This Data Processing Addendum ("DPA") forms part of the Terms of Service between Renaissance Geek, Inc. ("Processor", "we") and the Customer ("Controller", "you"). It applies whenever personal data protected by the EU or UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or a similar law ("Data Protection Law") is contained in Customer Content that we process on your behalf. It takes effect when the Terms are accepted; no separate signature or request is needed. Where this DPA and the Terms conflict about personal data, this DPA controls.
Plain-language summary: You decide what goes into your repositories and previews; we only process it to review pull requests. We act on your instructions, keep it confidential, use the subprocessors listed below, help you with data-subject requests, tell you about breaches, and when you uninstall we delete your stored review files and keep review records only until you ask us to delete them.
1. Roles and scope
1.1 You are the controller of personal data in Customer Content. We are your processor. Each party complies with Data Protection Law as it applies to that role.
1.2 This DPA does not cover data we process as a controller in our own right, such as sign-in and account data of the people who use the Service, billing data, and acceptance records. Our Privacy Policy covers those.
2. Details of processing
- Subject matter: repository contents, pull requests, design documents, and preview deployments connected to the Service, and the reviews produced from them.
- Duration: the term of the Terms of Service, plus the deletion period in Section 8.
- Nature and purpose: automated design review of pull requests: reading files and diffs, rendering previews in a browser, simulating user visits, generating comments, screenshots, recordings and scores, displaying them in the workspace and on GitHub, measuring how the workspace is used through PostHog (product analytics and session recordings, as the permissions and data handling page describes), and, when a repository editor presses a button that asks for it, opening a pull request from a branch of the App's own (the one-line setup test, or an update to an outdated preview workflow).
- Types of personal data: whatever you place in repositories and previews. Typically GitHub logins and names of contributors, and any personal data present in code, fixtures, content, or test environments. You are asked in the Terms not to connect production personal data.
- Categories of data subjects: your personnel and contributors, and any individuals whose data appears in the connected repositories or previews.
3. Instructions
3.1 We process personal data only on your documented instructions. The Terms, this DPA, your configuration of the Service (which repositories, previews, and settings you connect), and your use of its features are your complete instructions. Those instructions include our personnel examining individual reviews and the content behind them to support you and to diagnose and fix defects in the Service, under Section 4 and without copying it into any training set, and recording how the Service is used through the product analytics described in Section 3.2 of the Terms, to operate, support, and improve it.
3.2 We will tell you if we believe an instruction breaches Data Protection Law, unless the law prevents us from doing so.
3.3 We will not process personal data for our own purposes, sell it, or use it to train or fine-tune machine-learning models. The product analytics in Section 3.1 are part of your instructions, and we use them only to operate, support, and improve the Service.
4. Confidentiality
Personal data is accessible only to our personnel and subprocessors who need it to provide the Service, and who are bound by confidentiality obligations. We do not disclose it to third parties except as this DPA allows or law requires. Where law requires disclosure, we will notify you first unless prohibited.
5. Security
5.1 We maintain technical and organisational measures appropriate to the risk, summarised on the permissions and data handling page. They include: verified webhook and API authentication; installation-scoped access to data; encryption in transit; encrypted storage of preview credentials; scoped, revocable tokens; role-based operator access behind single sign-on; an audit log of operator and account actions; and scheduled expiry of review artifacts.
5.2 You acknowledge that the images the Service posts to GitHub are served from unguessable links that are not tied to a login, because GitHub fetches them without one, as Section 7.3 of the Terms describes; the rest of the review media is served only to signed-in members of your workspace. You control which repositories and previews are connected.
