Data Processing Agreement

1. Purpose & Scope

1.1 This Data Processing Agreement ("DPA") governs how TryGetBill processes personal data on behalf of users ("Data Principals" / "Controllers") who utilize the TryGetBill platform.

1.2 This DPA supplements TryGetBill's Terms of Service and Privacy Policy and is incorporated into those agreements by reference.

1.3 This DPA applies to all personal data processed by TryGetBill in the course of providing the Service, including data you enter about your clients, business contacts, and other third parties in invoices, client records, and other platform features.

1.4 In the event of a conflict between this DPA and the Terms of Service or Privacy Policy, this DPA shall prevail with respect to data processing matters.

2. Definitions

• "Data Fiduciary" (under DPDP Act, 2023) / "Data Controller": TryGetBill, with respect to user account data collected for its own purposes; the User, with respect to client data and business data the User enters into the platform.
• "Data Processor": TryGetBill, when processing data on behalf of the User for the purpose of providing the Service.
• "Data Principal": Any natural person whose personal data is processed, including Users and their clients whose information appears in invoices and client records.
• "Personal Data": Any data about a natural person who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023.
• "Processing": Any operation performed on personal data, including collection, storage, organization, structuring, retrieval, use, transmission, display, erasure, or destruction.
• "Subprocessor": A third-party service provider engaged by TryGetBill to process personal data on its behalf.

3. Roles & Responsibilities

3.1 When TryGetBill acts as Data Processor: TryGetBill processes your client data, invoice data, and business records solely as instructed by you (the Controller) and solely for the purpose of providing the Service. TryGetBill shall not process such data for any other purpose.

3.2 When TryGetBill acts as Data Fiduciary/Controller: TryGetBill independently controls and processes your account data (name, email, authentication data, usage analytics, payment records) for the purposes described in our Privacy Policy.

3.3 User responsibilities: As the Controller of client data you enter into TryGetBill, you are responsible for:

• Ensuring you have the legal right to process and share the personal data of your clients and contacts
• Obtaining any required consent from your clients before entering their personal data into the platform
• Ensuring the accuracy and legality of all data you enter
• Complying with all applicable data protection laws with respect to the personal data you process through TryGetBill
• Responding to data subject requests from your clients regarding data you have entered

4. Scope of Processing

4.1 TryGetBill processes personal data solely for the following purposes:

• Storing and managing business profile information, client records, and invoice data
• Generating, rendering, and storing invoices and PDF documents
• Managing user authentication and session state
• Verifying subscription payments via Razorpay Payment IDs
• Sending transactional emails (invoice reminders, payment confirmations, account notifications)
• Generating WhatsApp reminder message templates (wa.me deep links)
• Providing dashboard analytics and insights
• Detecting and preventing fraud, abuse, and policy violations
• Complying with applicable legal obligations

4.2 TryGetBill shall NOT process personal data for any purpose beyond what is strictly necessary to provide the Service, unless required by applicable law.

4.3 Categories of personal data processed:

• User identity data: name, email, Google account ID, profile photo
• Business data: company name, address, phone, GSTIN, PAN, bank details (as displayed on invoices)
• Client data: name, email, phone, address, GSTIN (as entered by the User)
• Invoice data: item descriptions, amounts, dates, tax breakdowns, notes
• Payment metadata: Razorpay Payment IDs, transaction status, timestamps
• Usage data: pages visited, features used (anonymized analytics, consent-gated)

5. Technical & Organizational Security Measures

TryGetBill implements the following measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction:

• Encryption in transit: All data transmitted via TLS 1.2+
• Encryption at rest: AES-256 encryption via Google Cloud Platform (Firebase Firestore, Firebase Storage) and Cloudflare R2 (TryGetBill PayLock files), as provided by the respective infrastructure providers
• Access control: Firestore Security Rules enforce document-level isolation; Firebase Storage Rules restrict file access to authenticated owners; TryGetBill PayLock Cloud Functions enforce server-side authorization with HMAC-signed tokens for purpose-specific actions (email verification, payment marking, session deletion)
• Authentication: Firebase Authentication via Google OAuth 2.0; Firebase App Check enforcement on authenticated callable functions where applicable. Note: certain TryGetBill PayLock callable functions used by the anonymous free tool operate without App Check enforcement, with compensating controls (per-email and per-IP rate limits, email verification, extension blocklist, abuse reporting and auto-suspension at 5 unique reporters in 24 hours)
• Rate limiting: Server-side rate limiting on sensitive operations (account creation, invoice creation, payment verification, TryGetBill PayLock session creation, "I have paid" notifications)
• Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Token security: HMAC-signed tokens (purpose, sessionId, expiry) for TryGetBill PayLock state transitions; presigned URLs of short duration (10 minutes for upload, 15 minutes for download) for file access
• Storage isolation: TryGetBill PayLock files stored under per-state prefixes (paylock/unpaid/, paylock/paid/) on Cloudflare R2 with lifecycle deletion rules
• Administrative access: Restricted to authorized personnel with multi-factor authentication
• Monitoring: Automated system monitoring, anomaly detection, and abuse-report-driven auto-suspension
• Dependency management: Regular updates and vulnerability scanning

6. Subprocessors

6.1 TryGetBill uses the following subprocessors to provide the Service:

6.2 All subprocessors are contractually required to implement appropriate technical and organizational security measures and to process data only as instructed.

