Last updated: 2026-10-14

This Data Processing Addendum ("DPA") supplements the Terms of Service between you (the customer) and Yieldwise Farmtech Private Limited ("Hyperfiling") and governs our processing of personal data on your behalf.

1. Roles of the parties

For personal data uploaded to your workspaces, you act as the Data Fiduciary and we act as a Data Processor in the sense of the Digital Personal Data Protection Act, 2023.

2. Scope of processing

• Subject matter: the workspace, document, query, draft, and audit log data your team uploads or generates, and the records the YieldWise platform sends to a workspace held for your client, as the Privacy notice describes in section 1.
• Duration: the term of the subscription, plus the export and deletion windows described in section 7.
• Nature and purpose: operating the AI compliance workspace, including citation-grounded research, document drafting, notice tracking, and billing.
• Categories of data: account data, usage data, content data, and communications.

3. Sub-processors and location of processing

We engage the following sub-processors:

• Hostinger: hosting of the application server, the database, uploaded documents and the nightly backups, in Mumbai, India.
• Amazon Web Services (AWS): AWS Bedrock, for text generation when our local model is unavailable, for reading the text in uploaded images, and for search embeddings; and AWS S3, for an encrypted copy of the nightly backups in the Mumbai region (ap-south-1).
• Resend: delivery of the emails the service sends.
• Razorpay: payment processing.
• Vercel: serving the pages of the web application.

This list is updated when it materially changes.

Text generation, including research answers, drafts, and the analysis of uploaded documents and notices, is sent first to a local language model, Gemma 4 (31B), which runs on computing hardware we operate in Karnataka, India, and which our server reaches over an encrypted SSH tunnel. If that model cannot be reached, times out, returns an error or no answer, or has just failed several times in a row, the request is sent to the Claude Sonnet 4.5 model on AWS Bedrock. That request enters AWS in the Mumbai region (ap-south-1), but it uses a global cross-region inference profile, so AWS may process it in another region, inside or outside India.

Text in uploaded images is read by the same model on AWS Bedrock, through the same global inference profile, so an image may be processed outside India; the local model is not used for images. Research questions and searches are converted into embeddings by AWS Bedrock in the Mumbai region.

A company name or CIN typed into company search is looked up first in our copy of the government's MCA company master data and, if it is not found there, on the Government of India's open government data platform. If neither finds the company, the text typed may be sent to the DuckDuckGo search engine and, if that fails or finds nothing, to Bing. These search engines and the government platform are not sub-processors engaged under this DPA, and its commitments do not bind them. The text of a research question is not sent to any search engine.

4. Security measures

• The database and uploaded documents are stored on a server in Mumbai, India.
• TLS 1.2+ encryption in transit.
• Workspace isolation enforced in the application layer: every query is scoped to the workspaces the requesting user belongs to.
• Role-based access control on every authenticated surface.
• An audit log recording create, update, delete and export actions with the acting user and timestamp.

5. Breach notification

We notify you without undue delay and within seventy-two hours of becoming aware of a personal data breach affecting your data. The notice describes the nature of the breach, its likely consequences, and the measures taken or proposed.

6. Audit rights

We make available all information necessary to demonstrate compliance with this DPA. On reasonable notice and at most once per year, you may audit our security posture remotely. On-site audits require mutual agreement and may be subject to confidentiality undertakings.

7. Data return and deletion

On termination of the subscription, we will provide your workspace content on request. A self-service export is not yet available, so this is handled by our team; we would rather describe the process we actually operate than one we do not. Deleting a workspace removes its records from the database immediately. Copies remain in our backups until those backups are deleted. As a rule, each nightly backup is deleted from our server within 16 days of being made, and the encrypted copy in AWS S3 expires 35 days after it is made and is removed permanently by S3 7 days after that. Copies made by hand before a software deployment, and copies kept for recovery from an incident, are not part of that schedule and may be retained longer. They are held on our server in Mumbai, and some of them also in AWS S3 in the Mumbai region (ap-south-1). Deletion of the underlying stored files is in progress and is not yet complete. Records that a law applicable to us requires us to retain are retained.