6. Subprocessors
6.1 You authorise us to engage the subprocessors listed at /privacy (section "Who receives it"). At the effective date they are: Cloudflare, Inc. (hosting, storage, workflows, browser rendering); PlanetScale, Inc. (primary database, on Amazon Web Services in the United States); Google LLC (Gemini API); Anthropic, PBC (Claude API, when the Service uses it); Cerebras Systems Inc. (Cerebras Inference API, when the Service uses it); PostHog, Inc. (product analytics and session recordings, United States region); and Stripe, Inc. (billing, which receives no Customer Content). We use the AI providers (Google, Anthropic, Cerebras) only under API terms that exclude training on the content we send.
6.2 Before a new or replacement subprocessor processes personal data, we will update the list at /privacy and tell you in the workspace and at the email address on your account. You may object on reasonable data-protection grounds. We will work with you to resolve an objection; if we cannot, you may terminate the Terms and uninstall the App, and Section 8 applies. The Service keeps running while an objection is considered. A version of the Terms that names a new subprocessor also authorises it once an owner accepts that version.
6.3 We impose data-protection obligations on each subprocessor no less protective than this DPA, and remain responsible for their performance.
7. Assistance
7.1 Data-subject requests. If we receive a request from a data subject about personal data in Customer Content, we will forward it to you without undue delay and not respond except on your instruction. We will help you respond, taking into account the nature of the processing, by making the relevant data accessible to you in the workspace and by deleting it on your instruction.
7.2 Security, impact assessments, and consultation. Taking into account the information available to us, we will provide reasonable assistance with your security obligations, data-protection impact assessments, and prior consultations with supervisory authorities, to the extent they concern our processing.
7.3 Personal data breach. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Content, with the information we have at the time and updates as we learn more. Notice goes to the workspace and to the email address on your account, if any.
8. Deletion and return
8.1 During the term you can retrieve your Output in the workspace and on GitHub. Customer Content itself remains in your repositories and previews; we hold copies only as described in the Terms and the Privacy Policy.
8.2 When you uninstall the App, we run the deletion sweep described in the Terms over artifacts of that installation. Review records that remain in our primary database are retained for the purposes and period stated in the Privacy Policy, and are deleted on request to privacy@renaissance-geek.ai. Copies in backups expire on the schedule stated there. We may retain data where law requires, and only for as long as it requires.
9. Audit
9.1 We will make available the information reasonably necessary to demonstrate compliance with this DPA: our data-handling description, our subprocessor list, and any third-party audit reports or certifications we hold.
9.2 If the information in Section 9.1 is insufficient to meet a requirement of Data Protection Law, you may first submit written questions, which we will answer within 30 days. If a requirement remains unmet after that, you may, once in any 12 months and on at least 30 days' written notice, mandate an independent auditor reasonably acceptable to us, bound by confidentiality and not a competitor of ours, to audit our processing under this DPA. The audit is conducted remotely unless Data Protection Law requires an on-site inspection, in which case it is limited to one business day during business hours without unreasonable disruption. You bear the cost, including our reasonable time and expenses at our then-current rates. You will share the findings with us, and any issues are resolved through a remediation plan we agree together. We may make the resulting report available to other customers under confidentiality in place of a further audit.
10. International transfers
We and our subprocessors process personal data in the United States and other countries. For transfers from the EEA, the UK, or Switzerland, we rely on the standard contractual clauses adopted by the European Commission (Module Two, controller to processor), the UK International Data Transfer Addendum, and the Swiss amendments, which are incorporated by reference with us as data importer and you as data exporter; the details in Section 2 populate their annexes and the measures in Section 5 populate the security annex. Our subprocessors' transfer mechanisms are set out in their own terms.
11. General
11.1 Our liability under this DPA is part of, and not in addition to, our liability under the Terms, and is subject to the exclusions and the cap in Section 14 of the Terms, which apply to this DPA without exception, except to the extent Data Protection Law does not allow it to be limited.
11.2 This DPA lasts as long as we process personal data on your behalf. Sections 4, 8, and 11 survive.
11.3 We may update this DPA to reflect changes in law or in the Service. Material changes follow the notice process for the Terms.
Renaissance Geek, Inc. · privacy@renaissance-geek.ai