WorkWeaverWorkWeaver Data Processing Addendum
This Data Processing Addendum is a draft pending counsel review and is not approved by counsel.
Effective Date: October 22, 2026
Last Updated: October 22, 2026
Version: 4.0
BitFoundry Tech Private Limited · 3/80, Ganesar Street, Ganapathipalayam, Sulur, Moperipalayam, Coimbatore 641659, Tamil Nadu, India · CIN U62011TZ2025PTC035159
In plain words
This Addendum explains how WorkWeaver handles personal data that a customer puts into, or connects to, the WorkWeaver platform. It applies the moment a customer accepts our Terms online or signs an agreement with us. The customer decides why and how that data is used; WorkWeaver processes it only on the customer's instructions to provide the service. We keep it confidential and secure, use only the sub-processors listed in Annex 3, tell the customer about breaches within 24 hours, help with requests from individuals, never train shared models on it, and delete or return it when the contract ends.
Annex 3 lists every provider that touches customer data on our accounts, and says when each one applies. Some run for every workspace (for example AWS hosting and Amazon Bedrock embeddings for company memory). Others apply only when the customer turns on a feature, such as WorkWeaver-managed models, voice or the meeting bot. Services the customer connects with its own accounts and keys are the customer's own providers, not ours.
The records the product creates about its own operation (tool calls, errors, retries, timing, the billing meter) are covered by our Privacy Notice, not this Addendum, and are designed to exclude customer content. Our liability under this Addendum sits inside the limits in the Terms.
This summary helps you read the Addendum; the numbered sections are the binding text.
1. Parties and scope
1.1 This Data Processing Addendum ("DPA") is between BitFoundry Tech Private Limited ("WorkWeaver") and the Customer that accepts the WorkWeaver Terms of Service ("Terms") online or under a Signed Agreement. It forms part of the Agreement and takes effect when the Agreement starts.
1.2 It applies to Customer Personal Data: personal data contained in Customer Data that WorkWeaver processes for Customer in providing the Service.
1.3 It does not apply to personal data WorkWeaver processes for its own purposes as a Data Fiduciary or controller (such as business contact, billing and website data), which our Privacy Notice covers.
1.4 WorkWeaver is an independent controller (and, under DPDP, a Data Fiduciary) for: (a) the personal data of Authorized Users that it processes for account, authentication, security, support, billing and customer-relationship purposes (including the signup, payment, usage-total, support and satisfaction records kept in its CRM), including the records of acceptance under section 21.8 of the Terms; and (b) Usage Data under sections 10.3 and 10.4 of the Terms. Usage Data is described in the Privacy Notice (section 4.6) and is designed to exclude the content of Customer Data. This DPA does not apply to that data; the Privacy Notice does.
2. Definitions
Words defined in the Terms have the same meaning here. In addition:
- Data Protection Laws: all laws on the processing of personal data that apply to a party's processing under the Agreement, including India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP") as and when their provisions come into force; the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") while in force; and the California Consumer Privacy Act as amended by the CPRA ("CCPA").
- Controller means a Data Fiduciary under DPDP and a business under the CCPA; processor means a Data Processor under DPDP and a service provider under the CCPA; data subject means a Data Principal under DPDP and a consumer under the CCPA; processing has the meaning in DPDP and the CCPA; and a personal data breach is a Personal Data Breach as defined below. Customer is the Controller (Data Fiduciary; business) and WorkWeaver is its processor (Data Processor; service provider).
- Personal Data Breach: a breach of security of the Service leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data (for DPDP, a "personal data breach" as defined in section 2(u) of the DPDP Act). It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as blocked log-in attempts, pings, port scans or denial-of-service attacks that do not lead to such access.
- Sub-processor: a third party WorkWeaver engages to process Customer Personal Data on WorkWeaver's own account.
- Customer-Directed Service: a Third-Party Service that Customer chooses and connects using its own Customer Accounts, credentials or API keys (Annex 3, Part B).
3. Roles
3.1 Subject to section 1.4, Customer is the Data Fiduciary / controller of Customer Personal Data, and WorkWeaver is its Data Processor / processor.
