The short version. If you use Zymura to process other people's personal data, you are the controller and we are your processor. This page is the agreement that governs that relationship. It is available to read before you sign up, and a countersigned copy is available on request.
1. Parties and scope
This Data Processing Agreement ("DPA") is entered into between Zymura, a sole proprietorship based in Bengaluru, Karnataka, India, registered as a micro enterprise under Udyam registration number UDYAM-KR-03-0744649 ("Processor", "we"), and the customer identified in the accompanying order or account registration ("Controller", "you").
It applies whenever you use Zymura to process personal data relating to individuals other than yourself, and forms part of our terms of service. Where this DPA and the terms conflict on the subject of personal data, this DPA prevails.
2. Roles
You determine the purposes and means of the processing. We process personal data only on your documented instructions, which for the ordinary operation of the service are the flows you build, the schedules you set and the connections you configure. Building a flow is an instruction to process the data that flow touches.
We will tell you if we believe an instruction infringes applicable data protection law. We do not process your data for our own purposes, and we do not sell, share or monetise it.
3. Confidentiality
Zymura is operated by a single individual. That person is bound by confidentiality in respect of personal data processed on your behalf, and access is limited to what is necessary to operate, secure and support the service. There are no other personnel with access.
4. Security
We implement the technical and organisational measures set out in Annex II. Those measures are described honestly, including what is not in place. We will not represent a control we have not implemented.
5. Subprocessors
You give general authorisation for the subprocessors listed in Annex III. Each is engaged under its own published data processing terms, identified in that annex so you can read them at source rather than take our characterisation of them. We remain liable to you for their performance.
If we intend to add or replace a subprocessor, we will update Annex III and notify account holders by email at least 30 days before the change takes effect. If you object on reasonable data protection grounds within that period, you may terminate the affected part of the service without penalty and receive a pro-rata refund of any prepaid fees.
6. Assisting you
Taking into account the nature of the processing, we will assist you with:
- Data subject requests. Where a data subject contacts us directly about data we hold on your behalf, we will refer them to you rather than respond ourselves. Where you need to access, correct, export or erase data held in the service, the application provides those functions directly; where it does not, we will assist within 14 days of a written request.
- Impact assessments and prior consultation, by providing the information about our processing that is reasonably available to us.
- Security incidents, as set out in section 7.
7. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting data processed on your behalf. The notification will describe what we know at that point: the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken. We will provide further detail as it becomes available rather than delaying the first notification until the picture is complete.
Notification will be sent to the email address on your account. Keeping that address current is your responsibility.
8. Deletion and return
You can delete your account and everything stored with it at any time, without asking us, using the process described at delete your account. Deletion is real: there is no soft-delete flag and no shadow record.
On termination of the service you may choose whether we delete or return the personal data processed on your behalf. Return is by export of your flows and run records in machine-readable form. Tell us which you want before you close the account; if you tell us nothing, we delete. Deletion completes within 30 days, except where retention is required by applicable law. Our database provider holds routine backups which cycle within 90 days, so deleted data disappears from those within that window rather than instantly.
9. Audits and information
We will make available the information necessary to demonstrate compliance with this DPA, and will respond to reasonable written security questionnaires. Given the size of the business, we do not currently hold a SOC 2 report or ISO 27001 certification, and we do not offer on-site audits. We will not claim otherwise, and we would rather tell you that plainly than have it emerge during procurement.
10. International transfers
We are established in India. Where you are established in the EEA, the United Kingdom or Switzerland, personal data you process through Zymura will be transferred outside those jurisdictions.
For such transfers, the parties incorporate by reference the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), with Clause 7 (docking) included, Clause 9 option 2 (general written authorisation, 30 days' notice) applying, Clause 11 optional redress body not applying, Clause 17 governed by the law of Ireland, and Clause 18(b) designating the courts of Ireland. Annexes I, II and III to this DPA serve as Annexes I, II and III to those clauses.
For transfers subject to UK law, the parties incorporate the UK International Data Transfer Addendum to the EU SCCs, with the courts and law of England and Wales applying. For Switzerland, references to the GDPR are read as references to the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
11. Term, liability and law
This DPA takes effect when you begin using the service to process personal data and continues while that processing continues. Liability under this DPA is subject to the limitations in our terms of service. Except where the incorporated Standard Contractual Clauses provide otherwise, this DPA is governed by the laws of India, with courts in Bengaluru, Karnataka having jurisdiction.