6.3 TryGetBill may update the list of subprocessors from time to time. Material changes to subprocessors will be reflected in this DPA. By continuing to use the Service after such updates, you consent to the use of the updated subprocessors.

6.4 TryGetBill shall be liable for the acts and omissions of its subprocessors to the same extent TryGetBill would be liable if performing the processing directly, subject to the limitations set forth in the Terms of Service.

7. Cross-Border Data Transfers

7.1 Some subprocessors process data outside India. Specifically: Google Cloud and Resend may process data in the United States; Cloudflare R2 stores files primarily in Asia-Pacific regions but may replicate or process data in other Cloudflare regions globally. Such transfers are conducted in compliance with the provisions of the DPDP Act, 2023.

7.2 Data shall not be transferred to any country restricted by the Central Government of India under Section 16(1) of the DPDP Act, 2023.

7.3 All cross-border subprocessors maintain security certifications and practices equivalent to or exceeding those required under Indian law.

8. Data Retention & Deletion

8.1 TryGetBill retains personal data only for as long as necessary to provide the Service or as required by applicable law.

8.2 Upon account termination or deletion:

• User Content (invoices, client records, PDFs, business data) will be permanently deleted within 30 days
• Payment transaction records (Razorpay Payment IDs, amounts, timestamps) may be retained for up to 8 years for tax and financial compliance under Indian law
• Anonymized, aggregated analytics data that cannot identify any individual may be retained indefinitely
• Records of accounts terminated for policy violations may be retained for abuse prevention purposes
• Data subject to pending legal proceedings, regulatory investigations, or government requests will be retained until the matter is resolved

8.3 Upon request, TryGetBill will provide written confirmation of data deletion, subject to the exceptions listed above.

9. Data Principal / Data Subject Rights

9.1 For User's own data: Users may exercise their rights under the DPDP Act, 2023 (access, correction, erasure, withdrawal of consent, nomination, grievance redressal) by emailing privacy@trygetbill.com or by using the grievance procedure at trygetbill.com/grievance. TryGetBill will acknowledge within 24 hours and resolve within 15 days, in compliance with Rule 3(2)(a) of the IT Rules, 2021.

9.2 For client data entered by Users: If a Data Principal (your client) contacts TryGetBill regarding personal data you have entered about them, TryGetBill will:

• Notify you of the request within 48 hours
• Provide reasonable cooperation to help you fulfill the request
• Not independently modify or delete client data without the Controller's (your) instruction, unless required by law

9.3 You are primarily responsible for responding to data subject requests from your clients regarding data you have entered into TryGetBill.

10. Data Breach Notification

10.1 In the event of a confirmed personal data breach affecting data processed under this DPA, TryGetBill will:

• Notify affected Users (Controllers) without unreasonable delay and in any event within 72 hours of becoming aware of the breach
• Provide details including: nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken to mitigate
• Notify the Data Protection Board of India as required under the DPDP Act, 2023
• Notify CERT-In within 6 hours as required under the Cyber Security Directions, 2022
• Cooperate with affected Controllers in their own breach notification obligations
• Maintain detailed records of all breaches, including facts, effects, and remedial actions

11. Audit Rights

11.1 Upon reasonable written request (no more than once per calendar year), TryGetBill will provide information reasonably necessary to demonstrate compliance with this DPA, including a summary of security measures and any relevant third-party audit reports or certifications available from our infrastructure providers (Google Cloud, Razorpay).

11.2 TryGetBill is not obligated to disclose proprietary source code, trade secrets, internal security architecture, or information that would compromise the security of the platform or other users.

12. Confidentiality

12.1 TryGetBill shall ensure that all persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

12.2 This confidentiality obligation survives the termination of this DPA.

13. Termination & Data Return

13.1 This DPA shall remain in effect for the duration of TryGetBill's processing of personal data on behalf of the User.

13.2 Upon termination of the Service or this DPA, and upon written request received within 30 days of termination, TryGetBill will provide you with a copy of your personal data in a structured, commonly used, machine-readable format (JSON or CSV).

13.3 After the 30-day request period or upon fulfilling a data return request, TryGetBill will permanently delete all personal data processed under this DPA, except where retention is required by applicable law or as specified in Section 8.

14. Liability

14.1 TryGetBill's liability under this DPA is subject to the limitations set forth in the Terms of Service.

14.2 Each party shall be liable for damages caused by processing that infringes applicable data protection law. A Controller (User) shall be liable for damages caused by processing that does not comply with the User's obligations under applicable law. A Processor (TryGetBill) shall be liable only for damages caused by processing that does not comply with obligations specifically directed to processors or where TryGetBill has acted outside of or contrary to the Controller's lawful instructions.

15. Governing Law

This DPA shall be governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and all applicable rules and regulations. Disputes shall be resolved in accordance with the dispute resolution provisions in the Terms of Service.

16. Changes to This DPA

TryGetBill may update this DPA to reflect changes in our processing activities, subprocessors, or applicable law. Material changes will be notified to registered users via email. Continued use of the Service after the effective date of changes constitutes acceptance.

17. Contact

For questions about data processing, this DPA, or to submit a data subject request:

Email: privacy@trygetbill.com

Grievance Officer: KAMBAM MADHU SUDHAN

Postal Address: Kotha Veedhi, Porumamilla, YSR Kadapa District, Andhra Pradesh - 516193, India

Response time: Acknowledgment within 24 hours; resolution within 15 days, in compliance with Rule 3(2)(a) of the IT Rules, 2021.

Full grievance redressal procedure: trygetbill.com/grievance