Data Processing Agreement

Last Updated: July 17, 2026

1. Parties & Role

This Data Processing Agreement (“DPA”) is between the institute / business customer (“Controller”) and E Acad Sutra (“Processor”) for personal data processed through InstiCloud and/or InstiSignal.

For student, parent, faculty, lead, and customer records uploaded or collected in the customer workspace, the customer is Controller and E Acad Sutra is Processor. E Acad Sutra acts as an independent controller for its own account, billing, security, and platform administration data.

2. Subject Matter

Processing is limited to hosting and operating educational ERP, CRM, WhatsApp automation, AI-assisted features (where enabled), analytics, and related support necessary to provide the subscribed services.

3. Nature & Purpose of Processing

  • Store and display institute-managed records
  • Send and receive WhatsApp messages via Meta Cloud API as configured by the Controller
  • Run automations, broadcasts, templates, and inbox workflows
  • Provide AI features only when enabled by the Controller
  • Generate usage analytics and operational logs
  • Provide customer support and security monitoring

4. Categories of Data Subjects

Students, parents/guardians, faculty/staff, leads, customers, and institute administrators — as entered by the Controller.

5. Types of Personal Data

Names, contact details, WhatsApp numbers, enrolment and academic records, fee-related references, message contents/metadata, uploaded documents, and device/technical logs associated with use of the services.

6. Controller Instructions

Processor will process Controller personal data only on documented instructions from the Controller (including configuration inside the product), unless required by Indian law or a lawful authority request.

7. Confidentiality & Security

Processor applies HTTPS, access controls, role-based permissions in-product, and organisational security measures. Controller remains responsible for user permissions inside its workspace and for lawful collection of data.

8. Subprocessors

Controller authorises Processor to use subprocessors reasonably required to deliver the services, which may include cloud hosting providers, Razorpay (billing), Meta (WhatsApp Cloud API), and optional AI providers (OpenAI / Flowise) when enabled by Controller. Meta processes WhatsApp delivery as an independent provider under Meta’s terms.

9. International Transfers

Subprocessors may process data outside India. Processor uses contractual/technical measures with providers where available. Controller is responsible for any notices/consents required for its data subjects.

10. Retention & Deletion

During the subscription, Controller may delete or export available records through product tools. After termination, Processor will delete or anonymise Controller personal data within a commercially reasonable period, except where retention is required for legal, accounting, dispute, or security purposes, or remains in encrypted backups for a limited cycle.

11. Assistance

Taking into account the nature of processing, Processor will provide reasonable assistance to Controller for data-subject requests and basic security incident notifications relating to Controller personal data, via contact@insti.cloud.

12. WhatsApp / Meta Note

Message delivery and WhatsApp account enforcement are controlled by Meta. Processor does not sell conversation contents. Messages may be stored as necessary for delivery, automation, analytics, and support as described in the Privacy Policy.

13. Governing Law

This DPA is governed by the laws of India, with disputes subject to the courts of Maharashtra, India, unless a signed enterprise agreement states otherwise.

14. Contact

E Acad Sutra · contact@insti.cloud · insti.cloud · signal.insti.cloud