Data Processing Agreement
Effective 20 October 2026 · Updated 2 November 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between Saichandra Bandi, operating StaffFlow, Hyderabad, Telangana, India ("StaffFlow", "Processor", "we"), and the customer that uses StaffFlow (the "Customer", "you"). It sets out how StaffFlow processes Personal Data on the Customer's behalf. It applies automatically to every Customer from the date the Customer first uses StaffFlow, and requires no separate signature. A Customer that requires a countersigned copy may request one at hello@staffflowpro.com.
- Definitions
- Roles and scope
- Customer instructions
- Confidentiality
- Security
- Separation between customers
- Sub-processors
- Personal Data Breach
- Assistance to the Customer
- International transfers
- United States privacy laws
- Use of artificial intelligence
- Return and deletion
- Audits and information
- Liability
- Term, precedence and changes
- Governing law
- Annex 1 — Processing details
- Annex 2 — Security measures
- Annex 3 — Sub-processors
1. Definitions
1.1"Applicable Data Protection Law" means every law on the protection of personal data that applies to the processing under this DPA, including, as applicable, India's Digital Personal Data Protection Act, 2023; United States federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"); and, where they apply, the EU and UK General Data Protection Regulations ("GDPR").
1.2"Personal Data" means any information relating to an identified or identifiable natural person that StaffFlow processes on behalf of the Customer under the Terms. It includes "personal information" and "digital personal data" as those terms are defined in Applicable Data Protection Law.
1.3"Controller", "Processor", "Data Subject" and "processing" have the meanings given in Applicable Data Protection Law. Where that law uses "Data Fiduciary", "Business" or "Service Provider", "Controller" and "Processor" are to be read accordingly.
1.4"Sub-processor" means a third party engaged by StaffFlow that processes Personal Data in providing the service.
1.5"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
1.6"Customer Systems" means the Customer's own Microsoft 365 tenant (including its mailbox and OneDrive) and the Customer's own QuickBooks Online company, to which the Customer grants StaffFlow access.
2. Roles and scope
2.1The Customer is the Controller of the Personal Data. StaffFlow is a Processor acting on the Customer's behalf.
2.2The subject matter, nature, purpose and duration of the processing, the categories of Personal Data and the categories of Data Subjects are described in Annex 1.
2.3The Customer is responsible for having a lawful basis for the processing, for giving any notices that Applicable Data Protection Law requires to its consultants, contractors and other Data Subjects, and for the accuracy of the configuration it enters into StaffFlow.
2.4Account data of the Customer's own dashboard users (name, email address, and authentication data) is processed by StaffFlow to provide and secure the service, as described in the Privacy Policy.
3. Customer instructions
3.1StaffFlow processes Personal Data only on the Customer's documented instructions. The Terms, this DPA, the Customer's configuration of StaffFlow, and the Customer's actions in the StaffFlow dashboard (including approving, correcting, discarding and closing items) together constitute those instructions.
3.2StaffFlow will not process Personal Data for any other purpose, unless required to do so by law. In that case StaffFlow will inform the Customer before processing, unless the law prohibits it.
3.3StaffFlow will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
4. Confidentiality
4.1StaffFlow treats all Personal Data as confidential. Any person StaffFlow authorises to process Personal Data is bound by an appropriate obligation of confidentiality.
4.2Access to Personal Data is limited to what is necessary to operate, support and secure the service. In the ordinary course of support, StaffFlow reviews error logs and processing outcomes and does not read the contents of timesheets. Where reading a specific document is necessary to resolve an issue the Customer has raised, StaffFlow does so only to the extent necessary.
5. Security
5.1StaffFlow implements and maintains appropriate technical and organisational measures to protect Personal Data, taking into account the nature of the processing and the risks to Data Subjects. The measures in place are described in Annex 2 and on the Security page.
5.2StaffFlow may update these measures over time, provided that an update does not materially reduce the overall level of protection.
6. Separation between customers
6.1Every record StaffFlow holds is bound to exactly one Customer. Every request to the service is scoped to the signed-in user's Customer, and an incoming email is attributed to a Customer at the moment it is first received, from the mailbox it arrived in, and never from the email's contents.
6.2StaffFlow does not combine one Customer's data with another's, and does not use one Customer's data to provide the service to another.
7. Sub-processors
7.1The Customer gives StaffFlow general authorisation to engage the Sub-processors listed in Annex 3.
7.2StaffFlow requires each Sub-processor to protect Personal Data under terms that are no less protective, in substance, than this DPA, and remains responsible to the Customer for each Sub-processor's performance.
7.3StaffFlow will notify the Customer by email at least fourteen (14) days before engaging a new Sub-processor, and will update Annex 3. The Customer may object on reasonable data protection grounds within that period. If StaffFlow cannot reasonably address the objection, the Customer may terminate its use of StaffFlow, and StaffFlow will refund any fees prepaid for the period after termination.
