Version 1.0 · Effective 11 October 2026
This DPA forms part of the Terms of Service between the Customer and FreWork Business Solutions (“FreWork”). It applies to personal data inside Customer Data, for example the names, PAN, phone numbers and bank details of the Customer's customers, suppliers and employees. For that data the Customer is the Data Fiduciary and FreWork is the Data Processorunder the Digital Personal Data Protection Act, 2023. It is accepted with the Terms; a signed copy is available on request.
FreWork processes this data only on the Customer's documented instructions, which are these Terms and the Customer's use of the app. FreWork will tell the Customer if an instruction appears to break the law. The Customer is responsible for having a lawful basis and giving any notice required to its own data principals.
Only staff and contractors who need access to support the service can reach Customer Data, and they are bound by confidentiality.
The Customer authorises the sub-processors below. FreWork binds each to data protection terms no less protective than this DPA and stays responsible for them. We will give at least 15 days' notice of a new sub-processor by email or on this page; the Customer may object, and if we cannot resolve it, may terminate and receive a pro-rata refund.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, file storage and sign-in | All account and accounting data | Cloud region chosen for the project (may be outside India) |
| Vercel Inc. | Hosting the website and app | Requests and logs in transit | Global edge network |
| Google LLC (Gemini API) | AI drafting of entries and reading documents | Chat text, uploaded documents, ledger names needed for the draft | United States / global |
| Anthropic PBC (Claude API) | AI drafting (backup model) | Same as above, only when used | United States |
| Sandbox (Quicko Infosoft Pvt Ltd) | GST filing status and tax document reading | GSTIN, uploaded Form 168 / 130 PDFs | India |
| PhonePe Pvt Ltd / Razorpay Software Pvt Ltd | Payments | Order amount, name, email, phone (never card or UPI credentials) | India |
| Meta Platforms (WhatsApp Business) | WhatsApp messages you choose to send or receive | Phone number and message text | Global |
If a data principal contacts FreWork directly about Customer Data, we will pass the request to the Customer and not answer it ourselves unless the Customer asks. The app lets the Customer find, correct, export and delete records; we will help further on reasonable request.
FreWork will tell the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Data, with what is known, the likely effects and the steps taken. We will help the Customer meet its duty to inform the Data Protection Board and affected data principals.
The Customer can export its data at any time. When the account closes, FreWork keeps Customer Data for 30 days for export, then deletes it from live systems; backups roll off within a further 30 days. Data FreWork must keep by law is kept only for that purpose.
On written request, once a year, FreWork will answer a reasonable security questionnaire and share summaries of its sub-processors' security certifications. On-site audits need 30 days' notice, are at the Customer's cost and must not expose other customers' data.
Liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on personal data, this DPA prevails.