3.2 Where Customer is itself a processor for another controller, Customer confirms that its instructions, including the appointment of WorkWeaver, are authorised by that controller, and WorkWeaver is a sub-processor. Customer remains WorkWeaver's only point of contact.
3.3 Customer-Directed Services are engaged by Customer, not by WorkWeaver. When Customer connects one, Customer instructs WorkWeaver to send data to it and receive data from it. The provider is Customer's own processor or an independent controller under Customer's agreement with it, and not a WorkWeaver Sub-processor.
4. Customer's instructions and obligations
4.1 Instructions. WorkWeaver processes Customer Personal Data only on Customer's documented instructions, including with regard to transfers to another country. The Agreement, Customer's configuration of the Service (including its Agents, Approval Policy, model settings, connected accounts and channels) and Customer's use of the Service are Customer's complete instructions. Other instructions need written agreement and may carry extra fees.
4.2 Unlawful instructions. WorkWeaver tells Customer immediately if, in its opinion, an instruction breaks Data Protection Laws, and may decline to follow it until Customer confirms or changes it.
4.3 Customer's duties. Customer is responsible for: (a) having a lawful basis, and for DPDP, a valid consent under section 6 or a legitimate use under section 7, for all processing it instructs; (b) giving all notices (including the DPDP section 5 notice) and obtaining and recording all consents, including for calls, messages, recordings and transcription; (c) the accuracy, quality and lawfulness of Customer Personal Data; (d) handling withdrawal of consent and telling WorkWeaver which processing must stop; (e) not submitting personal data of children (under 18 under DPDP) or of persons with disabilities without the verifiable consent of a parent or lawful guardian that DPDP requires, and not using the Service for tracking, behavioural monitoring or targeted advertising directed at children; (f) not submitting special-category, sensitive, health, payment-card or other specially regulated data unless a Signed Agreement allows it; (g) its own obligations as a Data Fiduciary, including any duties as a Significant Data Fiduciary; and (h) not submitting personal data of people located in the European Union, the European Economic Area or the United Kingdom (Terms section 1.4).
4.4 Health data. This DPA is not a HIPAA business associate agreement. Customer submits protected health information only where such an agreement is signed.
5. WorkWeaver's obligations
5.1 Purpose limitation. WorkWeaver processes Customer Personal Data only to provide, secure, support and bill the Service for Customer under the Agreement, and as the law requires. If the law requires other processing, WorkWeaver tells Customer first unless the law forbids it.
5.2 No training of shared models. WorkWeaver does not use Customer Personal Data to train, fine-tune or improve any AI model or skill used for any other customer, and does not permit its Sub-processors to do so.
5.3 No cross-customer use. WorkWeaver does not use Customer Personal Data from one customer to benefit another customer. Usage Data is not Customer Personal Data and is handled under section 1.4.
5.4 Connector Data. WorkWeaver processes Connector Data under section 10.5 of the Terms and follows the stricter data-use rules of the provider's API terms for that provider's data (including the Google API Services User Data Policy and its Limited Use requirements, the Microsoft APIs Terms of Use, the Slack API Terms of Service and Salesforce's API terms).
5.5 Confidentiality. WorkWeaver ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and has access only as needed.
5.6 Security. WorkWeaver maintains the technical and organisational measures in Annex 2, which meet the "reasonable security safeguards" standard of DPDP section 8(5) and Rule 6, and the reasonable security practices required by the SPDI Rules. WorkWeaver may update them where overall protection stays at least the same. Customer is responsible for the security of its own systems, Customer Accounts and credentials, and its configuration of the Service.
5.7 Consent records. Where the Service captures a call or meeting consent, a voice-clone consent or an opt-out for Customer, WorkWeaver records it (the person, the announcement used, the date and time, the channel and method) and makes it available to Customer on request. Customer remains responsible for which consents it needs.
5.8 Logs. WorkWeaver keeps logs of processing as Data Protection Laws and other applicable law (including the DPDP Rules and directions of CERT-In) require, for the periods they require.
6. Sub-processors
6.1 General authorisation. Customer gives WorkWeaver general authorisation to engage Sub-processors. The current list is in Annex 3, Part A, and Customer approves it.