7.4Services that the Customer itself contracts with and connects to StaffFlow (Microsoft 365 and QuickBooks Online) are the Customer's own systems. StaffFlow acts within them only as the Customer authorises, and the Customer's use of them remains governed by the Customer's agreements with those providers.
8. Personal Data Breach
8.1StaffFlow will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.
8.2The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at first will be provided as it becomes available.
8.3StaffFlow will take reasonable steps to contain and remedy the breach, and will cooperate with the Customer in meeting any obligation to notify a regulator or the affected Data Subjects. Notice of a breach is not an admission of fault.
9. Assistance to the Customer
9.1Taking into account the nature of the processing, StaffFlow will assist the Customer in responding to requests from Data Subjects to exercise their rights, including access, correction, erasure and portability.
9.2If StaffFlow receives such a request directly, it will refer the Data Subject to the Customer and will not respond itself, unless the Customer instructs otherwise or the law requires it.
9.3StaffFlow will provide reasonable assistance with any data protection impact assessment or regulatory consultation the Customer is required to carry out in relation to StaffFlow.
10. International transfers
10.1StaffFlow is operated from India, and its Sub-processors operate infrastructure in the United States and elsewhere. Personal Data may therefore be processed outside the country in which it was collected.
10.2StaffFlow will transfer Personal Data across borders only in compliance with Applicable Data Protection Law. Where a transfer requires a recognised transfer mechanism, such as standard contractual clauses, StaffFlow will put that mechanism in place with the Customer on request.
11. United States privacy laws
11.1Where the CCPA or a comparable United States state privacy law applies, StaffFlow acts as the Customer's "service provider" or "processor", and certifies that it will:
- not sell or share the Customer's personal information, as those terms are defined in that law;
- not retain, use or disclose that personal information for any purpose other than performing the service for the Customer, or outside the direct business relationship between StaffFlow and the Customer;
- not combine that personal information with personal information it receives from any other source, except as that law permits;
- comply with that law, provide the same level of privacy protection as it requires, and notify the Customer if StaffFlow determines it can no longer meet its obligations under it.
12. Use of artificial intelligence
12.1To read a timesheet, StaffFlow sends the document's contents to the Sub-processors listed in Annex 3 that interpret documents. They are used only to read the document. Neither StaffFlow nor any Sub-processor uses the Customer's data to train or improve artificial intelligence models.
12.2Artificial intelligence does not decide what is billed. Every figure a model reads is checked by deterministic rules against the document itself, including the document's own printed totals. Where a figure cannot be verified, StaffFlow holds it for a person to review rather than proceed. No invoice is created without a person approving the period first.
13. Return and deletion
13.1Timesheet documents are filed into the Customer's own OneDrive, and invoices are created in the Customer's own QuickBooks company. Those records remain with the Customer when the service ends.
13.2When the Customer's account is closed, StaffFlow automatically sends the Customer's administrators a complete export of the records it holds for the Customer (configuration, recorded hours, invoice references and their audit history) by a secure, single-use link. The Customer may also request an export at any time while the account is open.
13.3Closing starts a grace period of fourteen (14) days, during which the Customer may ask StaffFlow to reopen the account. After the grace period, StaffFlow ends its access to the Customer's QuickBooks company, stops monitoring the Customer's mailbox, and deletes the Customer's records from its live systems. The deletion is completed within thirty (30) days of closing.
13.4Copies in StaffFlow's database backups are never restored selectively and expire within about ninety (90) days of the deletion. If StaffFlow has to restore its systems from a backup, it repeats every deletion made since that backup was taken.
13.5The deletion does not affect the Customer's own OneDrive or QuickBooks company. Files and invoices kept there remain with the Customer.
13.6After the deletion, StaffFlow keeps only a record that the account existed and was deleted (the Customer's name, its StaffFlow ID and the relevant dates), the record of actions taken by StaffFlow's own staff, and the account's sign-in history with all names and email addresses removed.
13.7StaffFlow may retain Personal Data only where a law to which it is subject requires it, and then only for as long as that law requires, kept confidential and processed for no other purpose. Residual copies in Sub-processors' systems are deleted under their own retention cycles described in Annex 3.
14. Audits and information
14.1StaffFlow will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including written answers to a reasonable security questionnaire, no more than once in any twelve-month period unless a Personal Data Breach has occurred.
14.2Where that information is not sufficient to demonstrate compliance, or where a regulator requires it, the Customer may conduct an audit, or have an independent auditor bound by confidentiality do so, on at least thirty (30) days' written notice, during normal business hours, at the Customer's cost, and in a manner that does not compromise the security of any other customer's data.
15. Liability
15.1Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Terms, except where Applicable Data Protection Law does not permit such a limitation.
16. Term, precedence and changes
16.1This DPA remains in force for as long as StaffFlow processes Personal Data on the Customer's behalf.
16.2If this DPA conflicts with the Terms in relation to the processing of Personal Data, this DPA prevails.
