The short version
- When I build automations for you, they often handle your customers' personal data. You decide why and how; I process it only on your instructions.
- The data stays in accounts you own wherever possible. I access it only to build, test and maintain the work.
- This addendum forms part of the terms of service and applies automatically to every Build and Care plan.
1. Roles
You are the data fiduciary under India's Digital Personal Data Protection Act, 2023, and the controller under the GDPR and UK GDPR where they apply. I, Vishal Chopde trading as Samarth AI Studio, am your data processor. I process personal data only to deliver the work in your quote and on your documented instructions, including instructions given by email.
2. What is processed
| Subject matter | Designing, building, testing and maintaining websites, web apps, Chrome extensions and automations |
| Duration | The length of the project and any Care plan, plus the time needed to delete or return data afterwards |
| Types of data | Typically names, phone numbers, email addresses, messages, call recordings or summaries, booking details and CRM records |
| Data principals | Your customers, leads and staff |
3. My commitments
- I process the data only on your instructions, and tell you if I think an instruction breaks data protection law.
- I keep it confidential. Nobody else works on your projects without your written approval.
- I use reasonable security: two-factor authentication, encrypted connections, credentials kept in the tools' credential stores, and access limited to what the work needs.
- I use test data or a small real sample when testing, and keep copies out of personal files.
- I tell you without undue delay, and within 48 hours where possible, if I become aware of a breach affecting your data, and help you meet your own notice duties.
- I help you respond to requests from people exercising their rights, as far as the work I built allows.
- At the end of the work, I delete or return the data, as you choose, unless the law requires me to keep it.
4. Sub-processors
Wherever possible, automations run in accounts you own, so providers such as n8n, OpenAI, Twilio, Meta (WhatsApp), Vapi, Airtable, Supabase, Calendly and your hosting provider are your processors under your own contracts with them. Where I must use an account of mine, I will tell you which one before it touches your data, and you can object.
5. International transfers
I work from India. Where the GDPR applies to your data and it is accessed from India, we rely on the EU Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated into this addendum by reference for that purpose.
6. Checks
On reasonable notice, I will answer written questions and share the information you need to show that this addendum is being followed.
7. Law
This addendum follows the governing law of the terms of service, except where data protection law requires otherwise.
Questions about this page? Email hi@vishalchopde.com.