12. Signing
This DPA applies without signature from the moment you use Zymura to process personal data. If your procurement process requires a countersigned copy, write to support@zymura.app with your legal entity name and address and we will return one.
Annex I — Description of the processing
Subject matter and duration
Execution of automated workflows that you define, on the schedule you set, for as long as you use the service.
Nature and purpose
Zymura retrieves, transforms and transmits data between third-party services according to the steps you configure. We have no independent purpose for the data; the purpose is whatever your flow does.
Types of personal data
Determined entirely by you. Zymura does not require or request any particular category of data, and cannot know in advance what a flow will carry. Data we hold as a direct result of providing the service:
| Data | Why it exists |
|---|---|
| Account email address | Authentication and service notices |
| Flow definitions | So your flows follow you between devices and run on schedule |
| Connection credentials | So a scheduled flow can reach the services you connected |
| Run records, including per-step inputs and outputs | So you can see what a run actually did |
| Operational logs (IP address, timestamps) | Security and reliability |
Special category data
Zymura is not designed for special category data as defined in Article 9 GDPR, and we make no representation that it is suitable for such data. If your flows will carry it, you should satisfy yourself that the measures in Annex II are adequate for your purpose before doing so.
Categories of data subjects
Determined by you — typically your customers, employees, contacts or users, depending on which services your flows connect.
Retention
| Data | Retained |
|---|---|
| Account and flow definitions | Until you delete them or close your account |
| Run records and step data | Until you delete the run, the flow, or your account. There is no automatic expiry, so that your history remains available to you; deletion is available at any time and is immediate. |
| Operational logs | 30 days, then deleted, unless a specific security investigation requires longer |
| Queued webhook payloads | 3 days, then expired automatically |
| Provider backups | Cycled within 90 days |
Annex II — Technical and organisational measures
In place
- Encryption in transit. All traffic to and from the service uses TLS. Flow steps that contact third-party APIs do so over HTTPS.
- Encryption at rest. The database is encrypted at rest by our database provider.
- Tenant isolation. Postgres row-level security is enabled on every table holding customer data — profiles, flows, connections and run records — with policies restricting each row to its owning account.
- Credential handling. Fields a connector declares as secret are masked before a run record is written. Run step inputs and outputs are additionally scrubbed by key name, so a token returned by a third-party API does not persist into run history, and are truncated to bounded sizes.
- Server-side secrets. Service credentials are held as platform secrets and are never present in client-side code or in the repository.
- Least access. One individual has production access. No third-party contractors, no support tooling with data access.
- No tracking. No analytics provider, no advertising pixels, no third-party trackers on the application or website.
- Vulnerability reporting. A published contact and a commitment to respond, described on our security page.
- Deletion. Self-service account deletion with no soft-delete.
Not in place
Stated so you can assess it rather than assume it:
- No SOC 2 report and no ISO 27001 certification.
- No independent penetration test has been commissioned to date.
- No automated test suite covering the row-level security policies. The policies are in place; verification that they deny what they should deny is manual.
- No SAML or SCIM single sign-on. Authentication is email-based.
- No formal, tested disaster recovery plan beyond our providers' own resilience.
- No 24/7 on-call rotation. Incident response is best-effort by one person.
If any of these are requirements for your organisation, Zymura is not currently the right choice and we would rather you knew that now.
Annex III — Subprocessors
This is the authoritative list. Our privacy policy points here rather than repeating it, so the two cannot disagree.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Application hosting, request proxy, scheduled execution, webhook queue | Global edge network |
| Supabase, Inc. | Authentication and database, where you have an account | Mumbai, India |
| Google LLC | Gemini API, used only to answer questions asked in the support chat on our website. Not used to process flow data. | Google infrastructure |
| Dodo Payments | Checkout, invoicing and tax as merchant of record. Engaged only if you buy a paid plan. | As set out in their terms |
Not a subprocessor of ours: the third-party services your flows connect to, and any AI provider you configure for an AI step. Those are services you have chosen and authenticated with your own credentials. Data sent to them travels on your instruction, under your relationship with them, and we do not add prompts to any model or train anything on your data.