Who this applies to

This addendum is part of the Terms of Service between AskDoozy (“we”, “us”), run by Shiv Sarthak Sabhlok as a sole proprietor based in India, which provides the Doozy app, and the business that uses it (“you”). It applies whenever we process personal data on your behalf in providing the service.

For that personal data, you are the controller and we are your processor. Where you are yourself a processor for someone else, we are your sub-processor, and these terms apply in the same way.

If you need a signed copy for your records, write to [email protected] and we will countersign this addendum as it stands.

What we process

Purpose: to provide Doozy: carrying out the tasks your team asks for, in the tools your workspace connects, and the support and billing that go with it.
Duration: for as long as you use the service, and until deletion as set out below.
People the data is about: your team members, and the people whose details appear in your messages and connected tools, such as your customers, members and suppliers.
Kinds of data: names, email addresses and account details; the messages, files and records Doozy is asked to work with; and anything else your connected tools hold that a task touches. You decide which tools Doozy can reach.

We do not ask for special categories of personal data, and Doozy is not meant for them. If you send them, they are covered by these terms in the same way.

Our commitments

Your instructions only. We process personal data only to provide the service and on your instructions, which are these terms, your settings and what your team asks Doozy to do. If we believe an instruction breaks data protection law, we will tell you.
No training. We do not use your data, or your customers’ data, to train AI models, and neither may our sub-processors.
Confidentiality. Everyone at AskDoozy who can access personal data is bound to keep it confidential, and access is limited to the people who need it.
Security. We keep the measures in the section below in place for as long as we process your data.
Help with requests. We help you respond to requests from people exercising their rights, and with security, impact assessments and consultations with authorities where they concern the service.

Sub-processors

You authorise us to use the sub-processors on our sub-processors page. Each is bound by a written contract that protects personal data at least as well as this addendum, and we remain responsible for their work.

We update that page before a new sub-processor starts handling customer data. Write to [email protected] to be told by email when it changes. If you object to a new sub-processor on reasonable data protection grounds, tell us within 30 days; we will try to find a way around it, and if we can’t, you may end the affected part of the service and we will refund any amount you have prepaid for it.

Security measures

Each task runs in its own isolated environment, kept apart from other customers’ work and shut down when the task ends.
Data is encrypted in transit, and everything we store is encrypted at rest.
Credentials for the tools you connect are encrypted a second time, with a key unique to your workspace, and are never shown to the AI.
Tools that delete or overwrite start switched off, and your owners decide what Doozy can reach.
Each customer’s data is kept apart from every other customer’s.
Access to production systems is limited to the people who need it.
Sign-ins, setting changes and the use of saved secrets are written to an activity record that cannot be edited.

Our Security page describes these in more detail.

Personal data breaches

If we become aware of a breach of security that affects personal data we process for you, we will notify your workspace owners within 72 hours of becoming aware of it. We will tell you what happened, the data and people likely to be affected, what we have done to contain it, and who to contact, and we will add details as we learn them. We will take reasonable steps to limit the harm and to prevent it happening again.

International transfers

We and some of our sub-processors process data outside your country, including in India, the United States and, for AI processing, China. Where data protection law requires it, these transfers rely on appropriate safeguards, such as the European Commission’s standard contractual clauses and the UK’s addendum to them, which this addendum incorporates where needed.

Deletion and return

When you ask us to delete your workspace, or your use of the service ends and you ask us to, we delete the personal data we process for you within 30 days. Before that, owners can export what Doozy remembers from the web app, and you can ask us for a copy of the rest. We may keep records the law requires us to keep, such as invoices, and security records for as long as they are needed for that purpose; these terms keep applying to them.

Audits

We will give you the information you reasonably need to show that we meet this addendum, including answers to security questionnaires and the reports our sub-processors make available to us. Where that isn’t enough, you may audit our compliance once a year, with 30 days’ notice, at your own cost, in a way that does not disrupt the service or expose other customers’ data.

Liability and order

Each party’s liability under this addendum is subject to the limits in the Terms of Service. If this addendum and the terms differ on how personal data is processed, this addendum applies.

Data Processing Addendum