Data Processing Addendum
How Indoria handles the personal data you put into the software
Template - not legal advice. This document was written for Indoria Technologies Private Limited to match how the software actually works. Have an advocate in India read it before you rely on it.
Effective date: 6 November 2026. This addendum forms part of the agreement between your organisation ("you") and Indoria Technologies Private Limited ("Indoria"). It applies when you put other people's personal data into Indoria Munim, for example your customers, students or staff.
1. Roles
You decide why and how that data is used, so you are the Data Fiduciary under the Digital Personal Data Protection Act 2023. Indoria processes it for you as a Data Processor. For data about you as our customer (your account, billing and support), Indoria is the Data Fiduciary and the Privacy Policy applies.
2. What Indoria does with your data
- Stores it, shows it to the people you have given access to, backs it up, and deletes it as you ask or as the Data Retention and Deletion Policy says.
- Uses it only to provide the service to you. Indoria does not sell it, does not use it for advertising and does not use the content of your files, bills or customers to train any model.
- May look at it only to fix a fault you have reported, with your permission, or where the law requires.
3. Your responsibilities
- Have a lawful basis, and consent where it is needed, for the data you enter.
- Give people access only as needed. Use the roles (owner, admin, member, cashier, viewer) and turn on two-step sign-in for administrators.
- For people under 18, get the consent of a parent or guardian as the law requires. Do not enter data about children for tracking or advertising.
4. Security
The measures are described on the security page and in the Security Policy. They include hashed passwords, encrypted connections, optional two-step sign-in, access logs, backups, and separation between organisations. The software has not yet been checked by an independent security auditor, and we say so openly.
5. Where data is kept
On servers in India. If you run it on your own server, on your own server. Indoria does not move your data out of India without telling you first.
6. Other companies we use
Indoria uses a hosting provider (data centre), an email delivery provider and a payment processor (Razorpay Software Private Limited, which handles your card, UPI or bank details; we never see or store them) and, only if you switch it on in Indoria Munim, Meta Platforms (WhatsApp Business Cloud API) to deliver your bills and reminders through your own WhatsApp Business account. They process data only to do that job. We will give you the current list of names on request and tell you before adding a company that would handle the content of your files. If you do not agree, you can export your data and leave.
7. If something goes wrong
If we confirm that your personal data was exposed, we will tell you without undue delay and within 72 hours of confirming it, with what happened, what data, and what we are doing. You may have your own duty to tell the Data Protection Board and the people affected. We will give you the facts you need for that.
8. Requests from people
If someone asks you to see, correct or erase their data, you can do most of it yourself in the product and export it. If you need our help, write to us and we answer within 5 working days.
9. When the agreement ends
You can export your data for 30 days after the agreement ends. After that it is deleted as the retention policy says, and backups are overwritten in the normal cycle.
10. CA firms and resellers
A partner who set you up can see your name, plan and storage use. They cannot open your files, bills or customers. If you want a partner to work in your data, share it with them. Then they are a person you gave access to, and you remain responsible for that choice.
11. Questions
Write to contact@indoriamunim.in, or to the Grievance Officer named in the Grievance Procedure.