Data Processing Agreement

Last updated: October 26, 2026

This agreement forms part of the Terms of Service between AgencyReportr and each agency that uses it (“you”). It applies automatically; no signature is needed. If you need a signed copy for your records, email [email protected].

1. Roles

For the personal data you bring into AgencyReportr, such as your clients’ connected marketing accounts and the email addresses you send reports to (“Client Data”), you are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the controller under the GDPR), and AgencyReportr is your Data Processor. Our own handling of account holders’ data is covered by our Privacy Policy.

2. What we process and why

We process Client Data only to provide the service you use: connecting the accounts you choose, building reports, sharing report links you create, and emailing scheduled reports to the recipients you add. We do not use Client Data for any other purpose, sell it, or use it for advertising.

3. Your instructions

Your settings in the app, and anything you ask us in writing, are your instructions. We follow them, and tell you if we believe an instruction breaks the law.

4. Your responsibilities

5. Confidentiality and security

Everyone at AgencyReportr who can access Client Data is bound by confidentiality. We protect Client Data with appropriate technical and organisational measures, including encryption in transit and at rest for access tokens, encrypted backups, role-based access and logging of changes.

6. Sub-processors

You authorise us to use sub-processors for cloud hosting, network security, email delivery, AI summaries and search data. Each is bound by a contract with data protection terms at least as protective as this agreement. You can ask for the current list of named sub-processors at any time, and we will tell you before adding a new one so you can object.

7. Personal data breaches

If a breach affects Client Data, we tell you without undue delay after we become aware of it, with what we know: what happened, the data and people affected, the likely impact and what we are doing about it. We keep you updated and help you meet your own duties, including notices to the Data Protection Board of India and to the people affected.

8. Helping with rights requests

If someone asks us directly to access, correct or erase Client Data, we send the request to you and do not answer it ourselves unless you ask us to. We help you respond to such requests and to any enquiry from a data protection authority.

9. Transfers outside India

Client Data may be processed outside India by our hosting and sub-processors. We do so only where DPDP allows it (not to countries the Government of India restricts by notification) and, for EEA data, with the safeguards the GDPR requires.

10. Deleting Client Data

Disconnecting a platform deletes its access token and cached data straight away. When you close your account, Client Data is kept for 365 days so you can restore it, then erased; you can ask us to erase it sooner. Encrypted backups are overwritten within 35 days. We keep only what the law requires us to keep, such as invoices.

11. Information and audits

On reasonable request, we give you the information you need to show that this agreement is being followed, and answer reasonable security questionnaires.

12. Contact

Questions about this agreement: Aashirvad Kumar, Grievance Officer, [email protected].