This agreement ("DPA") is part of the terms of service between Nalkatti ("we", the processor) and the customer who buys a paid plan or uses Nalkatti for a team ("you", the controller). It applies whenever we process personal data for you under the EU or UK General Data Protection Regulation, or similar laws. Nothing needs to be signed; for a countersigned copy, contact ajaysaiux@gmail.com.
1. What we process
- Subject matter and purpose: running Nalkatti for you: team availability, find-a-time, events, booking links and bookings, workflows, routing forms, calendar sync and billing; and, if you run a business page, your customer records, intake forms, rentals, stays, enquiries, quotes, tickets, invoices, packs, gift cards and reviews.
- Data subjects: your team members and other users you invite, and people who book with you, rent from you, stay with you or fill in your forms.
- Personal data: names, email addresses, phone numbers, delivery addresses, time zones, availability and busy times, meeting and booking times, payment and deposit records, notes, and the answers people give on your forms.
- Sensitive data: a business page's intake questions can collect health information and other special categories of data, and rentals and stays can collect ID or licence numbers. These are optional and you choose whether to ask. If you do, you're responsible for having a lawful reason and any consent the law requires. Ask only through a service's intake questions, whose answers are encrypted; other booking and routing form answers aren't, so please don't ask for sensitive data there.
- Duration: as long as you use the service, then as set out in section 7.
2. Your instructions
We process personal data only to provide the service, as you configure it, and as the law requires. If we think an instruction breaks data protection law, we'll tell you.
3. Confidentiality and security
Everyone at Nalkatti who can access personal data is bound by confidentiality. We keep the technical and organisational measures in the annex below, and may improve them over time but won't make them weaker.
4. Subprocessors
You allow us to use the subprocessors below. We'll give at least 30 days' notice of a new one on the trust page and by email to plan owners. If you object on reasonable data protection grounds and we can't resolve it, you can cancel the affected plan and get a refund for the unused period. Each subprocessor is bound by data protection terms at least as protective as these.
| Company | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database and sending email | Global network (USA) |
| Stripe, Inc. | Plan billing in US dollars; payments on paid booking links and service deposits | USA, EU |
| Razorpay Software Pvt. Ltd. | Plan billing in Indian rupees | India |
| Anthropic, PBC | The in-app assistant (Claude), only if you add your own API key | USA |
| Functional Software, Inc. (Sentry) | Error reports, when switched on | USA |
5. International transfers
Where personal data leaves the EU, EEA, UK or Switzerland for a country without an adequacy decision, the EU Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor) and the UK Addendum apply and are incorporated by reference.
6. Helping you
- People's requests: most requests to see, correct, export or delete data can be handled in the app. We'll help with the rest, and pass on any request we receive directly.
- Breaches: we'll tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with what we know and what we're doing about it.
- Assessments: we'll give reasonable help with data protection impact assessments and consultations with authorities.
- Audits: we'll answer reasonable security questionnaires once a year and give you the information needed to show we meet this DPA. Audit reports will be shared once we have them (see the trust page).
7. When the service ends
Deleting an account or team deletes its personal data from our live systems straight away, including any business the account owns; backups are overwritten within 30 days. While you use the service, you decide how long to keep your customers' data. Deleting a customer removes their record, staff notes, intake answers and ID or licence numbers; their past bookings and rentals stay until you delete your account. Before that, you can download your own account's data from the profile page; for a copy of your business's customer records, contact us. Billing records are kept by our payment providers as tax law requires.
8. Liability and order
Liability under this DPA follows the terms of service. If this DPA and the terms disagree about personal data, this DPA wins; if the Standard Contractual Clauses apply, they win over both.
Annex: security measures
- All traffic over HTTPS; hosting on Cloudflare's network.
- Access tokens for connected accounts, private customer notes, intake answers and ID or licence numbers encrypted at rest with AES-256-GCM; passwords hashed.
- Intake answers, notes and ID numbers shown only to the business's staff, with each view recorded on the customer's record.
- Data minimisation: from connected calendars only busy times are stored; event details are read live and never kept.
- Teams see only whether a member is free, never why.
- Sign-in rate limits, signed links for bookers, and access checks on every team and booking.
- Server logs kept for at most 7 days.
- Card and bank details handled only by Stripe and Razorpay (PCI DSS Level 1 providers).