shabashTeam Recognition App

Data Processing Addendum

Last updated: 19 August 2026

Draft pending Indian counsel review. The grievance officer name has not been appointed yet — contact support@digitium.tech until then.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between DIGITIUM TECHNOLOGIES LLP ("Digitium", "Processor") and the Customer Group ("Customer", "Fiduciary") for processing of Customer Personal Data under the Digital Personal Data Protection Act, 2023 (including section 8(2) regarding processing under a valid contract). Capitalised terms not defined here have the meaning in the Terms or the Privacy Policy.

1. Roles and scope

For Customer Personal Data — Member profiles, Slack identifiers, recognition (Shabash) content, dates of birth and joining, redemptions, and related Team settings — the Customer is the Data Fiduciary and Digitium is the Data Processor.

Digitium remains Data Fiduciary (and this DPA does not apply) for User login and sessions, Group billing profiles and Razorpay Subscription data, website visitors, cookie consent records, and Digitium's own product analytics.

2. Instructions

Digitium will process Customer Personal Data only on documented instructions from the Customer. The Customer's instructions are to provide the Service as configured by the Customer (including Slack sync, recognition, redemptions, Statements, and related jobs). Additional written instructions may be agreed by email to support@digitium.tech. Digitium will inform the Customer if an instruction appears to infringe applicable data protection law, unless legally prohibited from doing so.

3. Security

Digitium will implement commercially reasonable technical and organisational safeguards appropriate to the nature of Customer Personal Data, including access controls, encryption in transit for the public Service, soft-deletion practices, and separation of main and tenant databases. Absolute security cannot be guaranteed.

4. Sub-processors

The Customer authorises Digitium to engage the sub-processors listed below. Digitium will post updates to this page when the list changes.

  • Cloudflare

    Purpose
    Hosts the Service (Workers), stores consent, founding-claim records, and Hubble cache (KV), bot protection (Turnstile), PDF storage (R2), PDF rendering (Browser Rendering), and transactional email (Email Sending)
    Data
    Request data, session cookies, consent records, Hubble brand cache and API tokens, billing PDFs, form submissions protected by Turnstile, recipient email and message content (magic links, billing, Statements, gift-card details)
    Region
    Global edge; US and EU data centers depending on request path

  • Turso / libSQL

    Purpose
    Main database (Users, Groups, billing) and per-Group tenant databases
    Data
    User accounts, Group and billing profile data, Member profiles, recognition, redemptions, Credit ledgers
    Region
    Configured Turso region (typically US or EU)

  • Slack

    Purpose
    Workspace integration for Member sync, recognition posts, and occasion messages
    Data
    Slack user ids, names, emails, profile start dates, channel membership, messages we post
    Region
    United States / Slack global infrastructure

  • Google

    Purpose
    OAuth sign-in for Users and Super Admins
    Data
    Name, email, and profile picture provided by Google during sign-in
    Region
    United States / Google global infrastructure

  • Razorpay

    Purpose
    Subscription billing and payment processing
    Data
    Billing profile (name, email, address, GSTIN), Subscription status, payment events — card numbers stay with Razorpay
    Region
    India

  • Hubble

    Purpose
    Gift card catalogue and order fulfillment
    Data
    Order amounts, brand ids, voucher codes returned to us; API customerDetails currently use dummy values
    Region
    India

  • PostHog

    Purpose
    Product analytics (only after cookie consent)
    Data
    Pageviews, usage events, device and browser metadata
    Region
    United States (us.i.posthog.com)

  • OpenRouter

    Purpose
    Optional AI polish of recognition notes and Member bios when a Member clicks generate
    Data
    Prompt text the Member submits for generation
    Region
    United States / OpenRouter model providers

  • Upstash QStash

    Purpose
    Scheduled jobs (Slack sync, birthdays, anniversaries, Statements, Credit reminders, season reset, Hubble brand sync, subscription sync)
    Data
    Job payloads referencing Group and Member identifiers
    Region
    Configured Upstash region

  • Giphy

    Purpose
    Optional GIF search for recognition messages
    Data
    Search queries; selected GIF URLs stored with the Shabash
    Region
    United States

  • Gravatar

    Purpose
    Avatar fallback in the browser when a Member has no uploaded avatar
    Data
    Email hash requested by the browser
    Region
    United States

5. Breach notification

Digitium will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its own notification obligations.

6. Data Principal rights

Digitium will provide reasonable assistance so the Customer can respond to Data Principal requests (access, correction, erasure, and other rights under the DPDP Act) that relate to Customer Personal Data in the Service. Digitium will not respond directly to a Data Principal as Fiduciary for Customer Personal Data except to redirect them to the Customer, unless required by law.

7. Return and deletion

On termination of the Service or written request, Digitium will delete or return Customer Personal Data in its systems, subject to soft-delete practices, backups that expire in the ordinary course, and retention required by law (including billing and tax records that are not Customer Personal Data under this DPA). Export on request is described in the Terms.

8. Cross-border processing and change of law

Customer Personal Data may be processed by sub-processors in the regions listed above. The parties will cooperate in good faith if Indian law or Board directions require changes to this DPA.

9. Fees

Standard assistance under this DPA is included in the Subscription. There are no extra fees for that assistance.

10. Contact

Privacy and DPA notices: support@digitium.tech.

DIGITIUM TECHNOLOGIES LLP · LLPIN ACQ-1131 · No.74, 3rd Floor, Mass Complex, Sarakki Industrial Layout, JP Nagar 3rd Phase, Bengaluru, Karnataka 560078, India · support@digitium.tech