How ArgDay processes data on your behalf.
Data Processing Agreement
Last updated: 17 April 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and Cog9 Technologies operating as ArgDay ("Processor"). It governs the processing of personal data by ArgDay on your behalf in connection with the ArgDay Service.
1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person as defined under the Digital Personal Data Protection Act, 2023 (DPDPA).
- "Processing" means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.
- "Controller" means the user or organisation that determines the purposes and means of processing personal data (i.e., you).
- "Processor" means ArgDay / Cog9 Technologies, which processes personal data on your behalf.
- "Sub-processor" means any third party engaged by ArgDay to process personal data.
- "Data Subject" means the individual to whom personal data relates.
2. Roles and Responsibilities
2.1 Controller Responsibilities
As Controller, you are responsible for:
- Ensuring you have a lawful basis for processing personal data you upload to ArgDay
- Providing appropriate privacy notices to your clients and data subjects
- Obtaining any required consents before uploading client data
- Ensuring the accuracy of personal data you provide
- Responding to data subject requests from your clients
- Compliance with all applicable data protection laws in your jurisdiction
2.2 Processor Responsibilities
As Processor, ArgDay will:
- Process personal data only on your documented instructions
- Ensure persons authorised to process data are bound by confidentiality
- Implement appropriate technical and organisational security measures
- Assist you in responding to data subject requests where technically feasible
- Notify you within 72 hours of becoming aware of a personal data breach
- Delete or return all personal data upon termination of the Service
- Provide all information necessary to demonstrate compliance with this DPA
3. Details of Processing
3.1 Subject Matter
Processing of personal data contained in legal case files, client information, court documents, and related professional data uploaded to and managed within the ArgDay platform.
3.2 Duration
For the duration of your subscription plus any retention period specified in our Privacy Policy or as required by applicable law.
3.3 Nature and Purpose
- Storage and retrieval of case and document data
- AI-powered processing for document summarisation (only when explicitly triggered by you)
- Display of data within the platform to authorised workspace members
- Backup and disaster recovery
- Technical support where you have reported an issue involving specific data
3.4 Types of Personal Data
- Names and contact details of parties, clients, and witnesses
- Case reference numbers and court identifiers
- Dates of birth, addresses, and identification numbers contained in uploaded documents
- Any other personal data contained in documents you choose to upload
4. Security Measures
ArgDay implements the following technical and organisational measures:
4.1 Technical Measures
- AES-256 encryption for data at rest
- TLS 1.2+ for data in transit
- Database Row-Level Security ensuring strict workspace isolation
- Private object storage with signed time-limited access URLs
- No public file storage buckets
- Regular automated security scanning and dependency audits
- Secure development practices and code review
4.2 Organisational Measures
- Access to production data limited to essential personnel only
- Confidentiality obligations for all employees and contractors
- Security incident response procedures
- Regular security awareness training
- Vendor security assessments for all sub-processors
5. Sub-processors
ArgDay uses the following sub-processors. By accepting this DPA, you provide general authorisation for their use.
| Sub-processor | Processing Activity | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | USA (AWS infrastructure) |
| OpenAI LLC | AI document processing (per-request only) | USA |
| Resend Inc. | Transactional email delivery | USA |
We will notify you of any intended changes to sub-processors with at least 14 days' notice. You may object to new sub-processors in writing within 14 days.
6. Data Subject Rights
Where a data subject (such as your client) makes a request to ArgDay directly, we will forward it to you within 5 business days. You are responsible for responding to such requests. Where technically feasible, we will assist you in complying with data subject requests relating to access, correction, or deletion.
7. Data Breach Notification
ArgDay will notify you without undue delay (and within 72 hours) upon becoming aware of a personal data breach affecting your data. The notification will include:
- Description of the nature of the breach
- Categories and approximate number of data subjects affected
- Likely consequences of the breach
- Measures taken or proposed to address the breach
You are responsible for notifying the relevant regulatory authority and affected data subjects as required by applicable law.
8. Data Deletion and Return
Upon termination of the Service or your written request, ArgDay will:
- Provide a data export within 14 days of request
- Delete all your personal data from primary systems within 30 days of termination
- Delete backup copies within 60 days
- Provide written confirmation of deletion upon request
We may retain data where required by applicable Indian law (e.g., billing records for GST compliance).
9. Governing Law
This DPA is governed by the laws of India. Any disputes shall be resolved in accordance with the dispute resolution provisions in the Terms of Service.
10. Contact
Data Protection Queries - ArgDay / Cog9 Technologies
Email: privacy@argday.com