Legal

Data Processing Agreement

Version 2026-10-05 · in effect from 5 October 2026

Customers accept this agreement in the app, once signed in.

This agreement is between Blackbird Finance (“Blackbird”, “we”) and the customer who accepts it in the app (“you”). It is the contract section 8(2) of the Digital Personal Data Protection Act, 2023 requires before a Data Fiduciary engages a Data Processor, and it applies whenever Blackbird processes Customer Data for you.

1. Who decides

Customer Data is the personal data you keep in Blackbird about other people: your clients, vendors, the people you trade crypto with, the people named in your bank lines and payroll files, and the people your reminders go to. Annex 1 lists it in full.

For Customer Data, you are the Data Fiduciary: you decide why it is collected and how it is used, and you are responsible for having a lawful ground for it and for giving the people concerned the notice the Act requires (for example, getting a client’s agreement before sending them WhatsApp reminders). Blackbird is your Data Processor. Section 8(1) of the Act keeps you responsible for processing done on your behalf, so this agreement binds us to you.

Your own account details are different: there Blackbird is the Data Fiduciary, under our Privacy Notice, not this agreement.

2. We act only on your instructions

Your instructions are what you do in Blackbird: the records you enter, import or sync, the settings you choose, the documents you create, and the messages and filings you send. A written instruction from you counts too.
We process Customer Data only to provide Blackbird to you as those instructions direct. We do not use it for our own purposes, sell it, share it for advertising, profile the people in it, or use it to train any model.
If we believe an instruction breaks the DPDP Act or another law, we will tell you and need not follow it.

3. People who handle it

Only the people who run Blackbird can reach Customer Data, only to provide the service, fix a fault, or answer you, and each is bound to keep it confidential.

4. Security safeguards

As section 8(5) of the Act requires, we keep reasonable security safeguards in place, including:

Encryption in transit (TLS) and at rest.
Row-level security enforced in the database, so each account’s records can be read and changed only by that account.
Two-factor sign-in, which, once you turn it on, the database itself requires before it releases your records.
An audit trail of changes to your records, and logs of processing kept for at least a year, as the DPDP Rules require.
Restricted, need-only access to production systems.

5. Sub-processors

You authorise us to use these sub-processors for Customer Data:

Who	What they do	Where
Optional journal AI service (identified before upload)	Extracts and suggests journal drafts from only the description and files you choose to submit; available only when Blackbird enables it	The service and its terms are shown before you submit a file
Supabase	Database, sign-in and file storage	India
Vercel	Hosting the app	India; pages served from a global network
WhatsApp Business Platform (Meta)	Delivering the payment reminders a customer sends their clients	Outside India
Sandbox (sandbox.co.in), a GST Suvidha Provider	Reaching the GST system when a customer files through Blackbird	India

We hold each sub-processor to obligations no less protective than these, and we remain responsible to you for what they do.
Before we add or replace one, we will tell you in the app and by email at least 30 days ahead. If you object on reasonable data-protection grounds and we cannot meet the objection, you may stop using the affected feature or close your account.
Services you connect yourself (Binance, PayPal, the GST and income-tax portals, files you upload from other services, and anyone you send a document to) receive data at your direction and are not our sub-processors.

6. Personal data breaches

If we become aware of a breach affecting Customer Data, we will tell you without undue delay and in any case within 24 hours.
We will tell you what we know: its nature, extent, timing and location, its likely impact, and what we have done and will do about it, and keep you updated as we learn more.
That is so you can inform the people affected and give the Data Protection Board the detailed report rule 7 of the DPDP Rules requires within 72 hours. We will help you with both.

7. Requests from the people in your records

If someone asks us to see, correct or erase Customer Data about them, or raises a grievance about it, we will pass it to you straight away and not answer it ourselves unless you ask us to.
Blackbird lets you find, correct, delete and export the records yourself, so you can answer within the 90 days the DPDP Rules allow. Where you cannot, we will help.
We will help you answer the Data Protection Board on processing we did for you.

8. Where it is processed

Customer Data is stored and processed in India, except that reminders you send on WhatsApp pass through Meta’s systems outside India. Section 16 of the Act allows this unless the Government restricts transfer to a country, and we will follow any such restriction.

