Data Processing Agreement
Last updated: 19 June 2026 · Version 1.0
1. Definitions
Data Controller
The business using Vylot (you). You determine the purposes and means of processing your customers' personal data.
Data Processor
Vylot. We process data on your behalf, according to your instructions and this DPA.
2. Subject Matter & Scope
Vylot processes personal data on behalf of the Customer to provide the Vylot platform services including invoicing, customer relationship management, point-of-sale, storefront, and reporting features. The nature and purpose of processing, and the types of personal data involved, are described in our Privacy Policy.
- Customer names & contact details
- Business GSTIN & PAN
- Invoice & payment data
- Employee/team names & emails
- Product & inventory data
- IP addresses & device info
3. Processor Obligations
Vylot, as Data Processor, commits to the following obligations:
- Process personal data only on documented instructions from the Controller
- Ensure that authorised persons are bound by confidentiality obligations
- Implement appropriate technical and organisational security measures
- Assist the Controller in responding to data subject requests
- Delete or return all personal data at the Controller's choice upon termination
- Provide all necessary information to demonstrate compliance with GDPR Article 28
- Notify the Controller of any data breach within 72 hours of becoming aware of it
4. Technical & Organisational Measures
Vylot implements and maintains appropriate technical and organisational security measures as described in our Security page, including AES-256 encryption at rest, TLS 1.3 in transit, zero-trust API authentication, and logical data isolation per business account.
5. Sub-processors
Vylot uses the following sub-processors to deliver the service. By accepting this DPA, you provide general authorisation for us to engage these sub-processors.
6. International Data Transfers
Some of our sub-processors are based outside India. Transfers outside India are conducted only where an adequate level of protection exists or appropriate safeguards (such as Standard Contractual Clauses) are in place. Cloudflare and Google Firebase maintain EU–US Data Privacy Framework certifications and Standard Contractual Clauses.
7. Data Retention & Deletion
Upon termination of the service, Vylot will delete or return all personal data within 30 days, unless applicable law requires longer retention. Account holders can request data export or deletion at any time via official.vylot@gmail.com.
8. Signing this DPA
For Growth and Scale plan customers, this DPA is incorporated by reference into your Terms of Service. By using Vylot, you agree to this DPA. Enterprise customers requiring a countersigned copy should contact us.