Legal

Data processing addendum

The terms under which Bhavyaruni processes personal data on behalf of a customer organization.

This is a summary, not a contract. Bhavyaruni is a demonstration product. In a live deployment this page would carry the full executed document, with a version history and an effective date. The substance below reflects the commitments the product is actually built to keep.

Roles

Where an organization administers Bhavyaruni for its people, that organization is the data controller and Bhavyaruni is the processor.
Where an individual signs up directly, Bhavyaruni is the controller for that account.

Processing

We process personal data only on documented instructions from the controller, and only for the purpose of providing the service.
Sub-processors are listed publicly, with 30 days' notice before any addition, and the controller may object.
Data residency can be pinned to the EU, UK, US or Australia on Enterprise plans.

Assistance and deletion

We assist with data subject access, rectification, erasure and portability requests at no additional charge.
On termination, customer data is deleted within 30 days, or returned in an open format first if requested. Backups age out within a further 35 days.

Questions about this document? Contact us. Last reviewed 4 September 2026.