Data Processing Addendum

1. Roles

Your company is the data fiduciary (the controller, where the GDPR applies) for the personal data in its Ledger account. Charky Labs Pvt Ltd is the data processor and processes it only for your company.

2. What we process, and why

• Purpose: to provide Ledger to your company under the Terms of Service, and for nothing else.
• Kinds of data: names, email addresses, phone numbers, postal addresses, GSTINs and PANs, bank transaction descriptions, and invoice and payment details.
• Whose data: your company's members, customers, vendors and employees.
• Duration: while your account is open, and until deletion under section 10.

3. Your instructions

We process the data only on your company's documented instructions: these terms, how your company configures Ledger, and the actions its members and their connected assistants take in it. If we believe an instruction breaks the law, we will tell you.

4. Confidentiality

Everyone at Charky Labs who can access the data is bound to confidentiality, and has access only where their work requires it.

5. Security measures

• Encryption in transit (TLS) and at rest.
• Isolation of each company's data at the database level, through row-level security.
• Least-privilege access for staff, with access logged.
• An audit log of every change in your account, visible to your company.
• Regular, encrypted backups, kept in India.

6. Sub-processors

We use these sub-processors. We will give at least 30 days' notice before adding or replacing one. If you object on reasonable data-protection grounds and we cannot resolve it, you may cancel and receive a pro-rata refund.

• Amazon Web Services (Amazon Web Services, Mumbai (ap-south-1), India): application, database, backups, and the built-in AI through Amazon Bedrock.
• Vercel: delivers the Ledger website. Data passes through it in transit, and it does not store your company's data.
• Razorpay: billing, which covers only your company's billing details.

7. Where the data is

The data is stored and processed in India. We do not transfer it outside India, except as section 8 describes or on your instruction.

8. Services you connect

If your company connects an AI assistant such as Claude or ChatGPT, or another service, what that service reads is sent to it on your company's instruction. That provider acts for your company under your own agreement with it. It is not our sub-processor.

9. AI

We never use the data to train an AI model. Amazon Bedrock, which runs Ledger's built-in AI, does not use prompts or outputs to train models.

10. Deletion and return

Your company can export its data at any time. When the account closes, the data stays available to export for 30 days, is deleted within a further 30 days, and leaves our backups within 35 days after that. We keep only what the law requires us to keep, such as our own billing records.

11. Helping you

If someone asks your company to see, correct or delete their data, we will help you respond. If they contact us directly, we will pass the request to you. We will also give you the information you reasonably need to show that this addendum is being followed.

12. Personal data breaches

If a breach affects the data, we will tell your company without undue delay and within 72 hours of becoming aware of it. We will say what happened, what data was involved, and what we are doing about it, so that you can notify the Data Protection Board and the people affected.

13. Precedence

If this addendum and the Terms of Service disagree about personal data, this addendum applies.