Data Processing Agreement

1. Definitions

"Customer Personal Data" means personal data in the Customer's account, such as its team members' details, and personal data contained in Customer Content, which RelayDev processes for the Customer. Other terms (controller, processor, personal data breach, data subject, sub-processor and processing) have the meanings given in the GDPR.

2. Roles

The Customer is the controller of Customer Personal Data. RelayDev is its processor. If the Customer is itself a processor for others, RelayDev is a sub-processor, and the Customer confirms that its instructions have been authorised by the relevant controller.

3. Instructions

RelayDev processes Customer Personal Data only on the Customer's documented instructions. These are the Terms, this DPA, and the actions the Customer takes in RelayDev, such as creating tasks, running agents or merging pull requests. If RelayDev believes an instruction breaches data protection law, it will tell the Customer without undue delay.

4. Confidentiality

RelayDev ensures that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality and has access only as needed to provide the service.

5. Security

RelayDev takes the technical and organisational measures in Annex II, which are appropriate to the risk. RelayDev may update them, provided the level of protection does not fall.

6. Sub-processors

• The Customer authorises RelayDev to engage the sub-processors listed at Subprocessors (Annex III).
• RelayDev imposes on each sub-processor data protection obligations that are no less protective than this DPA, and remains responsible for their performance.
• RelayDev gives the Customer at least 30 days' notice, by email to the account owner and on the Subprocessors page, before adding or replacing a sub-processor.
• The Customer may object within those 30 days on reasonable data protection grounds. If we cannot resolve the objection, the Customer may end the affected service and receive a refund of any prepaid fees for it.

7. International transfers

Where Customer Personal Data is transferred outside the European Economic Area or the UK to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two for controller to processor and Module Three for processor to sub-processor), which are incorporated by reference. For UK transfers, the UK International Data Transfer Addendum applies. Where the recipient is certified under the EU-US Data Privacy Framework, that framework may be relied on instead. If these clauses conflict with this DPA, the clauses prevail.

8. Requests from data subjects

RelayDev tells the Customer without undue delay if it receives a request from a data subject about Customer Personal Data, and does not respond to the request itself unless the Customer instructs it to. RelayDev helps the Customer meet its obligations to respond, taking into account the nature of the processing.

9. Assistance

Taking into account the nature of the processing and the information available to it, RelayDev helps the Customer with security, breach notification, data protection impact assessments and prior consultation with supervisory authorities (GDPR Articles 32 to 36).

10. Personal data breaches

RelayDev notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as it is known, the nature of the breach, the categories and approximate number of records and people affected, the likely consequences, and the measures taken or proposed. RelayDev updates the notice as more information becomes available, and takes reasonable steps to contain and remedy the breach.

11. Return and deletion

When the Customer ends its account, or on the Customer's instruction, RelayDev deletes or returns Customer Personal Data within 30 days, and deletes existing copies, unless the law requires it to keep them. Copies held in backups are removed when those backups expire, and are not restored to live use. On request, RelayDev confirms deletion in writing.

12. Information and audits

RelayDev makes available the information needed to show it meets this DPA, including any third-party assessment reports it holds from sub-processors. The Customer may audit RelayDev once in any 12-month period, on 30 days' written notice, during business hours and without disrupting RelayDev's operations, subject to confidentiality. Each party bears its own costs of an audit.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA prevails over the Terms of Service on the processing of Customer Personal Data.

14. Duration

This DPA applies for as long as RelayDev processes Customer Personal Data for the Customer.

Annex I: Description of processing

Subject matter

Providing RelayDev: a kanban board that hands tasks to AI agents, and pull requests back for review.

Duration

The term of the Customer's account, as set out in section 14.

Nature and purpose

Storing, displaying, analysing and transmitting data to run agents, record their output, show and merge pull requests, bill, keep audit records, and keep the service secure.

Frequency

Continuous, for as long as the Customer uses the service.

Categories of data subjects

The Customer's users and team members, and any individuals whose personal data appears in Customer Content.

Categories of personal data

Names, email addresses, GitHub identifiers, IP addresses and log data, and any personal data contained in task descriptions, repository code, agent output and run logs.

Sensitive data

Not intended. The Customer must not submit special category data, as defined in Article 9 GDPR, unless agreed in writing.

Annex II: Technical and organisational measures

• Provider credentials encrypted at rest (AES-256-GCM).
• Agent API keys stored only as SHA-256 hashes; GitHub App private key and client secret kept on the server only.
• Row-level security enabled on every database table; the web app reaches the database only from its server.
• Each cloud run in its own microVM, with network access limited to an allowlist. Credentials are added at the network layer and are never placed inside the VM. Agents cannot push to the default branch.
• Access control: administrator access requires a stated reason, lasts one hour, and is recorded in the audit log.
• Append-only audit log of merges, runs, credential and API key changes, and GitHub connections.
• Least-privilege GitHub access: the GitHub App requests only the repository permissions it needs.

Annex III: Sub-processors

The sub-processors authorised under section 6 are listed at Subprocessors, with the function each performs, the data it handles and where it is located.