Data processing agreement

This agreement is between Farnor Labs, LLC ("we") and the company that uses Gaitro ("you"). It's part of our Terms, so it applies as soon as you use Gaitro for a business, with nothing to sign. If you'd like a signed copy for your records, email info@gaitro.com.

Who does what

For the personal data your people and agents put in your projects (code, checks, logs, secrets, documents and anything else in them), you're the controller and we're your processor. For your account details, billing and how we run the service, we're the controller, as our Privacy policy explains.

What we process, and for how long

• Subject matter and purpose: storing your projects, running your checks and deploys, showing changes to the people you choose, and the other features of Gaitro you use.
• Kinds of personal data: whatever your projects contain. Commonly names, email addresses and usernames in code, commit history, logs and documents.
• People it's about: your people, and anyone whose data you put in your projects.
• Duration: while your company uses Gaitro, then until it's deleted under "When you leave" below.

What we promise

1. Your instructions. We process this data only to provide Gaitro as the Terms describe and as you configure it, unless the law requires otherwise; if it does, we tell you first where we're allowed to.
2. Confidentiality. Everyone at Farnor Labs, LLC who can reach your data is bound to keep it confidential.
3. Security. We protect it with the measures on our Security page: HTTPS only, a fresh sandbox for each check run, vault secrets encrypted and never shown again, logins stored only as hashes, and access limited to the people who need it. Cloudflare and Neon, where your data is stored, encrypt it on disk.
4. Sub-processors. We use the services listed in our Privacy policy under "Who else handles it", each under terms that protect your data at least as well as this agreement. We'll tell you by email at least 30 days before we add or replace one. If you object on reasonable data-protection grounds and we can't resolve it, you can end your subscription and we'll refund what you paid for the time after the change.
5. Helping you. We help you answer requests from people exercising their rights, and with security reviews, impact assessments and consultations with regulators, as far as Gaitro lets us. Most of it you can do yourself in Gaitro: export with Git, and edit or delete what you need to.
6. Breaches. If we learn of a personal data breach affecting your data, we tell you without undue delay, with what we know and what we're doing about it, and keep you updated.
7. When you leave. When your company stops using Gaitro, you can take everything with Git first. We then delete your projects within 30 days, and their backups are overwritten within a further 30 days, unless the law requires us to keep something.
8. Proving it. We make available what you reasonably need to show we keep this agreement, and answer your questions about it. Where that isn't enough, you can audit us once a year, on 30 days' notice, at your own cost and under confidentiality.

Transfers

We and our sub-processors are in the United States. Where your data comes from the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses (Module 2, controller to processor) apply between you and us, with the UK's International Data Transfer Addendum and the Swiss amendments where needed. They're incorporated by reference: Clause 7 (docking) doesn't apply, Clause 9(a) uses the 30 days' notice above, Clause 11 has no optional wording, and Clauses 17 and 18 use the law and courts of Ireland. The annexes are the sections of this agreement and our Security page.

The rest

If this agreement and the Terms disagree about personal data, this agreement wins. Our liability under it is part of, not on top of, the limits in the Terms, as far as the law allows.

Contact

Farnor Labs, LLC · 4539 N 22nd St, Ste R, Phoenix, AZ 85016, USA · info@gaitro.com