Data processing addendum

1. Roles

You are the controller of the personal data in your requests, or a processor acting for your own customer. We are your processor, or your subprocessor. Terms not defined here have their GDPR meaning.

2. Details of the processing

3. Our obligations

We will:

• (a) process the personal data only on your documented instructions, which are your API requests and this addendum, unless the law requires otherwise, in which case we will tell you first unless the law forbids it; and tell you if we believe an instruction breaks data protection law;
• (b) make sure that everyone we authorise to process the data is bound by confidentiality;
• (c) take the security measures required by GDPR Article 32, including those in section 4;
• (d) engage subprocessors only as set out in section 5;
• (e) help you, as far as possible and taking into account the nature of the processing, to answer requests from data subjects exercising their rights;
• (f) help you meet your obligations under GDPR Articles 32 to 36, including by telling you of a personal data breach affecting your data without undue delay after we become aware of it;
• (g) when the agreement ends, delete the personal data: prompts are never stored, and cached readings expire within 24 hours, so there is nothing to return;
• (h) make available the information needed to show that we meet these obligations, and allow for and contribute to audits, including inspections, by you or an auditor you appoint.

[To be confirmed by counsel: breach notification deadline in hours, audit frequency, notice and cost terms, and whether written reports may satisfy audit requests]

4. Security measures

• Prompts and tags are processed in memory and never written to our database, request logs or error reports.
• Request logs record the method, path, status and timing of each request, and for /v1/plan which decision model answered, whether a fallback was used and why, and whether the reading came from the cache; never the prompt, tags or key.
• Error reports exclude request bodies, query strings, cookies, secret headers and user details.
• Cached readings hold only vocabulary values, keyed by an HMAC with a server secret that includes the caller's scope, so a prompt can't be confirmed by guessing it or by another caller's cache hit.
• API key secrets are stored only as hashes and shown once, when created.
• Requests over the API's size limit are refused, and only a bounded part of each prompt reaches the decision model.
• Administrative access requires an admin role, and sensitive account actions require a recent sign-in.
• Traffic to the service is encrypted in transit with TLS.

[To be confirmed by counsel: the full technical and organisational measures annex, including personnel, access review and incident response]

5. Subprocessors

You give general authorisation for us to engage the subprocessors listed on the subprocessors page. Of them, Google Cloud (hosting) and OpenAI (the decision model) process the content of your requests. We will impose on each subprocessor data protection obligations no less protective than this addendum, and remain responsible to you for their performance.

We will email account owners before we add or replace a subprocessor, giving you the chance to object. If you object on reasonable data protection grounds and we can't address the objection, you may stop using the affected part of the service and end the agreement. [To be confirmed by counsel: notice period before a new subprocessor starts, and any refund on termination]

6. International transfers

We process data in the United States. Where a transfer of personal data from the EU or EEA is not covered by an adequacy decision, the standard contractual clauses (Commission Implementing Decision (EU) 2021/914, module two or module three as applicable) are incorporated into this addendum, and we rely on the same clauses or the EU-US Data Privacy Framework for transfers to our subprocessors. [To be confirmed by counsel: whether Nanner Tech self-certifies under the EU-US Data Privacy Framework; the clause options, governing law and supervisory authority for the SCCs; the UK International Data Transfer Addendum; and the Swiss amendments]

7. Liability and precedence

Each party's liability under this addendum is subject to the limitation of liability in the terms of service, as far as the law allows. If this addendum and the terms of service conflict on data protection, this addendum wins; if the standard contractual clauses conflict with either, the clauses win.

8. Contact

Data protection questions and notices go to support@rhumbdata.com. [To be confirmed by counsel: postal address, and the EU and UK representatives under Article 27 if required]

[To be confirmed by counsel: how a customer signs or accepts this addendum (by accepting the terms, or a countersigned copy on request)]