Data Processing Agreement

The Customer decides why and how its members' data, and data about people it adds (such as candidates or test-takers), is processed. Loomrail processes that data only to provide the service and only on the Customer's documented instructions — the Terms, this DPA, the Customer's settings in the app, and its members' use of the product. Loomrail tells the Customer if it believes an instruction breaks the law. The applicable laws include India's Digital Personal Data Protection Act, 2023 and its Rules, and where relevant the EU/UK GDPR.

Only Loomrail staff who need access to run or support the service can reach Customer data, under a duty of confidentiality, with least-privilege roles, and every staff action on an account is logged.

Loomrail keeps the technical and organisational measures in Annex 2 and on the Security page, and may improve them but will not reduce the overall level of protection.

The Customer authorises the sub-processors listed on the Sub-processors page. Loomrail binds each to data protection terms at least as protective as this DPA and remains responsible for them. Loomrail gives the Customer at least 30 days' notice of a new sub-processor; the Customer may object on reasonable data protection grounds, and if it can't be resolved, end the affected service and get a pro-rata refund of prepaid fees for it.

Data is stored in Singapore and processed by the sub-processors in the locations listed. Loomrail transfers data only to countries the Government of India has not restricted. For personal data subject to the EU or UK GDPR, the parties agree to the European Commission's Standard Contractual Clauses (and the UK Addendum), which are incorporated by reference.

Loomrail gives the Customer tools to find, export, correct and delete data (in the app and through its admin console) and helps with requests from data principals that the Customer can't handle with those tools. Requests Loomrail receives directly about Customer data are passed to the Customer.

Loomrail notifies the Customer without undue delay and within 48 hours of becoming aware of a breach affecting Customer data, with what is known — nature, data and people affected, likely consequences, and measures taken — and updates as it learns more, so the Customer can meet its own duties (including the DPDP 72-hour report to the Data Protection Board). Loomrail also meets its own reporting duties, including to CERT-In.

The Customer can export or delete its data at any time. When the Customer's account ends, Loomrail deletes Customer data within 30 days, except where the law requires keeping it (such as invoices), and on request confirms deletion in writing. Backups age out on their normal cycle.

Loomrail answers reasonable security questionnaires and shares its current security documentation and, when available, third-party audit or penetration-test reports under confidentiality. If those aren't enough to show compliance, the Customer may audit once a year with 30 days' notice, at its own cost, during business hours, without access to other customers' data.

Each party's liability under this DPA is subject to the limits in the Terms or signed order. This DPA lasts as long as Loomrail processes Customer data. It is governed by the laws of India, and the courts named in the Terms have jurisdiction. If this DPA and the Terms conflict on data protection, this DPA wins.

• Encryption in transit (HTTPS / TLS) everywhere; encryption at rest by the hosting providers; app-level AES-256-GCM encryption of connected-app tokens, with the key in Google Secret Manager.
• Passwords stored only as salted bcrypt hashes; sign-out of every device on demand and after a password, email or role change.
• Company single sign-on (Google Workspace, Microsoft Entra or any SAML identity provider), SCIM user provisioning and de-provisioning, and admin roles for company accounts; two-factor sign-in with an authenticator app, required for Loomrail admins and available for the Customer to require of its members.
• Least-privilege staff roles; every staff action on accounts recorded in an audit log; company admins see an audit log of their members' activity.
• Human approval before an AI agent sends email, posts, or sends invitations; per-person send limits; defences against instructions hidden in outside content, including approval before opening a site the member didn't name after outside content was read, and images from other sites loading only on click.
• Secrets masked before text reaches AI models; Customer-selected masking of contact, ID and financial details.
• Company retention settings, deletion and export; deletion of an account removes its files from storage; the company audit log is kept for 3 years.
• Application logs kept 365 days, stored in India; a written breach-response plan covering DPDP and CERT-In timelines.
• AI model providers used through business APIs that do not train on API data.