• We process customer personal data only on your documented instructions: the terms, these data processing terms and how you use and configure the service. If we think an instruction breaks the law, we will tell you. If the law requires other processing, we will tell you first unless the law forbids it.
• Anyone we authorise to process customer personal data is bound to keep it confidential.
• We keep the security measures below, and review them as risks and technology change.
• We help you, as far as we reasonably can, to answer requests from the people concerned, to keep data secure, to handle breaches, and with impact assessments and consultations with authorities.
• We don’t sell customer personal data, share it for targeted advertising, use it outside the business purpose of providing the service, or combine it with other data, except as the law allows.

• Encryption in transit (HTTPS) and at rest by our database provider; hosting on providers with independent security audits.
• Passwords (salted scrypt), recovery codes, API keys and emailed links stored only as hashes; optional two-factor sign-in; rate limits on sign-in.
• Each company’s data separated by the service, roles inside each company, and approval of changes proposed by AI or API clients.
• An audit log of changes and a tamper-evident hash chain over posted entries.
• Backups with point-in-time restore; access to production limited to what running the service needs.

You authorise us to use the subprocessors below. We bind each one by contract to data protection obligations at least as protective as these, and remain responsible for them. Before adding or replacing one, we update this list and the privacy policy and email your owners at least 30 days ahead. If you object on reasonable data protection grounds and we can’t address it, you may cancel, and we refund the part of the period you paid for and haven’t used.

We tell you without undue delay, and within 48 hours of becoming aware of a breach affecting customer personal data, what happened, the data and people likely affected, the likely consequences and what we are doing about it, adding details as we learn them.

You can export all of your company’s data at any time (Settings → Company). When an owner deletes the company, we delete customer personal data from the live service at once and from backups within 7 days, unless the law requires us to keep it. When the agreement otherwise ends, the terms of service and privacy policy describe how long it is kept.

We make available the information reasonably needed to show we meet these terms, including our providers’ independent audit reports where they make them available. If an authority requires it, or that information isn’t enough, you may audit our compliance once a year, with 30 days’ notice, at your cost, in a way that protects other customers’ data and confidential information.

We are in India and our subprocessors process data in the countries listed above. Where you are subject to the GDPR and the transfer to us needs safeguards, the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914 are incorporated by reference, with you as data exporter and us as data importer:

• Module Two (controller to processor), or Module Three where you are yourself a processor;
• clause 7 (docking) included; clause 9 option 2 (general authorisation, with the notice period above); the optional wording in clause 11 left out;
• clause 13: the supervisory authority of the EU member state where you are established, or where your representative is;
• clauses 17 and 18: the law and courts of Ireland;
• Annex I: the parties named here, and “What is processed” above; Annex II: the security measures above; Annex III: the subprocessors above.

For data subject to the UK GDPR, the UK Information Commissioner’s International Data Transfer Addendum to those clauses (version B1.0) applies, with the details above. For Swiss data, the same clauses apply with references read as the Swiss Federal Act on Data Protection and the Federal Data Protection and Information Commissioner. If these clauses conflict with the rest of the agreement, the clauses win.

Liability under these terms follows the terms of service, except where the standard contractual clauses or the law say otherwise. Questions about these terms: Sudip Kumar, Kalikapur, Haltu, support@raremargin.com.