6.2 Changes. WorkWeaver notifies Customer of a new or replacement Sub-processor by email to Customer's notice contact and through the Service at least 30 days before it starts processing Customer Personal Data, except where an emergency replacement is needed to keep the Service running, in which case WorkWeaver notifies as soon as practicable.
6.3 Objections. Customer may object in writing within 15 days of the notice on reasonable data protection grounds. The parties discuss in good faith. If WorkWeaver cannot reasonably avoid using the Sub-processor for Customer, Customer may end the affected part of the Service by written notice before the change takes effect, and WorkWeaver refunds prepaid Fees for the unused period and any unused Wallet balance.
6.4 Flow-down and responsibility. WorkWeaver imposes on each Sub-processor written data protection terms that are no less protective in substance than this DPA, to the extent relevant to the service it provides. Where a Sub-processor contracts only on its standard terms, WorkWeaver uses it only after assessing that those terms give at least the protection this DPA requires. WorkWeaver remains responsible to Customer for its Sub-processors' performance of these obligations, subject to section 13.
7. Data subject and Data Principal requests
7.1 If WorkWeaver receives a request from an individual about Customer Personal Data, it redirects the individual to Customer and does not respond itself unless Customer authorises it or the law requires.
7.2 Taking into account the nature of the processing, WorkWeaver helps Customer, mainly through the Service's own features (search, export, correction and deletion), to respond to requests to exercise rights under Data Protection Laws, including DPDP sections 11 to 14 and the CCPA, and consent withdrawals. Help beyond the Service's features is charged at WorkWeaver's then-current rates.
8. Personal Data Breaches
8.1 Notice. WorkWeaver notifies Customer without undue delay and in any event within 24 hours, and no later than any report WorkWeaver makes to a regulator about the same breach, after becoming aware of a Personal Data Breach. This lets Customer meet its own duties, including notifying the Data Protection Board of India and affected Data Principals under DPDP Rule 7.
8.2 Content. The notice describes, as far as then known: the nature and likely extent of the breach, the categories and approximate numbers of individuals and records affected, the likely consequences, the measures taken or proposed, and a contact person. WorkWeaver updates Customer as more information becomes available.
8.3 Response. WorkWeaver contains, investigates and mitigates the breach and cooperates with Customer. Customer makes the notices to regulators and individuals that the law places on the Data Fiduciary or controller. WorkWeaver makes any report that the law places on WorkWeaver directly (such as cyber-incident reports to CERT-In), and tells Customer it has done so where lawful.
8.4 No admission. A notice or response under this section is not an admission of fault or liability.
9. Assistance, records and audits
9.1 Assessments. WorkWeaver gives Customer reasonable information about the Service to help with the data protection impact assessments and audits that DPDP requires of Significant Data Fiduciaries. Extensive help may be charged at WorkWeaver's then-current rates.
9.2 Information. On written request no more than once in any 12 months, WorkWeaver answers a reasonable written security and privacy questionnaire and provides relevant documentation, which is WorkWeaver's Confidential Information.
9.3 Audits. If that information is not enough to show compliance, or a regulator requires it, or after a Personal Data Breach, Customer (or an independent auditor bound by confidentiality and not a WorkWeaver competitor) may audit WorkWeaver's compliance with this DPA: on at least 30 days' written notice, during business hours, no more than once in any 12 months (except where a regulator requires more), without access to other customers' data or to Sub-processors' facilities, and at Customer's cost, including WorkWeaver's reasonable time. Audits of Sub-processors are satisfied by the Sub-processors' own audit reports and certifications.
10. Return and deletion
10.1 Export. Customer may export Customer Personal Data at any time during the term through the Service or by request.
10.2 At the end. After the Agreement ends, Customer has 30 days to export (this is how WorkWeaver returns Customer Personal Data; Customer may instead ask for earlier deletion). WorkWeaver then deletes Customer Personal Data from live systems within 30 days and from backups as they expire in the normal cycle (within 90 days), and confirms deletion in writing on request. Customer should ask for the consent records (section 5.7) it must keep before they are deleted.
10.3 Connector disconnection. When Customer disconnects a connector, WorkWeaver deletes the Connector Data it holds from that connector, unless Customer chooses to keep it.
