Data Processing Agreement

Version 2.0 changes. This version adds WhatsApp messaging data and Inbox agent notes (Clauses 4.7 and 4.8), references the Digital Personal Data Protection Rules, 2025, and updates breach notice, deletion, sub-processor change, audit and acceptance terms. It takes effect on 27 October 2026 and replaces Version 1.2 (5 October 2026).

This agreement sets out how Margifi handles your end customers' personal data when it provides the Margifi service to you. You, the Client, are the Data Fiduciary for that data. Margifi is your Data Processor and acts only on your documented instructions. The agreement lists the data we process, what we do with it, how we protect it, who helps us, and what happens when something goes wrong or the service ends.

1. Parties, Acceptance & Precedence

1.1 Parties

This Data Processing Agreement ("DPA") is entered into between:

Data Fiduciary (Controller): the Client entity subscribing to the Margifi Service, as identified in the Client's Margifi account registration ("Controller"); and

Data Processor: Margifi Private Limited, having its office at 230, Ayodhyapuram Residency, Nr Valak Patiya, Valak, Surat City, PO: Sarthana, Dist: Surat, Gujarat 395006, India ("Processor" or "Margifi").

1.2 Acceptance

The Controller accepts this DPA together with the Terms of Service when it creates a Margifi account, and accepts it again when it connects a WhatsApp Business account to Engage or Inbox. No separate signature is needed for this DPA to bind the parties. A signed PDF copy of this DPA is available on request at admin@margifi.com.

1.3 Relationship to the Terms

This DPA forms part of, and is incorporated into, the Terms of Service between the Controller and Margifi ("Main Agreement"). The order of precedence is: a signed order form (if any), then this DPA (for matters of personal data), then the Main Agreement, then Margifi's other policies.

1.4 Agencies

Where an agency manages a brand's account on Margifi, the agency confirms it is authorised by that brand, and is responsible for that brand's authority, instructions and consents under this DPA.

2. Definitions

The following terms have the meanings given below throughout this DPA. Other capitalised terms have the meanings given in the Main Agreement.

Applicable Data Protection Law means the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and the rules made under it, and any other Indian law on the processing of personal data that applies to the parties under this DPA.

Data Breach means any unauthorised processing of Personal Data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data, that compromises its confidentiality, integrity or availability, as described in the DPDP Act.

Data Fiduciary has the meaning given in the DPDP Act: the person who decides the purpose and means of processing Personal Data. Under this DPA, the Controller is the Data Fiduciary for its end customers' Personal Data.

Data Principal has the meaning given in the DPDP Act: the individual to whom the Personal Data relates. Under this DPA, Data Principals are mainly the Controller's end customers.

Data Processor has the meaning given in the DPDP Act: a person who processes Personal Data on behalf of a Data Fiduciary. Margifi is the Data Processor for the Personal Data it processes for the Controller through the Platform.

Personal Data has the meaning given in the DPDP Act: any data about an individual who is identifiable by or in relation to that data.

Processing means any operation on Personal Data, including collection, recording, storage, retrieval, use, sharing, disclosure, restriction and erasure.

Sub-Processor means any third party Margifi engages to process Personal Data in connection with the Service.

GDPR terms. This DPA is made under Indian law. The EU General Data Protection Regulation and its terms (such as "controller", "processor" and standard contractual clauses) apply only if a Controller established in the European Union signs a separate GDPR addendum with Margifi. Where this DPA uses the word "Controller", it means the Data Fiduciary.

3. Subject Matter, Nature of Processing & Duration

3.1 Subject matter

This DPA governs Margifi's processing of Personal Data on behalf of the Controller in providing the Margifi Service: Insights (profit, ads, RTO and courier analytics), Engage (WhatsApp marketing, automation flows and broadcasts), Inbox (team WhatsApp inbox), Intelligence (AI answers on the Controller's data) and Margifi ID (cross-brand COD risk network), as each is enabled by the Controller. Annex 1 summarises the processing details.

