Legal
Data Processing Addendum
How LifeWyn processes personal data on your behalf — the roles, the safeguards, and the limits the zero-knowledge model puts on what we can process at all.
Last updated: August 28, 2026
Template notice. This Addendum is a good-faith template describing how a zero-knowledge platform like LifeWyn handles processing of personal data. It is not legal advice and is not an executed agreement. Have qualified counsel review and adapt it for your jurisdiction before relying on it.
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the agreement between you (the "Controller") and LifeWyn ("LifeWyn", the "Processor") for the provision of the Service. It applies where LifeWyn processes personal data on your behalf. Where the law of the European Union / EEA (GDPR) or India's Digital Personal Data Protection Act (DPDP) applies, this DPA is read consistently with it.
2. What we can process at all
LifeWyn is zero-knowledge. Vault content and the keys that decrypt it are encrypted on your devices and never reach us in plaintext. As a result, our processing is limited to ciphertext, account and routing metadata, and notifications. We cannot read, disclose, or hand over the contents of a vault, because we do not hold the keys — this is a technical limit, not only a policy one. Account and nominee contact details (names, emails, phone numbers) are processed as ordinary personal data and are described in the Privacy Policy.
3. Processing instructions
We process personal data only on your documented instructions, including the instructions embodied in the Service's design and your configuration, unless required otherwise by law — in which case we tell you first, where legally permitted.
4. Confidentiality
Personnel authorised to process personal data are bound by confidentiality obligations.
5. Security
We implement appropriate technical and organisational measures, including client-side encryption of vault content, encryption in transit, access controls, and audit logging. What we deliberately cannot do — read vault content — is the strongest of these measures. The Security page describes the model in detail.
6. Sub-processors
You authorise us to engage the sub-processors listed on our sub-processor page. We will update that page before adding a new sub-processor that handles account or notification data, and you may object on reasonable data-protection grounds.
7. Data-subject rights and assistance
Taking into account the nature of the processing, we assist you in responding to requests to exercise data-subject rights, and in meeting your security, breach-notification, and impact-assessment obligations. Data-subject access and erasure are supported by the Service's own export and erasure flows.
8. International transfers
Where personal data is transferred across borders, the transfer relies on an appropriate safeguard (such as Standard Contractual Clauses) or another lawful basis. Deployment region is described on the sub-processor page.
9. Deletion and return
On termination, we delete or return personal data as instructed, subject to retention required by law. Because vault content is ciphertext we cannot read, its deletion removes the only copies we hold.
10. Audits
We make available the information necessary to demonstrate compliance with this DPA and contribute to audits as required by applicable law.
11. Liability and precedence
This DPA is subject to the Terms of Service. Where this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.