Data processing addendum

1. Roles

For customer data you are the controller and Kestralia is the processor. For your own account data (billing, security) we may be an independent controller.

2. Scope and duration

Processing covers project hosting, crawling public pages, analysis, storing findings and content generation, and lasts until the agreement ends or data is deleted.

3. Security commitments

• AES-256-GCM encryption for credentials
• scrypt password hashing
• Role-based, least-privilege access
• Audit logging of sensitive actions
• Rate limiting and SSRF protection
• Backups with a documented recovery plan

4. Subprocessors

Current list: your hosting provider, Stripe (payments), and any AI provider whose key you supply. Changes are announced in advance. No data is sold to third-party advertisers.

5. International transfers

Where data leaves the region, standard contractual clauses or an equivalent mechanism apply.

6. Data breach

Notification without undue delay and within 72 hours of awareness, including nature, impact and remediation.

7. Data subject rights

Assistance with access, deletion, correction and portability requests, supported by in-product export and deletion tooling.

8. Deletion at end of contract

Data is deleted or anonymized within 90 days unless a legal obligation requires retention.