Data Processing Terms

1. Roles

• You (the business or professional using the apps) are the Data Fiduciary for “Customer Personal Data”: personal data of your customers, vendors, employees, clients and other people that you put into the Services.
• We (Prabhas SaaS) are your Data Processor for that data. For our own account, billing and usage data we are a Data Fiduciary, as the Privacy Policy explains.
• For Lekhya Pramaan, the firm or professional is the Data Fiduciary for its clients’ personal data.

2. Processing only on your instructions

We process Customer Personal Data only to provide, secure and support the Services, as you direct through your use of the apps, and as the law requires. If an instruction appears unlawful to us, we will tell you. We do not sell Customer Personal Data or use it for our own purposes, including to train AI models.

3. Your responsibilities

• Have a lawful basis for the data you enter, and give the notices the Act requires to the people it concerns.
• Enter only the data you need, keep it accurate, and do not enter children’s data unless the law allows it.
• Handle requests from those people to access, correct or erase their data — the apps let you find, edit, export and delete records, and we will help where you cannot.

4. Security safeguards

• Encryption in transit; passwords stored only as salted one-way hashes; backups encrypted with AES-256 before they leave our server.
• Access control within your account (roles and permissions), and two-factor authentication in Lekhya and Lekhya Pramaan.
• Our personnel handle Customer Personal Data only where their work needs it, under a duty of confidentiality.
• Backups: taken every hour on our servers in India and kept for about two days; any copy kept offsite is encrypted with AES-256 before it leaves the server and kept for no more than 30 days.
• Logs of access and security events, kept for the period the Digital Personal Data Protection Rules, 2025 and CERT-In directions require.

5. Sub-processors

We use the sub-processors listed in section 5 of the Privacy Policy, each under a written contract with obligations at least as protective as these terms. We will add a new sub-processor to that list and e-mail account owners at least 15 days before it starts processing Customer Personal Data; if you object and we cannot address it, you may stop using the affected Service and receive a pro-rata refund of the unused period.

6. Transfers outside India

Customer Personal Data in Lekhya AI and Lekhya Pramaan is stored on servers in Mumbai, India. Seedha Bill data, shared file storage and the encrypted offsite copies of Lekhya’s backups are stored with Supabase in the Republic of Korea, and data you submit to an AI feature is processed by our AI provider in the United States. These transfers are permitted by Section 16 of the Act; you instruct us to make them by using the Services.

7. Personal data breaches

If a breach affects Customer Personal Data, we will notify you without undue delay and within 48 hours of becoming aware of it, with what we know of its nature, extent, timing, likely impact and the steps taken — so that you can inform the Data Protection Board and the people concerned within the time the law sets. We will also report to CERT-In where its directions require.

8. Return and deletion

• You can export your data at any time while you have access, and for 72 hours after access ends.
• For Lekhya AI and Lekhya Pramaan, Customer Personal Data is erased 60 days after access ends without renewal, and leaves our backups within a further 30 days.
• On request, we confirm the erasure in writing.
• We keep data longer only where a law requires it, and only for as long as it requires.

9. For companies keeping books in Lekhya

Rule 3 of the Companies (Accounts) Rules, 2014 requires accounting software used by companies to keep an audit trail that cannot be disabled, and a daily backup of the books on servers physically located in India. Lekhya keeps posted journals unalterable — corrections are made only by reversing entries — and writes an edit log of every change to accounts, parties, products, invoices, payments, bank transactions and journals, which cannot be switched off. Lekhya’s books and their hourly backups are held on servers in India. Keeping the books for the period the law requires remains the company’s duty: export them before any erasure under section 8.

10. Information and audits

On reasonable written request, and not more than once a year unless a breach or an authority requires it, we will provide the information you need to show that these terms are being met.