Data Processing Addendum

Customer is the controller and Ruliad the processor of personal data in Customer Content. Ruliad processes it only on Customer's documented instructions (the agreement, Customer's API requests and settings), unless the law requires otherwise, in which case Ruliad tells Customer first where it may.

• Subject matter and purpose: running the models on Customer's requests and returning the results.
• Duration: the term of the agreement. Content is not stored beyond the processing of each request (an input may be held in memory for a few minutes for follow-up requests that refer to it by hash).
• Data categories: whatever Customer sends, which may include images, screen captures, text and audio containing personal data.
• Data subjects: Customer's end users and any person appearing in Customer Content.
• No training: Ruliad does not use Customer Content to train or improve models.

Ruliad limits access to people who need it to provide the Services, bound by confidentiality, and logs administrative access.

• Encryption in transit (TLS) for all traffic; worker connections through authenticated tunnels with no open inbound ports.
• API keys stored only as hashes; secrets encrypted at rest; least-privilege, audited administrative access.
• No persistent storage of request content; request metadata segregated per account.
• Monitoring, alerting and incident response; nightly database backups with restore tests.

Customer authorises the subprocessors on the Subprocessors page. Ruliad gives at least 30 days' notice of a new subprocessor (by email and on that page); Customer may object on reasonable data-protection grounds, and if no solution is found, terminate the affected Services. Ruliad imposes data-protection terms on each subprocessor at least as protective as this DPA and remains responsible for them.

• Ruliad helps Customer answer data-subject requests and carry out impact assessments, to the extent Ruliad holds relevant data.
• Ruliad notifies Customer without undue delay, and within 72 hours, after becoming aware of a personal-data breach affecting Customer Content, with the information Customer needs to meet its obligations.
• Ruliad makes available the information necessary to demonstrate compliance and allows reasonable audits, once a year with 30 days' notice, or after a breach.

Where personal data leaves the EEA, the UK or Switzerland, the parties agree to the Standard Contractual Clauses (Module 2, controller to processor; Module 3 where Customer is itself a processor) and the UK Addendum, incorporated by reference.

Request content is not retained. At the end of the agreement, Ruliad deletes the account data it holds for Customer within 90 days, except records the law requires it to keep.