The terms on which Nandi handles your customers’ personal data on your instructions. It forms part of your agreement with Nandi and you do not have to ask anyone for a copy.
Draft reference date: 15 October 2026 (rehearsal-aligned draft). No effective date has been set.
Provisional legal content — for design review only. Not approved for publication or customer acceptance.
This covers the ground a processor agreement has to cover, in the language it should be explained in, so a business or its lawyer can see what Nandi is committing to. It is not legal advice and it is not the executed agreement. Items marked To be completed before launch are at the end of the page.
Plainly, so it can be checked rather than interpreted:
Nandi is not built to hold special category data such as health records, and it is not designed as a clinical or medical records system. A practice can note what it needs to serve a patient administratively; if you intend to put sensitive categories into Nandi, that needs its own conversation rather than an assumption.
Nandi processes your customers’ data only to provide the service and only as you have instructed. Your instructions are the configuration you give Nandi: your services, your availability, your rules about notice periods, deposits, what to escalate and what Nandi must never promise. Using the product is how you instruct it.
Nandi does not use your customers’ data for its own purposes. Specifically, it does not market to your customers, does not sell or share their data, does not build a Nandi mailing list from it, and does not use their conversations to train general-purpose AI models. Anything outside providing the service would need a separate lawful basis and its own notice, and none is claimed here.
Two exceptions worth stating rather than hiding. Nandi may process the data where the law requires it to, in which case it will tell you unless it is prohibited from doing so. And Nandi may use aggregated, statistical information that does not identify anyone to operate and improve the service. If Nandi believes an instruction from you would break the law, it will tell you rather than quietly comply.
Everyone at Nandi who can reach your customers’ data is under a duty of confidence, is told what they may and may not do with it, and only has access where their job actually requires it. Access is limited by role and reviewed, not granted by default because someone works here.
Nandi maintains technical and organisational measures appropriate to the risk, including encryption of data in transit, access control and authentication, separation between one business’s data and another’s, logging of access to systems holding personal data, and backups with a defined lifecycle.
Nobody can promise absolute security, so Nandi does not, and it claims no certification it has not obtained. Measures may change as the service develops, but not in a way that materially weakens protection.
The measures above need to become a specific schedule that reflects what is actually built, including encryption at rest, retention periods and the backup cycle length. A processor agreement is usually reviewed against that schedule rather than against this prose.
Nandi uses other companies to run the service: hosting, messaging, AI infrastructure, payment providers, sign-in and monitoring. You are agreeing to that, on these conditions: each one is engaged under written terms no weaker than these, Nandi remains responsible to you for what they do with your data, and there is a current list of who they are and what each is used for.
Before adding or replacing one, Nandi will tell you in advance, so that you have a real chance to object rather than discovering it afterwards. If you reasonably object on data protection grounds, we will try to resolve it, and if it cannot be resolved you can end the affected part of the service without penalty.
The subprocessor list itself, at a stable public address, and the notice period before a change takes effect. Deliberately not drafted here: naming a company Nandi has not contracted with would be a false disclosure, and the categories above are as far as design can honestly go.
Nandi and its subprocessors operate in more than one country, so data may be processed outside the country your business is in. Where the law requires safeguards for that, Nandi puts the appropriate mechanism in place and will tell you which one applies.
Being configured for a particular market is not by itself a promise that data stays in that country, and this agreement does not imply one.
A request from one of your customers to see, correct, delete or object to the use of their data is yours to answer, because you are the one who decided to hold it. To see what Nandi holds about a customer, ask Nandi for a copy of that customer’s records alone, or download your own export of everything at any time.
For anything else, an owner of your business asks Nandi from their sign-in address. Nandi confirms the request with that address, acts only within your business’s records, and tells you what it changed and anything it has to keep, and why.
If a request reaches Nandi instead, Nandi will not answer it on your behalf and will not act on it unilaterally. It passes it to you promptly and helps you deal with it.
Built, for Nandi’s operators only: a copy, a correction or the erasure of one customer’s records, on an owner’s instruction, each recorded without the customer’s data. Erasure keeps nothing of the customer, because no requirement to keep any of it has been documented, and it waits while an appointment is ahead or a payment, conversation or message is still open. Not built: restricting or objecting for one customer. Still to be decided, with legal review: the time within which Nandi helps, and whether any record, such as a deposit, must be kept for a stated reason.
If there is a breach affecting your customers’ personal data, Nandi will tell you without undue delay once it is aware, and give you what you need to meet your own reporting obligations: what happened, which categories of data and roughly how many people are affected, the likely consequences, and what is being done about it. Nandi will keep you updated as more is known rather than waiting until the picture is complete.
Reporting to a regulator or to the individuals affected is your decision as controller, and Nandi will not make it for you or notify your customers behind you.
A specific notification timeframe, agreed against what the response process can actually deliver, and the internal breach process behind it. “Without undue delay” is the legal phrase; businesses and their lawyers will ask for hours.
Where you need to assess the privacy impact of using Nandi, or to consult a regulator about it, Nandi will give you the information it reasonably can about how the service works, what data it holds and how it is protected. Much of it is already public in this document and the privacy policy, which is deliberate: a small business should not have to run a procurement process to find it out.
On reasonable request, Nandi will provide the information needed to show it is meeting these obligations, and will allow an audit where the law entitles you to one, subject to reasonable notice, confidentiality, and not compromising the security or data of other businesses using Nandi.
Until your data is deleted you can download a copy of it yourself, at any time, including after your service has ended. When the service ends Nandi keeps your data for at least 90 days, so that you can come back to it; after that it may be deleted, except where the law requires it to be kept. Nandi tells you before it does. Deletion waits while something still depends on the data: a booking still to come, a payment still being resolved, or a WhatsApp number or Stripe account still connected through Nandi.
Nandi’s deletion covers what Nandi holds. It does not reach copies held by the companies Nandi uses to run the service, such as messages kept by the messaging provider, which those companies hold under their own terms, or the events Nandi added to your own calendar, which are yours. Backups are removed as they cycle rather than instantly, which is a real limitation and is stated here rather than glossed over. Where anything must be retained, it stays protected by this agreement for as long as it exists.
Built and switched off: deletion after the 90 days, with the warning before it. It stays off in every market until this agreement states the period, the backup cycle is known and a lawyer has confirmed it, so today nothing is deleted at the end. Built: the export, available until deletion. Not yet possible: deleting a business with a WhatsApp number (releasing the number is not built). A connected Stripe account is removed from Nandi’s platform first, which a sandbox test showed ends Nandi’s access; that the account keeps working afterwards rests on Stripe’s documentation. Also needed: the backup cycle length, and what happens to data held by the companies Nandi uses.
As controller you decide what goes into Nandi, so you need a lawful basis for the customer data you ask it to handle, and your customers need to be told what they are entitled to be told, including that a service like Nandi is involved where the law requires it. Your instructions to Nandi, meaning your configuration and your rules, need to be lawful. And you should only put in what you actually need, because the less that is held, the less there is to go wrong.
If it helps: most of what a business needs to tell its customers about Nandi’s role is already written in the privacy policy, and you are welcome to point at it.
The rest of the legal package is listed on the terms and the privacy policy.