Migrating production infrastructure? Get up to ₹10,000 in migration credits. Apply now
voroa

Data Processing Agreement

This Data Processing Agreement ("DPA") applies together with our Terms of Service, and is between:

  • Web Tech Digital Work, a sole proprietorship trading as Voroa, Commercial Office No. 605, Freedom Towers, CTS No. 15184, Near Akashwani, Chhatrapati Sambhajinagar, Maharashtra 431001, India, GSTIN 27ATFPT3932L1Z6 ("Voroa", "we"); and
  • the customer who holds a Voroa workspace ("Customer", "you").

It applies automatically to every workspace. You do not need to sign a separate copy.

1. Definitions

Words such as "personal data", "Data Fiduciary", "Data Processor", "Data Principal" and "personal data breach" have the meaning given in the Digital Personal Data Protection Act, 2023 and its Rules ("DPDP Act").

"Customer Data" means the personal data that you or your users put into your Voroa workspace - for example inside your applications, databases, environment variables, secret files, logs and backups.

2. Roles

For Customer Data, you are the Data Fiduciary and Voroa is your Data Processor. You decide why and how that data is processed; we process it only to run the services you use.

For your own account details (your name, email, billing details), Voroa is the Data Fiduciary, and our Privacy Policy applies instead of this DPA.

3. What we process, and why

| | | |---|---| | Purpose | Hosting, building, running, monitoring and backing up the services and databases in your workspace; storing the objects in your Voroa Object Storage buckets, including writing a bucket's access key into a service's environment variables when you use Connect to a service | | Kind of data | Whatever personal data you place in your workspace. We do not inspect it or decide what it is | | Data Principals | Your users, customers, staff, or anyone else whose data you store with us | | Duration | For as long as your workspace exists, plus the deletion period in section 9 |

4. Our obligations

We will:

  1. Process Customer Data only to provide the service, and only on your instructions. Using the Voroa dashboard, API or connected tools counts as your instruction.
  2. Not sell Customer Data, and not use it to train AI models or for advertising.
  3. Make sure everyone at Voroa who can reach Customer Data is bound to keep it confidential.
  4. Protect Customer Data with the safeguards described in our Security Overview, including encryption in transit, encryption of stored secrets, tenant isolation and encrypted backups (except objects in Voroa Object Storage, which are not backed up).
  5. Help you answer requests from your Data Principals (access, correction, erasure) where you cannot do it yourself in the dashboard.

5. Your obligations

You confirm that you have a lawful basis under the DPDP Act for the personal data you put into Voroa, that you have given any notices and collected any consents the DPDP Act requires, and that you will not store data in Voroa that you are not allowed to process.

6. Sub-processors

You allow us to use the following sub-processors to deliver the service:

| Sub-processor | What it does | Where | |---|---|---| | Our cloud infrastructure provider | Runs your applications and databases; stores your data | India | | DigitalOcean | Extra build capacity on short-lived machines that are destroyed after use | India (Bangalore) | | Amazon Web Services (S3) | Stores encrypted backup copies | India (Mumbai) | | Cloudflare | Network security and delivery; carries a service's web traffic when edge protection is on for it; stores Customer Data in Voroa Object Storage | Global network; object storage in the Asia-Pacific region, best effort | | Transactional email and error monitoring providers | Send service emails; detect and fix faults | May be outside India |

Our current list is also available on request at legal@getvoroa.com.

We will tell you before we add or replace a sub-processor that handles Customer Data, by email to the workspace owner, at least 14 days in advance. If you object on reasonable data protection grounds, you may close your workspace before the change takes effect.

7. Where Customer Data is stored

Customer Data is hosted in India, except data stored in Voroa Object Storage, which is stored in the Asia-Pacific region on a best-effort basis as described in the Object Storage policy. Some sub-processors in section 6 may process limited data outside India to deliver the service (for example email delivery, error reports, or web traffic routed through Cloudflare). In every such case the data is encrypted in transit, and it is shared only to the extent needed to run the service.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we will:

  1. inform the workspace owner without undue delay, and in any case within 48 hours of becoming aware of it, so that you can meet your own duty to inform the Data Protection Board and your Data Principals;
  2. tell you what happened, what data is affected, and what we are doing about it, and keep you updated;
  3. report the incident to CERT-In where Indian law requires it.

9. Deletion and return of data

You can export or delete your services, databases and backups from the dashboard at any time.

When you close your workspace or ask us to delete it, we delete Customer Data within 30 days. Backups of your databases are deleted within 30 days. Two kinds of backup are kept longer, and are used only to recover the platform after a failure:

  • Voroa's own platform backups, which can include your environment variables and secret files in encrypted form, are kept for up to 3 years.
  • Full server snapshots, taken before maintenance, are kept until the next snapshot replaces them.

We keep records we are legally required to keep, such as GST invoices, for the period the law requires. Content we remove under the Information Technology Rules, and its records, are kept for 180 days where the law requires it, even if you delete it or your workspace.

10. Information and audits

On request, we will answer reasonable written questions about how we protect Customer Data and give you our current Security Overview. We answer in writing; we do not offer on-site audits.

11. Liability, term and law

  • Each party's liability under this DPA is subject to the limits in the Terms of Service.
  • This DPA lasts as long as Voroa processes Customer Data for you.
  • If this DPA and the Terms of Service conflict on the protection of personal data, this DPA wins.
  • This DPA is governed by the laws of India. The courts in Chhatrapati Sambhajinagar, Maharashtra have jurisdiction.

12. Contact

Questions about this DPA, or any data protection request: legal@getvoroa.com (Grievance Officer: Sagar Tayde).

*Version 1 - effective 4 October 2026.*