Data Processing Agreement

1. Scope and incorporation

This Data Processing Agreement applies to personal data processed within an Organization Workspace and forms part of the agreement between an Organization and us alongside our Terms of Service and Enterprise Terms.

2. Roles

For Organization Workspace data, Revanta AI acts as a data processor (the equivalent term under India's Digital Personal Data Protection Act, 2023 and the GDPR alike) on behalf of the Organization, which acts as data controller — or "Data Fiduciary" under the DPDP Act's terminology — for its members' personal data, subject in each case to applicable data protection law.

3. How your data is handled

Most PawOS data — companion memory, conversation history, local Workspace Intelligence, and project analysis — is stored locally on your device and is never transmitted to us, except where it must pass through a third-party AI provider to generate a response, or where you explicitly share it into an Organization Workspace.

Organization Workspace data is hosted with our infrastructure provider, Supabase, with row-level security scoping every record to the requesting organization so that one organization's data is never visible to another, or to us, outside of what is necessary to operate the service and respond to a valid legal or support request.

4. Sub-processors

We rely on the following categories of sub-processor to operate PawOS: cloud database and authentication infrastructure (Supabase); payment processing (Razorpay); email delivery for account and billing notifications; and third-party AI providers that generate reasoning responses when you use an AI-powered feature. Each is bound by its own data-processing terms with us, and none is authorized to use your data for purposes beyond providing its service to us.

We will notify Organization customers of a material change in sub-processor (for example, a new AI provider) via the Changelog or direct notice, consistent with the Changes to this document section above.

5. Security measures

Row-level security scoping every record to its Organization, encrypted credential storage for shared infrastructure credentials, and audit logging of security-relevant actions, as described in our Security Policy, apply to Organization Workspace data processed under this agreement.

6. International transfers

Organization Workspace data may include personal data of an EU/EEA data subject and be transferred outside the EU/EEA to us or our sub-processors. As described in our Privacy Policy, we have not executed Standard Contractual Clauses or another formal Article 46 GDPR transfer mechanism with every sub-processor as of this writing.

7. Assisting with data subject requests

Where a data subject directs a rights request to us regarding data held in an Organization Workspace, we will refer it to the relevant Organization as controller and provide reasonable assistance to help the Organization respond, consistent with our own obligations under this agreement.

8. Term and deletion

We process Organization Workspace data for as long as the Organization's subscription is active. On termination, we delete or return Organization Workspace data within a reasonable period at the Organization's request, except where retention is required by law.

9. Contact

General questions about this document: legal@revantaai.com. Privacy and data-protection requests: privacy@revantaai.com. Security reports: security@revantaai.com, following our Vulnerability Disclosure Policy. See also our Grievance Officer contact above where this document includes one.

10. Changes to this document

We may revise this document as PawOS's features or applicable law change. The date at the top of this page reflects the version currently in effect. Where a change is material, we will note it in our Changelog and, where required by law, notify affected users directly (for example, by email or an in-app notice) before the change takes effect. Continuing to use PawOS after a revised document takes effect constitutes acceptance of it.