10.4 Retention required by law. WorkWeaver may keep Customer Personal Data where the law requires it (for example, logs under the DPDP Rules or CERT-In directions, or tax records). It keeps such data confidential, protects it under this DPA, and uses it only for the purpose the law requires.
10.5 DPDP erasure. Where Customer instructs erasure because consent was withdrawn or the specified purpose is no longer served (DPDP section 8(7)), WorkWeaver erases the data, and has its Sub-processors erase it, within 30 days of the instruction, subject to section 10.4.
11. International transfers
11.1 Locations. Customer Personal Data is hosted with Amazon Web Services in the region of Customer's Workspace (listed in Annex 3) and may be accessed from India by WorkWeaver personnel for support and operations. Sub-processors process data in the locations listed in Annex 3. Where Amazon Bedrock uses cross-region inference, it processes prompts and responses in other AWS regions within the United States only, and stores nothing at rest outside the Workspace region.
11.2 From India. WorkWeaver transfers Customer Personal Data outside India only in line with DPDP section 16 and any restriction notified by the Government of India, and any sectoral rule that applies to Customer and that Customer has told WorkWeaver about in writing.
12. CCPA terms
Where WorkWeaver processes personal information subject to the CCPA as a service provider, WorkWeaver: (a) does not sell or share it (as those terms are defined in the CCPA); (b) does not retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer; (c) does not combine it with personal information from other sources, except as the CCPA permits for service providers; (d) complies with the CCPA and provides the same level of privacy protection the CCPA requires; (e) notifies Customer if it can no longer meet these obligations; (f) allows Customer to take reasonable and appropriate steps, including those in section 9, to make sure WorkWeaver uses the personal information consistently with Customer's CCPA obligations, and to stop and remedy unauthorised use; and (g) flows these obligations down to its Sub-processors under section 6.4. Customer tells WorkWeaver of any consumer request WorkWeaver must act on. The business purposes are providing, securing, supporting and billing the Service. WorkWeaver certifies that it understands these restrictions.
13. Liability
Each party's liability under this DPA is subject to the exclusions and limits in section 17 of the Terms (including the single aggregate cap in section 17.3), to the extent the law allows. Nothing in this section limits any liability that cannot be limited under applicable law.
14. General
14.1 This DPA lasts as long as WorkWeaver processes Customer Personal Data under the Agreement.
14.2 If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. A Signed Agreement changes this DPA only where it names the section it changes.
14.3 WorkWeaver may update this DPA to reflect changes in Data Protection Laws, regulator guidance or the Service, with at least 30 days' notice, as section 21.7 of the Terms describes. Changes that materially reduce Customer's protection need Customer's acceptance, and for a Signed Agreement its written agreement, unless the law requires them.
14.4 Governing law and dispute resolution follow section 20 of the Terms.
Annex 1 — Description of processing
| Item | Description |
|---|---|
| Customer / Data Fiduciary | Customer, as identified in its Workspace or Signed Agreement. Role: controller (or processor, see section 3.2). |
| WorkWeaver / Data Processor | BitFoundry Tech Private Limited (WorkWeaver), CIN U62011TZ2025PTC035159, 3/80, Ganesar Street, Ganapathipalayam, Sulur, Moperipalayam, Coimbatore 641659, Tamil Nadu, India. Contact: workweaver@bitfoundry.ai. Role: processor (or sub-processor). |
| Data subjects | Customer's Authorized Users; Customer's employees and contractors; Customer's customers, prospects, suppliers, partners and other contacts; participants in meetings, phone calls, emails, SMS, WhatsApp, Slack and Teams conversations the Service handles for Customer; individuals named in documents and records Customer submits or connects. |
| Categories of personal data | Identity and contact data (name, title, email, phone, address); account and access data (user IDs, roles, authentication and audit logs); communications content (email, chat and WhatsApp messages, meeting and call audio, recordings and transcripts, and their metadata such as numbers, times and participants); business records in connected applications (such as CRM, helpdesk, finance, HR and project records); company memory, notes, documents and files, and the embeddings derived from them; Agent instructions, approvals and Outputs. Exact data depends on what Customer connects and instructs. |