9. Return and erasure

You can download all your Customer Data at any time from Settings → Privacy, and delete any record in the app.
When your account closes, we keep Customer Data for 30 days so you can download it, then erase it, as section 8(7) of the Act requires once the purpose is served. Copies in backups are not restored except to recover the service, and are overwritten as the backups expire.
We erase Customer Data sooner if you ask us to, except what a law requires us to keep.

10. Showing we comply

We will answer your reasonable written questions about how we process Customer Data and give you the information you need to show the Board that your processor meets this agreement.

11. How long it lasts, and changes

This agreement lasts for as long as we process Customer Data for you, and its duties on erasure and confidentiality outlast it.
Each party is responsible for its own obligations under the DPDP Act. Nothing here limits a duty the law does not allow to be limited.
When we change this agreement, we ask you to accept the new version in the app. Until you do, the version you accepted applies.
This agreement is governed by the laws of India.

Questions about this agreement: support@blackbirdfinance.net.

Annex 1. Details of processing

Subject matter and duration: providing Blackbird to you, for as long as you use it, and the 30 days after your account closes. Nature: storing, organising, calculating with, displaying, exporting and, where you direct, transmitting (invoice links, WhatsApp reminders, GST filings).

Data	Whose	Personal data	Purpose
Journals and ledgerledger_accounts, journal_sequences, journal_entries, journal_lines, journal_ai_usage	You and the people named in your transaction records	Chart of accounts; Journal dates, references, narrations and debit/credit lines; Source snapshots and extracted evidence; Posting and reversal history; AI usage counters; selected text and document contents only when you submit an AI draft	To prepare journal drafts, keep balanced accounting records and provide ledger and trial balance reports. Optional AI only extracts and suggests; you review and confirm each posting.
Clientsclients	Your clients and the people you deal with there	Name, email and phone; GSTIN, address and country; Whether and when they agreed to WhatsApp messages, and their language	To invoice them and track what they owe you, as you direct.
Invoices and incomeinvoices, invoice_line_items, income_entries, payment_matches, recurring_invoice_templates, attachments	Your clients	Invoices, line items, shipping addresses and notes; Payments received and their references; Recurring invoice schedules; Files you attach, and links you share	To create, send and account for your invoices, as you direct.
Vendors and expensescreditors, expense_entries, expense_line_items	Your vendors and creditors	Name, email, phone, GSTIN and address; Bills, line items and what you paid	To record your expenses and claim input tax credit, as you direct.
Bank lines and payoutsbank_accounts, bank_entries, external_transactions	You, and the people named in your bank lines, payout and payroll files (including any employees or contractors)	Bank account and UPI details; Bank statement lines and their narrations; Payouts and payroll imported from Stripe, Deel, Rippling or PayPal	To match payments to invoices and expenses, as you direct.
GST and export filingsuser_gstins, gstr1_exports, gst_taxpayer_sessions, edf_filings, compliance_events, lut_letters	Your clients, as they appear in your returns	GSTINs; GSTR-1 data, with clients’ GSTINs and invoices; Export declarations and compliance dates; The session with the GST system while filing	To prepare and file your returns, as you direct.
Crypto trades and the people you trade withvda_counterparties, vda_trades, vda_tds_postings, vda_tds_certificates, vda_tds_agreements, vda_tds_challans, vda_tds_statements, vda_tds_profiles	The people you buy crypto from and sell it to	Legal name, PAN and its status, residency and entity type; Email, phone, address and P2P nicknames; Orders, payment references (UPI or bank) and wallet addresses; Tax deducted, certificates and lower-deduction certificates	To work out, deduct, pay and report TDS on your crypto purchases, as you direct.
WhatsApp payment reminderswhatsapp_reminders, collection_reminders	Your clients	Phone number; The message, its language and payment link; Delivery status and replies	To send the reminders you choose to send, as you direct.
Connected accountspaypal_connections, razorpay_connections, accountant_links	You	PayPal API credentials (encrypted) and account email	To fetch your transactions from the accounts you connect.
Audit trailaudit_logs	Anyone named in a record that changed	What changed in your records, when, and from which IP address	To keep the audit trail of your books that company law expects, and to look into misuse.
Settings and cataloguecollection_settings, inventory_items, invoice_settings	No one: business settings	Invoice numbering and defaults; Items and services you sell	To fill in your documents the way you set them up.