Compliance
- GDPR and UK GDPR: we act as a processor for the teams and companies that use Nalkatti. Our data processing agreement applies to every paid plan, with the EU Standard Contractual Clauses for transfers outside the EU.
- India's DPDP Act: we collect only what the service needs, and you can see, correct and erase your data yourself.
- SOC 2 and ISO 27001: not audited yet. We'll publish here when an audit is under way; the report will be shared with customers under NDA.
- Google API Services User Data Policy: our use of Google data follows it, including the Limited Use requirements. See the privacy policy.
Subprocessors
These companies process data for us, only to run the service. We'll update this list, and tell customers on the DPA, at least 30 days before adding one.
| Company | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database and sending email | Global network (USA) |
| Stripe, Inc. | Plan billing in US dollars; payments on paid booking links and service deposits | USA, EU |
| Razorpay Software Pvt. Ltd. | Plan billing in Indian rupees | India |
| Anthropic, PBC | The in-app assistant (Claude), only if you add your own API key | USA |
| Functional Software, Inc. (Sentry) | Error reports, when switched on | USA |
When you connect Google, Microsoft, iCloud, Zoom, HubSpot or Salesforce, data goes between Nalkatti and your own account there, under your agreement with them.
Report a security issue
Found a vulnerability? Email ajaysaiux@gmail.com with the details. Please give us a reasonable time to fix it before telling others. We won't take legal action over research done in good faith that doesn't harm users or their data.