Data processing agreement

Last updated 5 November 2026

Draft terms for how Milvao processes members' data as your processor under the DPDP Act and the GDPR. Waiting for legal review and not yet in force.

1. 01Roles

   • The Customer is the data fiduciary under the DPDP Act and the controller under the GDPR for its members' personal data. It decides which groups use Milvao, which profile questions are asked and why, and who on its team has access.
   • Milvao is the Customer's data processor (a processor under the GDPR) for that data.
   • Milvao is a data fiduciary and controller in its own right only for operator accounts, billing, website visitors and enquiries, as its privacy policy explains.

   The Customer is responsible for having a lawful basis for the processing, for giving members the notice the law requires, and for the instructions it gives Milvao. Milvao records members' consents in the service, but that does not move the Customer's duties to Milvao.

2. 02What Milvao processes, and why

   Item	Details
   People	The Customer's members who message its business number, and anyone who asks for help or is offered an introduction
   Data	WhatsApp phone number and profile name; profile details (name, city, skills, cities served, offer preferences, answers to the Customer's profile questions); groups joined; consent records; requests, briefs, introductions and message delivery status; data request records
   Purpose	Running private requests and consented introductions for the Customer's community, the operator dashboard and metrics, member controls (PAUSE, STOP, MY DATA, DELETE MY DATA), support, security and billing records
   Not processed	Content, member lists or history of the Customer's WhatsApp groups. Government ID numbers are refused in profile questions
   Duration	For as long as the Customer uses Milvao, then until deletion under the section on ending the service below

   Sensitive topics in profile questions (health, religion, caste, sexual orientation, political views, finances) need the owner's confirmation and a stated purpose. The Customer should not ask for them unless it truly needs them.

3. 03Milvao's commitments

   • Process the data only on the Customer's documented instructions, which are these terms and the settings the Customer chooses in Milvao, and tell the Customer if an instruction appears to break the law.
   • Never sell the data, use it for advertising, or use it to train AI models.
   • Make sure everyone with access is bound by confidentiality, and limit access to the people who need it.
   • Send the AI provider only redacted request text, never the member directory, phone numbers or profile answers.
   • Help the Customer with data protection impact assessments and consultations with regulators, where reasonable.
   • Make available the information needed to show compliance with this DPA, and allow audits by the Customer or its auditor on reasonable notice. [TODO: audit frequency, notice and cost terms.]

4. 04Security measures

   Milvao maintains the technical and organisational measures described on the security page, including:

   • Encryption in transit (HTTPS with HSTS) and encryption at rest of phone numbers and WhatsApp access tokens.
   • Separation of each community's data in the database, and access checks on every request.
   • Invited team accounts, least-privilege roles, two-factor sign-in available to everyone and required for staff support access, and support access only when the owner grants it, read only and time limited.
   • An audit trail and security event log in a separate database, kept for 1 year, without message text or full phone numbers.
   • Bot protection, rate limits and input validation on public endpoints, and signature checks on webhooks.

   Milvao may improve these measures over time but will not reduce the overall level of protection.

5. 05Sub-processors

   The Customer authorises the sub-processors listed on the sub-processors page. Milvao binds each one to data protection terms no less protective than this DPA and remains responsible for them. Before adding a sub-processor that will process members' personal data, Milvao updates that page and emails the Customer's owner [TODO: notice period, for example 14 days] in advance. If the Customer objects on reasonable data protection grounds, the parties will discuss it in good faith, and the Customer may end the affected service and receive a refund of fees prepaid for the period after it ends.

6. 06International transfers

   Milvao's database is hosted in Singapore. Some sub-processors process data in other countries, as listed. Under the DPDP Act, Milvao will not transfer data to a country the Central Government restricts. Where the GDPR applies, transfers outside the EU, EEA or UK rely on the European Commission's standard contractual clauses (with the UK addendum) or another valid mechanism. [TODO: confirm the mechanism with each sub-processor and attach the clauses.]

7. 07Members' requests

   Milvao gives the Customer tools to answer members who exercise their rights:

   • Members can send MY DATA or DELETE MY DATA to the Customer's number. Requests appear in Settings, Data requests, with a 30-day due date.
   • The owner can export a member's data, correct details, or delete the member. Deletion removes the profile, answers, number, and request and message text, stops outreach, and keeps only de-identified counts and consent proofs.
   • If a member writes to Milvao directly, Milvao passes the request to the Customer and helps it respond, unless the law requires otherwise.

8. 08Personal data breaches

   Milvao will notify the Customer without undue delay, and in any case within [TODO: hours, for example 48] hours of becoming aware of a personal data breach affecting the Customer's data. The notice will describe what happened, the data and people likely affected, likely consequences, and the steps taken, with updates as more is known. Milvao will help the Customer notify the Data Protection Board of India and affected members, and, where the GDPR applies, the supervisory authority within 72 hours. Milvao will not notify members or regulators on the Customer's behalf without its agreement, unless the law requires it.

9. 09Retention and ending the service

   While the service runs, these periods apply:

   Data	Kept for
   Raw message data received from WhatsApp	7 days
   Message text	90 days
   AI call logs (redacted)	90 days
   Copies of Razorpay payment events	30 days, with contact and card details removed
   Audit trail and security events	1 year
   Member profiles, consent records and introduction history	Until the member or the community asks for deletion

   When the service ends, the Customer can ask for an export of its workspace data within [TODO: period, for example 30 days]. After that, Milvao deletes the Customer's personal data, including from backups within [TODO: backup retention period], except what the law requires Milvao to keep and de-identified counts.

10. 10Contact

    Data protection questions: [TODO: privacy contact email, for example privacy@milvao.com]. Anything else: hello@milvao.com. Grievance officer under the DPDP Act: [TODO: grievance officer name], [TODO: grievance officer email].