| Sensitive / special-category data | Not intended. Customer controls whether any is submitted (section 4.3(f)). Voice recordings are processed as audio and transcripts; WorkWeaver does not use them to identify individuals biometrically. Any sensitive data submitted is protected by the Annex 2 measures. |
| Frequency of processing | Continuous, for the term of the Agreement. |
| Nature of processing | Collecting, recording, organising, structuring, storing, retrieving, embedding, analysing, transcribing, summarising, generating, transmitting, making available, correcting, erasing and destroying, by automated AI Agents and by WorkWeaver personnel for support and delivery. |
| Purposes | Providing the Service and any Transformation to Customer: running Agents that do work for Customer across departments and channels; maintaining Customer's company memory and skills; quality review; connecting Customer Accounts; support; security; billing; and compliance with law. |
| Duration and retention | For the term of the Agreement, then as in section 10. Customer may delete data earlier through the Service. |
| Sub-processor transfers | As in Annex 3, for the purposes and duration stated there. |
Annex 2 — Technical and organisational security measures
1. Hosting and network - The production platform runs on Amazon Web Services managed infrastructure (including Amazon EKS, Amazon Aurora/RDS for PostgreSQL, Amazon DynamoDB and Amazon S3), in private networks with security groups and least-privilege network paths. - Public endpoints sit behind a content delivery network and web application firewall; only required ports are exposed.
2. Encryption - Data in transit across public networks is encrypted with TLS 1.2 or higher. - Data at rest in databases, object storage and backups is encrypted with AES-256 using keys managed in AWS Key Management Service. - Third-party credentials and API keys that Customer provides are stored encrypted in a secrets manager and used only to provide the Service.
3. Tenant isolation - Each customer's data is logically separated by tenant identifiers enforced at the application and data layers. Requests are authenticated and authorised for the tenant before any data is read or written. - Memory, skills and quality learning from one customer's data are used only for that customer.
4. Access control - Personnel access to production is limited to named people who need it, on least privilege, protected by multi-factor authentication, and removed promptly when no longer needed. - Customer administrators control their own users' roles and access. - Administrative access to customer data is logged.
5. Agent controls - Customers can require human approval before Agents take actions, and can limit which tools, accounts and channels each Agent may use. - Agents' outbound connections are restricted to configured services, and Agent actions, approvals and Outputs are logged with their correlation records.
6. Logging and monitoring - Security-relevant events (authentication, administrative actions, configuration changes, data access by personnel) are logged and kept for the periods the law requires. - Systems are monitored for availability, errors and suspicious activity, with alerts to the people responsible.
7. Secure development and change - Changes go through version control, peer or automated review, automated tests and protected deployment pipelines. - Infrastructure is defined as code. Secrets are not stored in source code. - Dependencies are kept current, known vulnerabilities are tracked, and security issues are fixed in order of severity.
8. Backup, resilience and recovery - Databases are backed up automatically, backups are encrypted, and recovery to an earlier point in time is available.
9. Incident response - A written incident response process covers detection, triage, containment, investigation, notification (section 8; CERT-In reporting where applicable) and post-incident review.
10. People - Personnel are bound by confidentiality obligations and receive security and privacy guidance on joining and periodically.
11. Vendors - Sub-processors are bound by data protection terms under section 6.4 and are assessed for security and privacy before use.
12. Data minimisation and deletion - Customers can delete data through the Service. Connector Data is deleted on disconnection (section 10.3). Deletion after termination follows section 10.
Annex 3 — Sub-processors and Customer-Directed Services
Part A — WorkWeaver Sub-processors
These providers process Customer Personal Data on WorkWeaver's own accounts. The last column says when each one applies.
