15 days before adding or replacing a sub-processor, so you can object. Some sub-processors are outside India; transfers follow section 16 of the DPDP Act.

6. Security

We keep reasonable security safeguards: encryption in transit, encrypted storage of credentials and secrets, role-based access, two-step verification, audit logs, signed and expiring links to recordings, backups, and separation of each business’s data.

7. Personal data breaches

If we become aware of a breach affecting your data we will tell you without undue delay — our target is within 24 hours of confirming it — with what happened, the data involved and what we are doing, so you can inform the Data Protection Board of India and affected people as the DPDP Act requires. We will help you with those notices.

8. Requests from your customers

Your customers’ requests to access, correct or erase their data, or to withdraw consent, are yours to answer. waca.ai gives you the tools: export a customer’s data, erase a customer (their name, number, chats and recordings), and opt-outs that stop all messages and calls. If a request reaches us directly, we pass it to you.

9. Deleting or returning data

When your account closes you have 30 days to export your data. We then delete it from live systems within 90 days and from backups as they expire, except what the law requires us to keep (for example invoices). You can also delete data yourself at any time.

10. Information and audits

On reasonable request we will share the information you need to show compliance — our security measures, sub-processor list and the relevant parts of our audit logs. A signed long-form DPA is available from nitish@waca-ai.com.