Skip to content
Confirmly
Request a demo

Data Processing Agreement

Last updated 16 September 2026

1. Parties and scope

This Data Processing Agreement (“DPA”) is between the merchant that installs Confirmly (“Merchant”, “you”) and Frostleaf LLP (“we”, “us”). It forms part of the Terms of Service and applies whenever we process Customer Personal Data to provide Confirmly. You accept it when you accept the Terms.

In this DPA:

  • “Data Protection Law” means the laws of India that apply to the processing, including the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 and its rules as they come into force.
  • “Customer Personal Data” means personal data of your customers that we process on your behalf to provide the Service.
  • “Data Fiduciary”, “Data Processor”, “Data Principal” and “personal data breach” have the meanings given in the Digital Personal Data Protection Act, 2023.

2. Roles

For Customer Personal Data, you are the Data Fiduciary and we are your Data Processor. You are responsible for having a lawful basis to process Customer Personal Data and to have your customers called, and for giving your customers any notice the law requires.

3. Details of the processing

  • Purpose: placing automated order confirmation calls to your customers, recording their answers, and writing the results to your Shopify store, as described in the Terms.
  • Data Principals: your customers who place orders on your Shopify store.
  • Personal data: name, phone number, email address, delivery address, order details, call details and outcomes, call transcripts and, if you switch recording on, call recordings.
  • Duration: for as long as you use Confirmly, and until the data is deleted under section 10.

You must not configure the Service to collect sensitive personal data, such as health or financial account information, from your customers.

4. Processing on your instructions

We process Customer Personal Data only to provide the Service and on your documented instructions, which are these Terms, this DPA and the settings you choose in the app. We will tell you if we believe an instruction breaks Data Protection Law. We will not sell Customer Personal Data, use it for our own marketing, or use it to train AI models.

We may process Customer Personal Data where the law requires it. If so, we will tell you first unless the law prohibits it.

5. Confidentiality

We allow access to Customer Personal Data only to staff and contractors who need it to provide or support the Service, and who are bound by confidentiality obligations.

6. Security

We maintain reasonable security safeguards appropriate to the risk, including encryption in transit and at rest, access controls limited to people who need access, access logging kept for at least one year, separate test and production environments, backups and an incident response process.

7. Service providers (sub-processors)

  • You authorise us to use service providers to help provide the Service, in these categories: cloud hosting and databases, telephony, voice AI and language processing, and email.
  • We impose data protection obligations on each provider that are no less protective than this DPA, and we remain responsible for their performance.
  • We will give you the current list of providers on request, and at least 15 days’ notice by email or in the app before adding or replacing a provider. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using the Service by uninstalling it.

8. Processing outside India

Customer Personal Data may be processed outside India by us or our providers, only as permitted by Data Protection Law and subject to any restrictions notified by the Government of India.

9. Assistance

  • Customer requests. If a customer contacts us directly, we will pass the request to you. We will help you respond to requests to access, correct or erase their data, including through Shopify’s privacy requests.
  • Breaches. If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay, and within 48 hours where possible, with the information you need to notify the Data Protection Board and affected customers. We will take reasonable steps to contain and fix it.
  • Compliance. We will give you reasonable information and help so you can meet your obligations under Data Protection Law.

10. Retention and deletion

  • 30 days after calling on an order finishes, we remove the customer’s name, phone number, email, street address and pincode, the order’s items, the transcript and any recording, as described in the Privacy Policy.
  • When you uninstall Confirmly, or when we receive Shopify’s request to delete your store’s data, we delete Customer Personal Data within 30 days, except where the law requires us to keep it.
  • Deleted data may remain in encrypted backups for a short period until they are overwritten, and is not used during that time.

11. Information and audits

On written request, not more than once a year unless required by a regulator or after a breach, we will answer reasonable questions about our security and data protection practices. Any audit must be on reasonable notice, during business hours, subject to confidentiality, and at your cost.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms about Customer Personal Data, this DPA prevails.

13. Contact

Frostleaf LLP
Email: business@frostleaf.co