3.2 Nature of processing

Margifi processes Personal Data by:

• Collecting it by API from the platforms the Controller connects (Meta Ads, Google Ads, Shopify, courier partners, and the Controller's WhatsApp Business account through Meta's WhatsApp Business Platform)
• Storing it in the Margifi database (Supabase, Mumbai region)
• Hashing end-customer email addresses and phone numbers, encrypting phone numbers, and, only where the Controller connects Meta, sending hashed identifiers to Meta's Conversions API
• Computing analytics, profit and performance reports, and showing them in the Dashboard
• Sending and receiving WhatsApp messages, templates, broadcasts and automated flows on the Controller's instruction, applying opt-outs, quiet hours and frequency caps, and showing conversations to the Controller's Inbox agents
• Sending the minimum data needed to an AI model provider to answer a question or draft text that the Controller asks for (see Clause 6.5)
• Where the Controller has consented, contributing hashed order outcome signals to the Margifi ID network and returning risk tiers (see Clause 4.5)
• Deleting it at the end of the service, when the Controller disconnects a WhatsApp number, and on Shopify customer or store redaction requests (see Clause 8)

3.3 Duration

Margifi processes Personal Data for the subscription term under the Main Agreement and, after termination, for the export and deletion period in Clause 8 (export available for thirty (30) days, deletion complete by day ninety (90)), unless the Controller asks for earlier deletion.

4. Categories of Personal Data Processed

Margifi may process the following categories of Personal Data for the Controller, depending on which products and integrations the Controller enables:

4.1 Order identifiers

Order IDs and transaction reference numbers used to match fulfilled orders to advertising conversions. These may be linked to customer identifiers assigned by the Controller's Shopify store.

4.2 Attribution data

Ad click identifiers (such as Meta fbclid and Google gclid) and UTM parameters that arrive with the Controller's orders, used only to attribute orders to campaigns.

4.3 Delivery status data

Shipment identifiers and delivery outcomes (delivered, RTO, NDR) received from the courier partners the Controller connects. This data may indirectly show a customer's city or PIN code.

4.4 Account holder data

The names of the Controller's authorised Users (including Inbox agents) as they appear inside conversations, notes and audit logs. Margifi handles Users' own login and account details as Data Fiduciary under the Privacy Policy, not under this DPA.

4.5 Margifi ID network data

Margifi ID is a cross-brand COD risk network. The Controller's order outcome signals join the network only if the Controller gives its explicit consent, using the Margifi ID toggle when it connects a courier. Shopify order data from stores that install Margifi from the Shopify App Store never joins the network. With that consent, Margifi acts on the Controller's instruction to contribute the Controller's signals to the network and to return risk tiers to the Controller.

Network records hold a keyed HMAC-SHA-256 hash of the end customer's phone number, order outcomes, payment method, a hashed PIN code, an order-value band, a risk flag and a count of brands ordered from. No plaintext phone number, name or address is stored in or shared through the network. Other brands see only a risk tier for a phone number, never the underlying data and never which brand it came from. The Controller can withdraw its consent at any time with the same toggle. For more detail, see COD Intelligence.

4.6 End-customer contact data (Shopify)

Order data read from the Controller's Shopify store includes the end customer's email address and phone number, shipping city, state and PIN code, and the order note. Margifi does not request or store end-customer names or street address lines from Shopify.

• Email addresses are never stored in raw form. Margifi stores only a SHA-256 hash.
• Phone numbers are stored encrypted (AES-256) so the Controller's authorised Users can see their own delivery follow-up call list, and every reveal is logged. A keyed HMAC-SHA-256 hash of the phone number is used for the Controller's own repeat-customer analytics.
• Only where the Controller connects Meta, SHA-256 hashes of the email, phone, city, state and Shopify customer ID are sent to Meta's Conversions API to match orders to ad conversions.

4.7 WhatsApp messaging data (Engage and Inbox)

Where the Controller connects its own WhatsApp Business account and number through Meta's Embedded Signup, Margifi processes:

• the end customer's phone number, WhatsApp username or business-scoped user ID, and WhatsApp profile name;
• message content and media sent and received;
• delivery and read statuses, and button and link clicks;
• consent (opt-in) and opt-out records; and
• order and delivery status details the Controller chooses to use in messages.