| Sub-processor | Service | Data processed | Location | Applies when |
|---|---|---|---|---|
| Amazon Web Services, Inc. (and its affiliates) | Cloud hosting, compute (Amazon EKS), databases, object storage, content delivery and firewall, identity (Amazon Cognito), key management, secrets storage and transactional email (Amazon SES) | All categories in Annex 1 | The AWS region of Customer's Workspace: United States (AWS US East, N. Virginia; AWS US West, Oregon). Backup and recovery copies stay in the United States | Always |
| Amazon Web Services, Inc. (Amazon Bedrock) | (a) Embeddings that index Customer's company memory for search and recall; (b) model inference when a Workspace Admin selects WorkWeaver-managed models, or adds the WorkWeaver Cloud model to the Workspace's model chain, or Customer calls the WorkWeaver managed inference API (/inference/v1). AWS does not use Bedrock inputs or outputs to train models and does not share them with model providers. |
(a) Text of memory items, documents and messages being indexed; (b) prompts, context and Outputs sent to the model, which may include any category in Annex 1 | The AWS region of Customer's Workspace; for inference, cross-region inference within the United States only | (a) Always; (b) only when WorkWeaver-managed models are selected, the WorkWeaver Cloud model is on the model chain, or Customer calls the managed inference API |
| X.AI LLC (xAI) | Real-time voice model for phone calls, voice rooms and meeting voice, when Customer has not connected its own voice provider key | Call and meeting audio, transcripts, and the context sent to the voice model | United States | When Customer uses voice features on WorkWeaver's default voice provider |
| Deepgram, Inc. | Speech-to-text for meeting and call transcripts | Meeting and call audio and transcripts | United States | When Customer uses meeting or call transcription on WorkWeaver's provider |
| Sarvam AI | Speech-to-text for Indian languages | Meeting and call audio and transcripts | India | When Customer uses Indian-language transcription on WorkWeaver's provider |
| Recall.ai, Inc. | Meeting bot that joins video meetings (such as Zoom, Google Meet, Microsoft Teams) to capture audio, video and transcripts for Customer | Meeting participants' names, audio, video, transcripts and meeting metadata | United States (AWS US East, N. Virginia; AWS US West, Oregon) | When Customer enables the meeting bot without its own Recall.ai account |
| Twilio Inc. | Telephony for calls and SMS on a WorkWeaver-held account | Phone numbers, call audio, SMS content and call metadata | United States | Only when Customer uses a number on WorkWeaver's Twilio account; numbers on Customer's own Twilio account are Customer-Directed (Part B) |
| Zoho Corporation Private Limited | Business email, scheduling, helpdesk and invoicing used by WorkWeaver to run the customer relationship and any Transformation | Authorized Users' and Customer contacts' names, emails, phone numbers, meeting times and correspondence | India (Zoho's India data centre) | Always (limited to account, support and Transformation administration) |
| Razorpay Software Private Limited | Payment processing for Wallet top-ups and refunds | Billing contact's name, email, phone and payment references (no Customer Data content) | India | Self-serve Workspaces that fund a Wallet, once Wallet top-ups open |
| Stripe, Inc. | Invoicing for Workspaces on a Signed Agreement, until these invoices move to Zoho Books | Billing contact's name, email, address, tax identifiers, invoice lines and payment references (no Customer Data content) | United States | Workspaces on a Signed Agreement paid by invoice |
WorkWeaver personnel in India access Customer Personal Data for support, delivery of any Transformation and operations, under section 5.5.
Part B — Customer-Directed Services (not WorkWeaver Sub-processors)
Customer chooses and connects these services with its own accounts, numbers, credentials or API keys, under its own agreements with the providers (section 3.3; Terms section 7). They are listed here for transparency.
| Category | Examples |
|---|---|
| Telephony and SMS | Twilio, or another carrier, on Customer's own account |
| WhatsApp messaging | Meta Platforms (WhatsApp Business Platform) and Customer's WhatsApp business solution provider |
| AI model and voice providers | Model and voice providers whose keys Customer adds (for example Anthropic, OpenAI, Google Gemini, Amazon Bedrock on Customer's AWS account, xAI, ElevenLabs, Sarvam AI, Deepgram) |
| Meeting capture | Recall.ai on Customer's own account |
| Collaboration and meetings | Slack, Microsoft Teams, Zoom, Google Meet and other platforms Customer connects |
| Business applications | Email, calendar, CRM, helpdesk, finance, HR, project and storage applications Customer connects (for example Google Workspace, Microsoft 365, Zoho, HubSpot, Salesforce) |
Last Updated: October 22, 2026