1. Roles
For personal data of your leads, customers and their contacts ("Customer Personal Data"), you are the Data Fiduciary: you decide why and how it is processed. SunSolarOne is your Data Processor and processes it only on your behalf. For data about your own account and users, we act as a Data Fiduciary under our Privacy Policy.
2. Data and purposes
- People: your leads, customers, their family members or company contacts, and people who open your proposal links or customer portal.
- Data: names, phone numbers, emails, addresses and site locations; electricity bill images and details (consumer number, DISCOM, tariff, consumption); site photos with location and time; designs, proposals, e-signature records, invoices, payment records, loan enquiries, project, subsidy and service records; and messages you send them through the service.
- Purpose: providing the SunSolarOne features you use — storing records, sizing and designing systems, generating and sharing proposals and invoices, sending messages you trigger, tracking projects and service — and keeping the service secure.
- Duration: for the term of your subscription and the deletion period in section 11.
3. Your instructions
We process Customer Personal Data only on your documented instructions, which are these terms, your configuration of the service and the actions your users take in it. We will not use it for our own purposes, sell it, use it for advertising or use it to train AI models. If we believe an instruction breaks the law, we will tell you. If the law requires us to process data in another way, we will tell you first unless the law forbids it.
4. Your responsibilities
- Give your customers a clear notice of how you use their data and, where the DPDP Act requires it, obtain their consent — including consent to receive WhatsApp, SMS or email messages.
- Collect only the data you need, keep it accurate, and delete it when you no longer need it.
- Respond to your customers' requests to access, correct or erase their data, and to their grievances.
- Control which of your users can see which data, and remove users who leave.
- Do not store sensitive data the service is not designed for, such as Aadhaar numbers, card numbers or health information, except where a feature specifically asks for it.
5. Confidentiality
Only SunSolarOne personnel who need access to support or operate the service can access Customer Personal Data, and they are bound by confidentiality obligations. Support access to your workspace happens only to resolve an issue you raised or to keep the service secure.
6. Security
We maintain reasonable security safeguards appropriate to the risk, as required by section 8(5) of the DPDP Act, including encryption in transit and at rest, row-level security isolating each company's data, private file storage with short-lived links, access controls and logging, rate limiting, backups and point-in-time recovery. Details are on our Security page.
7. Sub-processors
You authorise us to use the sub-processors listed in our Privacy Policy (Supabase, Vercel, OpenAI and Anthropic, Razorpay, Meta WhatsApp Business Platform, Twilio, MSG91, our email provider, Cloudflare, and Esri / OpenStreetMap / Google / Apple map services). We impose data protection obligations on each that are no less protective than these terms, and we remain responsible for their performance. We will give at least 15 days' notice of a new sub-processor by updating that list and emailing account owners; if you object on reasonable data-protection grounds and we cannot address the concern, you may cancel and receive a pro-rata refund of prepaid fees.
8. Data principal requests
If one of your customers contacts us directly about their data, we will pass the request to you promptly and will not respond ourselves except to tell them we have done so. The service lets you find, export, correct and delete customer records; where you need more help to meet a request, we will provide reasonable assistance.
9. Breach notification
If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and in any case within 48 hours, with what we know about the nature of the breach, the data and people affected, its likely consequences and the steps we are taking. We will update you as we learn more and help you meet your obligations to inform affected people and the Data Protection Board of India (including the detailed report the DPDP Rules, 2025 require within 72 hours). We will also report incidents to CERT-In where required.
10. Location and transfers
Customer Personal Data is stored in India (AWS Mumbai, ap-south-1). Limited processing happens outside India only where a feature needs it, such as AI reading of an uploaded electricity bill or message delivery, and only to countries not restricted by the Government of India under section 16 of the DPDP Act.
11. Return and deletion
You can export your data at any time. When your subscription ends, we keep the workspace read-only for 30 days so you can export it, then delete Customer Personal Data from live systems, with backup copies erased within a further 30 days, unless the law requires us to keep it.
12. Information and audits
On request, we will provide the information reasonably needed to show that we meet these terms, such as a description of our security measures and our sub-processors' certifications (for example, the SOC 2 reports of our hosting providers). Where that is not enough, an audit can be agreed in writing, at your cost, with reasonable notice, no more than once a year and without access to other customers' data.
13. General
The limitation of liability in the Terms of Service applies to these terms. If these terms conflict with the Terms of Service on data protection, these terms prevail. If you need a signed copy of these terms for your records, email support@sunsolarone.com.