Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service or other written or electronic services agreement that incorporates it by reference or link (Agreement). The parties are the legal entity identified as the customer in the Agreement (Customer) and Rerove Inc., 1304 Mcdaniel Ln Se Apt 103, Lacey, WA 98503, USA (Rerove).

Customer Data means data and content Rerove processes on Customer's behalf to provide the service, including code, repository metadata, product specifications, documents, decision ledger content, review outputs, and related account and usage data.

Customer Personal Data means personal data contained in Customer Data.

Roles and applicable law. Customer is the controller and Rerove is the processor of Customer Personal Data. Under the California Consumer Privacy Act, as amended (CCPA), Customer is the business and Rerove is its service provider. Applicable data-protection law includes the EU GDPR, UK GDPR and UK Data Protection Act 2018, Swiss Federal Act on Data Protection, and US state privacy laws, to the extent they govern the processing. Data-protection terms have their meanings under those laws.

Scope. Confidentiality (section 2), security (section 3 and Annex 2), no-training (section 5), incident notification (section 7), access and deletion (section 8), audits (section 9), and access locations (Annex 3) protect all Customer Data, including non-personal code and documents. Personal-data obligations apply to Customer Personal Data; statutory duties apply where the relevant law governs the processing. This DPA continues while Rerove processes the data it covers.

The Privacy Policy does not expand Rerove's permitted uses of Customer Data under this DPA.

This DPA prevails over conflicting data-protection provisions in the Agreement. Mandatory law and Annex 3 transfer terms prevail over both. Neither document restricts data subjects' rights or regulators' powers.

Rerove processes Customer Personal Data only on Customer's documented instructions, including for transfers: this DPA, the Agreement, Customer's service configuration and authorized use, and further written instructions agreed with Rerove. Customer is responsible for lawful instructions, data, notices, and a legal basis for processing.

If a law requires other processing, Rerove will tell Customer about that requirement before processing, unless the law prohibits notice. Rerove will promptly inform Customer if it considers an instruction to infringe applicable data-protection law and will suspend that instruction while the parties resolve it.

Rerove keeps Customer Data confidential and limits access to authorized personnel who need it to provide the service under Customer's instructions. Personnel receive security training and are bound by confidentiality obligations that continue after access ends.

Rerove maintains the technical and organizational measures in Annex 2 to protect Customer Data. It may update those measures provided the overall level of protection is not reduced.

Taking account of the processing and information available, Rerove assists Customer with data subjects' rights, security obligations, breach notifications, data-protection impact assessments, and prior consultation with supervisory authorities. Rerove promptly forwards data-subject requests to Customer and responds only on Customer's instructions or as legally required. It provides information needed to demonstrate compliance with this DPA and applicable processor obligations. Contact security@rerove.app.

Customer gives general authorization for the subprocessors on the Subprocessors page, including all AI model providers used for Customer Personal Data. The list identifies each provider's purpose, data, and processing location.

Before sharing Customer Personal Data, Rerove binds each subprocessor in writing to protections no less protective than this DPA, including applicable CCPA obligations. Rerove remains liable for their performance.

Rerove emails Customer's designated contact at least 30 days before adding or replacing a subprocessor, identifying the provider, purpose, data, and location. Customer must keep that contact current; additional contacts can subscribe on the Subprocessors page.

Customer may object on reasonable data-protection grounds by emailing security@rerove.app during the notice period. The parties will work in good faith to resolve the objection. If unresolved, Customer may terminate the affected service before the change takes effect and receive a refund of unused prepaid fees and credits for that service. The disputed subprocessor will not process Customer Personal Data before resolution or termination.

Neither Rerove nor its AI model providers use Customer Data to train AI models. Rerove sends only the content needed for the requested AI task to the listed providers.

Zero data retention is available as an optional configuration for AI gateway processing. Customer can request activation at security@rerove.app. It applies once Rerove confirms activation for Customer's organization. Gateway requests then use only providers supporting zero data retention and fail if none is available. Other AI processing follows the applicable provider agreements. This option does not change Rerove's retention periods under section 8.

Where the CCPA applies, Rerove processes Customer Personal Data only for these business purposes: maintaining and searching Customer's decision ledger; reviewing pull requests; answering authorized AI-assistant tool calls; managing access to Customer's service; and providing service security, troubleshooting, and support.

Rerove will not sell or share Customer Personal Data, retain, use, or disclose it for a purpose outside those specified business purposes, or use it outside the direct business relationship with Customer. Rerove will not combine it with personal information received from another person or collected from its own interactions with individuals.

Rerove complies with applicable CCPA obligations and provides the same level of privacy protection required of Customer. It assists Customer with consumer requests and with applicable cybersecurity audits, risk assessments, and automated decisionmaking obligations relating to the services it provides.

Customer may take reasonable and appropriate steps to verify that Rerove uses Customer Personal Data consistently with Customer's CCPA obligations. Rerove will notify Customer if it can no longer meet its obligations, and Customer may take reasonable and appropriate steps to stop and remediate unauthorized use.

Rerove notifies Customer without undue delay and in any event within 72 hours after becoming aware of a security incident affecting the confidentiality, integrity, or availability of Customer Data.

Notice goes to Customer's security contact, or its account contact if none is designated. It describes the incident, affected data and, where applicable, data subjects (including approximate numbers where known), likely consequences, measures taken or proposed, and a contact for further information. Rerove provides updates as information becomes available without undue delay.

