Data Processing Statement
Version 2026-11-03-draft. Processors under the Digital Personal Data Protection Act, 2023. Draft dated 03/11/2026.
1. Purpose
1.1 AIVE is the Data Fiduciary for the personal data of beta users (see the DPDP Act notice). This statement lists the processors AIVE engages, as section 8(2) of the Digital Personal Data Protection Act, 2023 requires, and the terms on which they process. It is a public summary. [[OWNER TO DECIDE: whether to publish the signed agreements or only this summary]]
2. Processors
| Processor | What it does for AIVE | Personal data it handles | Location | Status |
|---|---|---|---|---|
| Amazon Web Services (the AWS entity that contracts with AIVE: [[OWNER TO SUPPLY: AWS contracting entity]]) | Hosting, storage and compute for the website, the editor and its databases | Everything in clause 2 of the privacy notice, including uploads and their outputs | Mumbai region, India | In use |
| Amazon Simple Email Service | Sends service emails: waitlist, your turn, beta ends tomorrow, beta ended | Your email address, and the content of the email (your place in the line, dates, links) | [[OWNER TO SUPPLY: SES region]] | In use |
| Razorpay Software Private Limited | Takes payments by card, UPI and net banking and tells us the result | Order and payment references, amount, plan and result. Card and UPI details are entered on Razorpay and are not received by AIVE | India | Planned: opens with paid plans |
| Cloudflare (Turnstile) | Checks that a sign-up is made by a person | The challenge response and IP address | Global network | [[OWNER TO DECIDE: whether in use in the beta]] |
2.1 AIVE does not send your footage, transcripts or any content to an AI service run by another party. Transcription and editing suggestions run on AIVE’s own servers.
2.2 Razorpay also acts as a data fiduciary in its own right for the payment details you give it; its privacy policy applies to that data.
3. Terms we require of each processor
- Process personal data only on AIVE’s documented instructions and only for the service described in clause 2.
- Keep it confidential and allow access only to people who need it.
- Apply reasonable security safeguards, and tell AIVE without undue delay of a personal data breach so that AIVE can meet section 8(6) of the DPDP Act and CERT-In’s reporting time.
- Use another sub-processor only with AIVE’s permission or on terms that give the same protection.
- Delete or return personal data when the service ends, or when AIVE tells it to, unless a law requires it to keep the data.
- Help AIVE respond to requests from Data Principals and to the Data Protection Board of India.
3.1 [[OWNER TO DECIDE: counsel to confirm that AWS, SES and Razorpay standard terms give these protections, or whether a signed addendum is needed for each]]
4. Transfers
4.1 See clause 10 of the DPDP Act notice for the statement on transfers outside India under section 16 of the DPDP Act.
5. Questions
5.1 Write to [[OWNER TO SUPPLY: grievance officer name]] at [[OWNER TO SUPPLY: grievance officer email]].