Data Processing Addendum

When this applies

This addendum forms part of the Terms of Service between you (the customer) and Akshar Software LLP and applies whenever we process personal data on your behalf. It applies automatically - there is nothing to sign. If your process needs a countersigned copy, ask at support@rezee.app and we will send one.

Where the GDPR or UK GDPR applies you are the controller and we are the processor. Under India's Digital Personal Data Protection Act, 2023 you are the Data Fiduciary and we are a Data Processor. For your own account and billing data we are the controller ourselves, and the Privacy Policy covers that.

What we will and will not do with it

We process personal data only to provide the service, only on your documented instructions, and for no purpose of our own. Configuring Rezee, using its features and this addendum together are those instructions. We do not sell personal data and we do not train models on your content. If we ever think an instruction breaks data protection law we will tell you rather than quietly comply.

Everyone at Rezee with access is bound to confidentiality, and access is limited to the people who need it to run and support the service. Every administrative action inside a workspace is written to an audit log the database will not let anyone rewrite, so break-glass access is visible to you rather than only to us.

Security

The technical and organisational measures are set out in specifics on the security page, which is part of this addendum by reference: encryption in transit and at rest, envelope encryption for pipeline secrets with per-repository data keys, per-runner credentials, isolated single-use build containers, permission checks by verb on every request, and an append-only audit log. We may change a measure, but not to something materially weaker.

Rezee holds no SOC 2 report and no ISO 27001 certificate today. We would rather say that here than let you find out during a review.

Subprocessors

You authorise the companies listed on /subprocessors, each of which is bound by terms no weaker than these and is only given what its row says it can reach. We will publish a change there and email account owners at least 30 days before a new subprocessor starts processing. If you reasonably object on data protection grounds, tell us within that window and we will either find another route or let you terminate the affected part of the service and refund the unused prepaid remainder.

Helping you answer your own users

Most requests you can satisfy yourself: the product lets you search, edit, export and delete what a workspace holds, and a workspace export is one button in settings. Where you cannot, we will help you meet a data subject request within the time the law gives you. If such a request comes to us directly about your workspace, we will not answer it - we will point the person at you.

Personal data breach

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a breach affecting your data, at the email addresses of your workspace owners. The notice will say what happened, what categories of data and roughly how many people are affected, what we have done, and what we suggest you do. We will not wait until we know everything before telling you the first thing.

Deletion and return

You can delete content and export a workspace at any time in the product. On termination we delete what remains; copies persist in rolling backups for up to 30 days, and are then gone. We keep nothing after that except where law requires it, and that exception covers billing records rather than workspace content.

Audits and questionnaires

To demonstrate compliance we will give you this addendum, the security page, the subprocessor list, and a completed security questionnaire on request. We are a small team and cannot host an on-site audit; if your regulator requires one, tell us before you buy so nobody discovers the mismatch later.

International transfers

Processing happens in the United States, as the subprocessor list sets out. Where you transfer EEA personal data to us, the EU Standard Contractual Clauses (Commission Decision 2021/914) apply, Module Two, with this addendum supplying their annexes: Annex I below, Annex II being the security page, Annex III being the subprocessor list. Where UK data is transferred, the UK International Data Transfer Addendum applies to those clauses. Where Swiss data is transferred, references to EU law read as references to the Swiss FADP. Governing law and forum follow the Terms, except where the clauses require otherwise.

Annex I: details of the processing

• Subject matter. Providing the Rezee workspace: issue tracking, projects, documents and design canvases, chat, git hosting and code review, CI/CD, search, notifications, and agent work you ask for.
• Duration. For as long as your subscription lasts, plus the deletion windows above.
• Nature and purpose. Storage, transmission, indexing, rendering, backup, and submission to a language model provider when an agent runs.
• Categories of data subject. Your team members, agent accounts they create, guests you invite into a single channel, and any person named in the content your team writes.
• Categories of personal data. Identity and contact details (name, email address, avatar), authentication data (credentials as hashes, identity provider assertions, tokens, SSH keys), technical data (IP address, user agent, device push token), activity records (audit log, notifications), and whatever personal data your team chooses to put into issues, documents, messages, code or commit history.
• Special category data. None is requested by the product, and Rezee is not designed to hold it. If your team puts it in a document anyway, it is processed like any other content and you remain responsible for that decision.
• Frequency. Continuous, for as long as your team uses the service.

Liability, and the rest

Each party's liability under this addendum is subject to the limits in the Terms. This addendum takes precedence over the Terms where they conflict on the processing of personal data, and is governed by the law of India. Questions: support@rezee.app.