Data Processing Agreement

Effective 5 October 2026 · Version 2026-10-05

This agreement is part of the Terms.

Parties

Data Fiduciary: the jewellery or girvi firm using SthirApp (“Firm”). Data Processor: AADINATH VENTURES, a partnership firm trading as SthirApp (“Processor”). Principal place of business: Ground Floor, 60, Getor Road, Nand Vihar, Jaipur, Rajasthan 302017. GSTIN: 08ACNFA4818K1Z0.

What is processed

The Processor hosts and syncs customer and loan records the Firm types in, including name, mobile, address, Aadhaar where the Firm enters it, collateral, bills, and WhatsApp message content the Firm sends through the product. The Processor uses that data only to provide the software. Using the app is the Firm’s instruction. The Processor does not use vault data for its own marketing, and it does not sell it.

Processor obligations

  • Process vault data only to operate the Firm’s books
  • Encrypt vault fields at rest and data in transit
  • Limit access to people who operate or support the service
  • Help the Firm with a data-principal request where the product can do so
  • After we confirm a breach of vault data, tell the Firm without undue delay, so the Firm can notify the Data Protection Board and its customers. We do not notify borrowers ourselves
  • Use the sub-processors below. We will not add a new sub-processor for vault data without notice in the app

Sub-processors

  • Supabase — database, authentication, and file storage
  • Expo, Apple, and Google — push tokens and device metadata for the mobile app
  • Meta — WhatsApp Business messages the Firm chooses to send
  • Razorpay — the Firm’s subscription payment to Aadinath Ventures, not borrower money

Firm obligations

  • Have a lawful basis before entering a customer’s Aadhaar, mobile number, or other personal data
  • Give customers the notice the law requires
  • Answer customer rights requests as Data Fiduciary
  • Treat WhatsApp content the same way: the Firm is the sender and the fiduciary

When the subscription ends

On the Firm’s request after termination, the Processor will let the Firm export vault data and will then delete it, except where a tax or audit law requires a copy to be kept.

See also the Privacy Notice for account data, where the Processor is the Data Fiduciary.