WhatsApp data passes through Meta's servers, which are outside India, under Meta's own terms. Meta acts as the provider of the WhatsApp Business Platform. The Controller owns its WhatsApp Business account and number.

4.8 Inbox agent notes

Internal notes, tags and assignments that the Controller's Inbox agents add to conversations. These may contain end-customer Personal Data the agents choose to record. The Controller is responsible for what its agents write in notes.

5. Purposes of Processing

Margifi processes Personal Data only to:

1. provide the Service described in the Main Agreement for the products the Controller enables;
2. match advertising spend data to order outcomes and compute profitability metrics;
3. send hashed conversion data to Meta's Conversions API, only where the Controller connects Meta;
4. provide the Controller's delivery follow-up list and repeat-customer analytics;
5. send, receive and display WhatsApp messages, broadcasts and automated flows that the Controller sets up, and keep consent and opt-out records;
6. answer AI questions and draft text that the Controller asks for;
7. contribute to and query the Margifi ID network, only where the Controller has consented;
8. send daily profit reports, alerts and notifications that are part of the Service; and
9. keep the Platform secure, available and working correctly.

Margifi will not process Personal Data for any other purpose without the Controller's documented instruction, except where Indian law requires it. In that case Margifi will tell the Controller about the legal requirement before processing, unless the law prohibits this.

6. Processor Obligations

6.1 Processing on instructions

Margifi processes Personal Data only on the Controller's documented instructions. The Main Agreement, this DPA and the settings the Controller chooses in the Dashboard are the Controller's instructions. Margifi will tell the Controller if it believes an instruction breaks Applicable Data Protection Law.

6.2 Confidentiality

Margifi ensures that everyone it authorises to process Personal Data is bound by confidentiality obligations and receives suitable data protection training.

6.3 Security

Margifi maintains reasonable security safeguards, as required by the DPDP Act and DPDP Rules, to protect Personal Data and prevent Data Breaches. The current measures are set out in Annex 2. Margifi may update them as long as the overall level of protection does not go down.

6.4 Assistance and Data Principal requests

If a Data Principal sends Margifi a request about Personal Data that Margifi processes for the Controller, Margifi will forward it to the Controller within three (3) business days and will not answer it directly unless the Controller instructs it to. Margifi will give the Controller reasonable help to:

• respond to Data Principal requests to access, correct, update or erase Personal Data, or to withdraw consent;
• meet its security and Data Breach obligations; and
• carry out data protection impact assessments or audits where Applicable Data Protection Law requires them.

6.5 AI processing

AI features include Intelligence answers, report narratives and any Engage reply suggestions. To provide them, Margifi sends the data needed for the request to AI models through OpenRouter and the model providers listed on the Sub-processors page. Margifi does not use the Controller's data to train AI models. AI outputs can be wrong. The Controller should check them before acting on them, and must tell its end customers when it uses automated replies.

7. Data Breach Notification

7.1 Notice by Margifi to the Controller

If Margifi becomes aware of a Data Breach affecting the Controller's Personal Data, Margifi will send the Controller an initial notice within 48 hours and full details within 72 hours of becoming aware. The notice will cover, as far as then known:

• the nature, extent, timing and location of the Data Breach;
• the categories and approximate number of Data Principals and records affected;
• its likely consequences;
• the measures Margifi has taken or proposes to limit harm and stop it happening again; and
• a contact person for further information.

Margifi will send updates as it learns more, and will help the Controller notify affected Data Principals.

7.2 Data Protection Board

Margifi will notify the Data Protection Board of India of a Data Breach where the DPDP Act or DPDP Rules require Margifi to do so, and will cooperate with the Controller in any notice the Controller gives to the Board as Data Fiduciary.

