Scope and roles
This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“Customer”, the controller) and TruenoTech (the processor) for the TruPDF SDK and licensing services, and applies where TruenoTech processes personal data on the Customer’s behalf.
The TruPDF SDK is architected so that TruenoTech processes as little personal data as possible: documents, annotations, form values, and AI prompts are handled inside the Customer’s application and infrastructure and are never transmitted to TruenoTech. TruenoTech’s processing is limited to the categories in Section 2.
Data processed
- Licensing contact data — names, email addresses, company names, and enquiry details submitted by the Customer’s representatives when requesting or renewing licenses.
- License telemetry — heartbeat requests carrying the license identity, origin domain, and timestamps, used solely for liveness and revocation. No document content, no end-user identifiers, no usage metering. Enterprise offline tokens emit no telemetry at all.
- Support correspondence — the content of emails the Customer’s team sends to us.
End users of the Customer’s application are not tracked or profiled by TruenoTech. The Customer remains the controller (and, where applicable, TruenoTech is not a processor at all) for all data handled inside the SDK runtime, including documents processed with the AI features via the Customer’s own model provider.
Processing instructions
TruenoTech processes the data above only to operate the license relationship — issuing, validating, renewing, and revoking licenses, responding to support requests, and meeting legal obligations — and only on the Customer’s documented instructions, unless required otherwise by law (in which case we inform the Customer unless legally prohibited).
Confidentiality and personnel
Access to personal data is limited to TruenoTech personnel who need it to provide the service, all of whom are bound by confidentiality obligations.
Security measures
- Transport encryption (TLS) for all licensing and lead endpoints.
- Ed25519-signed license tokens; no shared secrets in customer builds.
- Hashed IP addresses and rate limiting on public endpoints; no raw IP retention in lead records.
- Role-restricted operator access with audited admin actions.
- Append-only audit logging of license issuance, revocation, and status changes.
Sub-processors
TruenoTech uses infrastructure providers to host the licensing service and this website. A current list of sub-processors is available on request at [email protected]. We will give the Customer prior notice of any intended change and remain fully liable for our sub-processors’ performance.
Data subject rights
Taking into account the nature of the processing, TruenoTech will assist the Customer with reasonable measures to fulfil data subject requests (access, rectification, erasure, restriction, portability, objection) concerning the data categories in Section 2.
Breach notification
TruenoTech will notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed under this DPA, and will provide the information reasonably required for the Customer’s own notification obligations.
International transfers
TruenoTech is established in India. Where data originating from jurisdictions with transfer restrictions (for example the EEA or UK) is processed, the parties rely on appropriate safeguards such as standard contractual clauses, executed on request.
Deletion and return
On termination of the agreement, and at the Customer’s choice, TruenoTech deletes or returns the personal data processed under this DPA, unless retention is required by law. Licensing audit records are retained only as long as legally necessary.
Audits
TruenoTech will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by the Customer or an agreed independent auditor, at reasonable intervals and on reasonable notice.
Contact
TruenoTech — B-703, Titanium Square, Thaltej, Ahmedabad, Gujarat 380054, India. To execute this DPA or request a countersigned copy: [email protected].