Data processing terms.

Last updated 3 November 2026.

These terms apply where Crudoimage Photographic Technologies Private Limited ("processor") processes personal data on behalf of a customer company ("controller") through the Crudo.si app.

Instructions

The processor processes personal data only to provide the app as the controller's users direct, and for no other purpose.

Confidentiality and security

• Each company's data is isolated from every other company's, verified by automated tests before release.
• Access to administration uses two-step sign-in; administrative changes are recorded in a tamper-evident audit record.
• Secrets are kept out of logs; personal notebooks are encrypted at rest; backups are encrypted and stored off the server.

Sub-processors

Our sub-processors are: Contabo (servers, in India); AI and speech services that do the work the users ask for; Firebase (phone alerts); Razorpay and PayU (payments). We tell the controller by email before we add or change one. Questions: [email protected].

Assistance and records

The processor helps the controller answer requests from individuals and provides an export of the controller's data on request. Company memory and skills are not deleted by the app; every earlier version is retained.

Breach notification

We tell the controller within 72 hours of finding a breach that affects its data, by email, with what happened and what we are doing. Contact: [email protected], +91 85388 45052.

Term

When the service ends, the controller can take an export of its data. We delete the data 90 days later, or sooner within 30 days if the controller asks. Backups are removed within 35 days after that. Billing papers are kept for 8 years because tax law needs them.