7.3 Notice by the Controller to Margifi

The Controller will notify Margifi at admin@margifi.com within 24 hours of becoming aware of a breach on its side that affects Margifi's systems or the credentials used to access them (for example, a compromised Dashboard login or API key).

8. Deletion & Return of Data

8.1 On termination

When the Main Agreement ends, the Controller may export its data for thirty (30) days. Margifi will then delete the Controller's Personal Data, and deletion will be complete by day ninety (90) after termination, including from backups. On request, Margifi will confirm the deletion in writing. The Controller may ask for earlier deletion at any time.

8.2 WhatsApp number disconnect

When the Controller disconnects its WhatsApp number from Margifi and Margifi receives Meta's partner-removed event, Margifi will delete the WhatsApp messaging data for that number (Clause 4.7) within thirty (30) days. The Controller may also set a shorter retention period for WhatsApp messages and media in the Dashboard.

8.3 Shopify uninstall and redaction

Where the Controller installed Margifi from the Shopify App Store, Margifi stops accessing the store and deletes its stored access tokens when the app is uninstalled. Margifi honours Shopify's customer and store redaction requests promptly, and always within thirty (30) days, by deleting the affected end-customer contact data and any Margifi ID records for those orders. It answers customer data requests forwarded by Shopify within thirty (30) days, as described in the Privacy Policy.

8.4 Records kept longer

Margifi may keep consent and opt-out records for up to three (3) years after the subscription ends so that the Controller can prove consent, and any data that Indian law requires it to keep, for the period the law requires. Margifi may also keep anonymised or aggregated data that can no longer be linked to any individual or to the Controller.

9. Sub-Processors

9.1 Authorisation

The Controller gives Margifi general authorisation to engage Sub-Processors, on the conditions in this Clause 9.

9.2 Current Sub-Processors

The current Sub-Processors, with their purpose and location, are listed on the Sub-processors page (Annex 3).

9.3 Sub-Processor obligations

Margifi will have a written agreement with each Sub-Processor with data protection obligations no less protective than this DPA, and remains responsible to the Controller for its Sub-Processors' performance.

9.4 Changes and objections

Margifi will give at least fourteen (14) days' notice before adding or replacing a Sub-Processor, by updating the Sub-processors page and emailing the Controller. The Controller may object in writing within ten (10) days of the notice, on reasonable data protection grounds. If Margifi cannot reasonably accommodate the objection, the Controller may end the affected product without penalty and receive a pro-rata refund of any prepaid fees for the unused period of that product.

10. Controller Obligations

As Data Fiduciary, the Controller confirms that:

1. it has a lawful basis under Applicable Data Protection Law, including any consent required, to give Personal Data to Margifi and to instruct Margifi to process it as this DPA describes;
2. for WhatsApp messaging, it has accepted the WhatsApp Business Terms and the WhatsApp Business Messaging Policy, collects and keeps opt-in records, honours opt-outs, uses approved templates outside the 24-hour customer service window, and does not message bought, rented or scraped lists;
3. it gives notices to its end customers that Applicable Data Protection Law requires, including that it uses Margifi to process their data;
4. the Personal Data it provides is accurate and not excessive for the purposes of processing;
5. it will not instruct Margifi to process Personal Data in a way that breaks Applicable Data Protection Law;
6. it will tell Margifi promptly of any change that affects Margifi's ability to process Personal Data under this DPA, including a withdrawal of consent that requires Margifi to stop processing; and
7. it keeps its Dashboard logins, API keys and connected platform credentials secure, and remains responsible for its own obligations as Data Fiduciary under the DPDP Act.

11. International Data Transfers

Margifi's primary database is hosted in India (Supabase, Mumbai region). Some Sub-Processors, including Meta, Google, Shopify, Vercel, OpenRouter and the AI model providers it routes to, PostHog, Resend and Sentry, process data on infrastructure outside India. Personal Data may therefore be transferred to and processed in other countries.

The DPDP Act permits transfers of Personal Data outside India, except to countries that the Central Government restricts by notification. Margifi will not transfer Personal Data to a restricted country, and makes each transfer under contractual data protection safeguards with the recipient.

