Outside companies we use

1.1 This page lists the outside companies that receive or handle personal information so that XoraPro can work. It is published by M/s N.P. Xora Private Limited (Company Registration No. 387740/82/83, PAN 623570591, Ward No. 3, Samakhusi, Kathmandu Metropolitan City, Nepal), called "N.P. Xora", "we" or "us".

1.2 It is part of the XoraPro Privacy Policy (xorapro.com/legal/privacy, section 7) and the list referred to in section 6 of the XoraPro Data processing terms. Where those documents refer to "the outside companies we use", they mean the companies on this page as it stands on the day. Data processing terms

1.3 It is written for everyone whose information is in XoraPro: business owners and their staff, and the customers, guests, suppliers, students and others whose details a business keeps in XoraPro.

• Outside company means a company that is not N.P. Xora and that receives, stores or passes on personal information because XoraPro uses its service. The law and contracts elsewhere sometimes call this a "sub-processor".
• Personal information has the meaning given in section 2 of the Individual Privacy Act 2075.
• Business data means personal information a business puts into XoraPro or collects through it, as defined in the Data processing terms.
• In use means XoraPro sends information to the company today, whenever the feature it serves is used.
• Not in use means XoraPro contains a way to connect to the company, but it is switched off and nothing is sent.
• Where means the country where the company does the work for XoraPro, or where the company is based when it does not say where its servers are.

7.1 Your books and records are stored in Nepal, on Ncell's servers in Pokhara. Invoices, sales registers and their logs stay on that server in Nepal, as the Inland Revenue Department's Electronic Billing Procedure 2082 requires, and the Department may inspect them as the law allows. A standby copy of the database is kept read-only on Amazon Web Services in Singapore. XoraPro runs from it only while the Nepal server is unavailable, and we move the service back to Nepal once that server is back.

7.2 Some outside companies work from outside Nepal and receive only what their job needs: Amazon Web Services (the standby copy of the database), Cloudflare (encrypted backups it cannot read), Resend (emails), Anthropic (the AI features), Apple, Google and browser push services (notifications), Google ML Kit (the phone app's scanner), Google Workspace (email you send us), the call connection servers, Have I Been Pwned (the password check) and Sync.com (files you send us directly).

7.3 The duties in the Privacy Policy and the Data processing terms apply to your information wherever it is kept.

8.1 Only what the job needs. We choose each outside company for a specific job and send it only the information that job needs. We do not sell personal information to any of them.

8.2 On their terms, our responsibility. Each outside company works for XoraPro under its own published terms or a signed agreement. Towards a business, we remain responsible under the Data processing terms for the work we ask each outside company to do.

8.3 30 days' notice before a change. Before we add an outside company that XoraPro itself engages, switch on a service from section 5, or change what such a company receives or the country where it does the work, we tell the owners of every affected business at least 30 days ahead, by email and inside the app. On the same day we update this page and add an entry to the change log below, showing the date the change will take effect. A payment provider that a business chooses to connect with its own account, such as Fonepay, eSewa or Khalti, is that business's own provider. It is listed here for transparency, and it receives data only once the business connects it.

8.4 If you object. A business that objects to a change may tell us within those 30 days at support@xorapro.com. We will discuss whether the change can be avoided for that business. If it cannot, the business may close its account before the change takes effect and export its records first, as section 6.4 of the Data processing terms sets out. Data processing terms

8.5 Urgent changes. If we must replace an outside company urgently to keep XoraPro running or secure, for example because it stops its service or suffers a breach, we may make the change first and tell account holders within 7 days, with the reason. Section 8.4 then applies from the day we tell them.

8.6 Removing a company, or sending it less. When we stop using an outside company, or reduce what it receives, no advance notice is needed. We record it in the change log.

8.7 Everyone else. Staff, customers, guests and others whose information a business keeps in XoraPro can read this page at any time. The business that holds their information is their first point of contact, as the Privacy Policy, section 13, explains. Anyone may also ask support@xorapro.com to be emailed when this page changes.

10.1 This page is governed by the law of Nepal, in particular the Individual Privacy Act 2075, the Individual Privacy Regulation 2077 and the Electronic Transactions Act 2063, and the Electronic Billing Procedure 2082 for billing records.

10.2 The Nepali and English texts are published side by side.

10.3 Any dispute about this page is decided in the same way as a dispute under the Terms of Service.