Niyora Back
This is a working draft pending review by legal counsel. It describes how Niyora handles data today; the final wording is subject to change.

Data Processing Terms

Last updated: 4 September 2026

These Data Processing Terms ("DPT") form part of the agreement between the CS Firm ("you", the Data Fiduciary) and Niyora, operated by Operators of Niyora (the Data Processor), and apply whenever you upload or process personal data of your clients and of individuals connected to them ("Client Personal Data") using the Service.

1. Roles

For Client Personal Data, you are the Data Fiduciary and determine the purposes and means of processing. Niyora is your Data Processor and processes Client Personal Data only on your documented instructions - which include your configuration and use of the platform's features.

The same applies to HR records you keep about your own team - member profiles, and the government identifiers and identity documents you may switch on for them. You are the Data Fiduciary as the employer; Niyora stores and presents those records on your instruction and uses them for no purpose of its own. Everything in these Terms that refers to Client Personal Data applies equally to them.

2. Your authority and warranties

You represent and warrant that:

  • you have a lawful basis and all necessary authority and consents to collect the Client Personal Data and to upload it to Niyora and have it processed as described here and in the Privacy Policy;
  • you are authorised to share the personal data of directors, shareholders, subscribers, signatories and other individuals (including identifiers such as PAN, DIN and Aadhaar references and KYC documents) for the compliance and secretarial purposes for which you use the Service;
  • where you switch on government identifiers for your own team, you have a lawful basis to collect and retain your team members' PAN, Aadhaar and identity documents for employment, payroll and statutory purposes, and you will grant access to them only to the people in your firm who need it;
  • you will provide the notices and, where required, obtain the consents that the DPDP Act requires of a Data Fiduciary in respect of those individuals; and
  • your instructions to Niyora comply with applicable law.

3. Niyora's obligations as Processor

Niyora will:

  • process Client Personal Data only to provide and support the Service and on your instructions, not for its own purposes;
  • apply appropriate technical and organisational security measures (see the Privacy Policy, §7);
  • ensure personnel handling the data are bound by confidentiality;
  • assist you, taking into account the nature of processing, in responding to Data Principal requests and in meeting your security, breach-notification and audit obligations;
  • notify you without undue delay on becoming aware of a personal-data breach affecting Client Personal Data; and
  • on termination, delete or return Client Personal Data subject to legal retention requirements, as described in Data Retention & Deletion.

4. Sub-processors

You authorise Niyora to engage the sub-processors listed on the Sub-processors page - including Supabase, Vercel, Anthropic, OpenAI and Resend, and, only where you enable them, Google Drive, OneDrive and MCA/GST verification providers. That page is the authoritative list and carries a dated change log. Each sub-processor is bound by data-protection obligations consistent with this DPT.

We will give you notice - in-app and by email to your firm administrators - before a new sub-processor begins processing Client Personal Data, so that you may object on reasonable grounds. If we cannot resolve a reasonable objection, you may terminate the affected part of the Service.

5. AI processing

By using AI features you instruct Niyora to transmit the relevant Client Personal Data to our AI sub-processors (Anthropic, OpenAI) via their APIs for the requested task. Under those providers' standard API terms, your data is not used to train their models. See the AI Use & Disclaimer.

6. Cross-border transfer

You acknowledge and instruct that certain processing (notably AI inference and embeddings) may occur outside India, subject to the safeguards described in the Privacy Policy and as permitted by the DPDP Act.

7. Optional cloud mirror

If you connect Google Drive or OneDrive, Niyora copies uploaded files to your firm's own cloud storage. You control that storage, its access and retention, and are responsible for the data once mirrored there.

8. Liability & precedence

This DPT supplements the Terms of Service; in the event of conflict on data-processing matters, this DPT prevails. Liability under this DPT is subject to the limitations in the Terms of Service.

Questions about data processing? Contact privacy@niyora.space.

Related documents

Privacy Policy
What personal data we collect, why, who we share it with, and your rights under the DPDP Act 2023.
Terms of Service
The rules for using Niyora - your account, acceptable use, billing, and limits of liability.
AI Use & Disclaimer
Niyora’s AI assists your work but is not legal advice - review every output before you rely on or file it.
Sub-processors
Every third party that processes data on our behalf, what each one receives, and a dated log of changes.
Data Retention & Deletion
How long we keep each kind of data, how deletion works, and what survives it - including backups.

Policy version 2026-09-04