12. Audit Rights

12.1 Written audit

Margifi will answer the Controller's reasonable written security and data protection questions, and share relevant policies, reports or certifications it holds, to show its compliance with this DPA. This is the first and usual way to audit Margifi.

12.2 On-site audit

Only after a Data Breach affecting the Controller's Personal Data, the Controller (or an independent auditor bound by confidentiality) may carry out an on-site audit of Margifi's processing for the Controller, at the Controller's own cost, with at least thirty (30) days' written notice, no more than once a year, during normal business hours, and in a way that limits disruption to Margifi and its other clients.

12.3 Confidentiality

Information the Controller obtains in an audit is Margifi's Confidential Information.

13. Liability for Data Breaches

To the extent a Data Breach is caused by Margifi's failure to comply with this DPA or Applicable Data Protection Law, Margifi is liable for penalties, fines and damages caused by that failure. Margifi's total liability for breaches of this DPA is capped at two (2) times the fees the Controller paid in the twelve (12) months before the event giving rise to the claim. All other limits and exclusions in the Main Agreement apply.

To the extent a Data Breach or regulatory action is caused by the Controller's instructions, its actions, its failure to obtain required consent, or its failure to keep its credentials secure, the Controller is responsible for the resulting penalties, fines and damages.

14. Term, Termination & Governing Law

14.1 Term

This DPA applies from its effective date until the Main Agreement ends, and continues after that for as long as Margifi holds any of the Controller's Personal Data. Clauses 7, 8, 10, 12, 13 and 14 survive termination.

14.2 Changes to this DPA

Margifi will give at least fourteen (14) days' notice of changes to this DPA by email and in the Dashboard. Continued use of the Service after the effective date means the Controller accepts the change. A Controller that objects may cancel and receive a pro-rata refund of the prepaid unused period, as set out in the Main Agreement.

14.3 Governing law and disputes

This DPA is governed by the laws of India. Disputes are resolved as set out in the Main Agreement: thirty (30) days of good-faith negotiation, then arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996, seated in Surat, in English. Subject to that, the courts at Surat, Gujarat, India have exclusive jurisdiction.

15. Contact

Questions about this DPA, requests for a signed copy, and breach notices go to admin@margifi.com. For our own privacy practices, see the Privacy Policy and DPDP page.

Annex 1: Processing Details

Annex 2: Security Measures

• Encryption in transit (TLS 1.2 or higher) and encryption at rest.
• End-customer phone numbers stored encrypted (AES-256), with the key held in Supabase Vault, and matched using keyed HMAC-SHA-256 hashes. Email addresses stored only as SHA-256 hashes. Platform access tokens stored encrypted.
• Row-level security in the database, so each Controller (tenant) can access only its own data.
• Two-factor authentication (2FA) for Dashboard users.
• An audit log of every reveal of an encrypted phone number or other personal data in the Dashboard.
• Least-privilege service roles: each internal service gets only the database access it needs, and Margifi ID network data is held apart from tenant data and reached only by a dedicated restricted role.
• Access to production systems limited to authorised personnel, with multi-factor authentication.
• Regular review of security settings, patching of vulnerabilities, and error monitoring with secrets removed before sending.

Annex 3: Sub-Processors

The current list of Sub-Processors, with each one's purpose and location, is kept on the Sub-processors page and forms part of this DPA. Changes follow Clause 9.4.

Version history

• Version 2.0, 27 October 2026 (effective 27 October 2026): added WhatsApp messaging data and Inbox agent notes; added DPDP Rules 2025; click-through acceptance; breach notice 48 hours initial and 72 hours full, Board notification and the Controller's 24-hour duty; export within 30 days and deletion by day 90 including backups; WhatsApp data deleted within 30 days of number disconnect; sub-processor objection with pro-rata refund; AI processing clause; written-first audit; Annexes 1 to 3.
• Version 1.2, 5 October 2026: Shopify App Store uninstall and redaction terms, Shopify and Meta Conversions API listed as Sub-Processors.