16.3StaffFlow may update this DPA to reflect changes in law or in the service. A change that materially reduces the protection given to the Customer's Personal Data will not apply to a Customer without at least thirty (30) days' notice by email, during which the Customer may terminate its use of StaffFlow.
17. Governing law
17.1This DPA is governed by the laws of India, and the courts of Hyderabad, Telangana have exclusive jurisdiction, consistent with the Terms, except where Applicable Data Protection Law requires otherwise.
Annex 1 — Processing details
| Subject matter | Automating the processing of consultant timesheets into recorded hours, payroll figures and invoices for the Customer. |
|---|---|
| Nature of processing | Receiving timesheet emails from a mailbox the Customer authorises; storing and filing the documents in the Customer's storage; reading hours, dates and labels from documents; checking them against the document; recording hours; presenting items for review and approval; computing invoice and pay amounts from the Customer's configuration; creating approved invoices in the Customer's QuickBooks company and reading their status and payments; keeping an audit trail; sending account emails to the Customer's dashboard users (password-reset links and password-change confirmations). |
| Purpose | Providing the service under the Terms, on the Customer's instructions. |
| Duration | For the term of the Customer's use of StaffFlow, and afterwards only as set out in Section 13. |
| Data Subjects | The Customer's consultants and contractors; contacts at the Customer's clients and vendors (such as timesheet approvers); the Customer's dashboard users. |
| Categories of Personal Data | Names; business email addresses; hours worked and the dates worked; project, client and vendor names; bill rates and pay rates entered by the Customer; timesheet and approval documents and the emails that carry them; invoice amounts and references; dashboard account and authentication data, including records of password-reset requests (the time and the network address of each request, kept for ninety days). |
| Sensitive data | None intended. StaffFlow does not ask for and is not designed to process government identifiers, bank account or payment card details, or special categories of personal data. The Customer should not configure StaffFlow to receive them. |
Annex 2 — Security measures
- Encryption in transit. All traffic to and from StaffFlow and between StaffFlow and its Sub-processors is encrypted with TLS.
- Encryption of the most sensitive values. QuickBooks access tokens and two-step sign-in secrets are encrypted by StaffFlow with authenticated encryption, each under its own key. Passwords and recovery codes are stored only as bcrypt hashes.
- Separation between customers. As described in Section 6.
- Access control. Every dashboard request requires authentication. Roles distinguish users who may approve and change records from users with read-only access. Two-step sign-in with an authenticator app is available. Repeated failed sign-ins lock the account temporarily. Sessions use secure, HTTP-only cookies and expire after twelve hours. A forgotten password is reset through a link emailed to the user's own address: each link works once and expires after thirty minutes, only a one-way hash of it is stored, requests are rate-limited, and the response never reveals whether an account exists. A reset changes the password only — it does not sign the user in, so two-step sign-in still applies — and it signs the user out of every session.
- Service-to-service authentication. Every automated endpoint requires a secret, compared in constant time and failing closed. Notifications from Microsoft are verified before they are acted on.
- Secrets management. Credentials and keys are held as environment secrets of the hosting platform, never in source code.
- Human approval and verification. As described in Section 12.2.
- Audit trail. Approvals, corrections, discards and closures are recorded with the user, the time and the reason. Changes to placement records are kept in a change history. A figure a person corrected is marked as corrected on the record itself.
- Monitoring. Processing failures are recorded and alerted. A scheduled check alerts if a Customer's mailbox stops delivering timesheets.
- Minimisation. StaffFlow requests the narrowest access to Customer Systems it needs, stores documents in the Customer's own storage rather than in StaffFlow, and does not read bank feeds, payroll or unrelated transactions in QuickBooks.
Annex 3 — Sub-processors
| Sub-processor | What it processes | Purpose | Retention |
|---|---|---|---|
| Railway Corp. | StaffFlow's application, database and workflow engine, and the data they hold | Hosting | For the term, then per Section 13 |
| OpenAI, L.L.C. | Text and tables of timesheet documents | Reading hours, dates and labels | Not used for training. May be retained up to 30 days for abuse monitoring, then deleted |
| Microsoft Corporation (Azure AI Document Intelligence) | Images and PDFs of timesheet documents | Reading text and tables | Deleted automatically 24 hours after processing |
| Cloudflare, Inc. | Requests to the dashboard | Hosting the web application | Transient |
| Resend, Inc. | Operational alert emails to StaffFlow's operator, which may include a sender's email address and an error description; and account emails to the Customer's dashboard users (password-reset links, password-change confirmations and invitations to join the Customer's workspace), which contain the user's email address and, for a reset or an invitation, the Customer's name and a single-use link | Failure alerts; account emails | Per Resend's standard retention. A reset link expires 30 minutes after it is sent and works once |
The Customer's own Microsoft 365 tenant (accessed through Microsoft Graph) and the Customer's own QuickBooks Online company are Customer Systems under Section 7.4, not Sub-processors.
Contact
Questions about this DPA, requests for a countersigned copy, security questionnaires and notices under it: hello@staffflowpro.com.