Rerove takes reasonable steps to contain, investigate, and remediate the incident and assists Customer with its own notification obligations. A notification is not an admission of fault or liability.

Customer can access and retain Customer Data throughout the service. Review results are in Customer's GitHub, and the decision ledger is accessible through MCP.

At the end of the service, Rerove deletes Customer's organization as part of offboarding. If Customer requests return under applicable law, Rerove assists with return before deletion. Rerove confirms deletion in writing on request.

Retention and deletion periods are set out in section 6 of the Privacy Policy, incorporated into this DPA. Organization-deletion periods start when the organization is deleted; logs and backups follow their separate periods. Privacy Policy updates cannot extend retention under an existing Agreement without Customer's agreement.

Retained backups remain protected, are used only for recovery, and restored data is deleted again. Rerove retains data beyond the applicable periods only where required by law, restricts its use to that purpose, and deletes it when the requirement ends. The Privacy Policy's fraud-prevention exceptions do not extend retention of Customer Personal Data under this DPA.

For routine assurance, Rerove provides its available SOC 2 report under confidentiality and answers one reasonable security questionnaire per year.

Customer may request an on-site audit after a security incident under section 7 affecting its Customer Data or on a regulator's order, with reasonable notice, an NDA, and an independent auditor bound by confidentiality. The parties coordinate to protect other customers and avoid unnecessary disruption. Customer bears its audit costs.

Rerove cooperates with any broader information, audit, or inspection rights required by applicable law or Annex 3, including where routine assurance is insufficient.

Liability arising under this DPA is subject to the limitations and aggregate cap in section 12 of the Terms, unless the parties expressly agree otherwise in writing. No limitation applies to liability or rights that applicable law or the transfer terms in Annex 3 prohibit limiting. The Terms do not excuse Rerove from its responsibility for subprocessors under section 4.

This DPA takes effect when incorporated into the Agreement, including through electronic acceptance of the Agreement. No separate DPA signature is required. Rerove records the applicable dated version with Customer's Agreement.

The dated version remains available. Changes follow the Agreement's amendment terms, except for subprocessor and security updates permitted by this DPA.

A signed PDF with the same text is available on request from security@rerove.app.

Subject matter. Providing Customer's decision ledger and AI-assisted product and code review service.

Duration and frequency. Ongoing throughout the service term and deletion periods under section 8. Subprocessors process only for their listed functions during their engagement and applicable deletion periods.

Nature and purpose. Receiving, storing, organizing, searching, and retrieving content; extracting statements, topics, glossary terms, and search indexes; reviewing pull requests; returning results to Customer and its connected tools; authenticating users; securing, supporting, and operating the service; and deleting data.

Data subjects. Customer's employees and contractors, and people named in Customer content, including authors, meeting speakers, and people to whom statements are attributed.

Categories of personal data. Personal data processed on Customer's behalf within: account data (names, emails, profiles, organization, role, and verification phone numbers); decision ledger content (text, statements, source quotes, topics, glossary terms, search indexes, and attribution); code data (code, diffs, file names, commit messages, pull request descriptions, and usernames); and usage data (request times, IP addresses, user agents, actions, audit events, and performance or error data).

Excluded data. Customer must not submit or import its own end-user data, payment card data, health information, government identification numbers, passwords, API keys, or special category data under Article 9 GDPR. Rerove is not authorized to access or use Customer's end-user data. Inadvertently supplied data retains its applicable protections under this DPA; the parties will cooperate to remove it.

Subprocessing. Providers, purposes, data, and locations are listed on the Subprocessors page, subject to section 4.

These measures protect Customer Data and address the Security and Confidentiality scope of Rerove's service. They do not add an uptime, recovery-time, or recovery-point commitment.

• Encryption. TLS 1.2 or later protects data in transit. AES-256 encryption protects database, file-storage, and queue data at rest.
• Tenant separation. Records are scoped to an organization. Organization-specific storage access points and isolated processing environments restrict access to the relevant customer's data.
• Access control. Role-based permissions and least privilege limit access to approved service needs. Access is reviewed and removed when no longer needed. Personnel are bound by confidentiality and security responsibilities.
• Logging and monitoring. Security and access logs support detection, investigation, and response. Logs are protected against unauthorized access and retained under section 8.
• Vulnerability management. Secure development, code review, vulnerability assessment, and remediation processes identify and address security risks according to their severity.
• Incident response. A documented incident-response process assigns responsibilities for detection, containment, investigation, remediation, and notification under section 7.
• Backup and recovery. Scheduled backups and recovery procedures protect service data. Access to backups is restricted, and backups expire under section 8.
• Vendor management. Providers are assessed for the services they supply, subject to contractual data-protection obligations, and reviewed as part of vendor management. Subprocessor changes follow section 4.

These measures also support access, correction, restriction, and deletion requests under section 3.

Locations. Customer Data is hosted in the United States. Personnel access is limited to the United States and the European Union. Subprocessor locations are listed on the Subprocessors page.

Application. These terms apply to Customer Personal Data transferred to a country for which the relevant law requires these safeguards.

EU Standard Contractual Clauses (SCCs). The clauses in the Annex to Commission Implementing Decision (EU) 2021/914 are incorporated without alteration. Module 2 applies to Customer as controller/data exporter and Rerove as processor/data importer. For restricted onward transfers to subprocessors, Rerove uses Module 3 or another valid transfer mechanism, with the required parties and annexes completed.

SCC selections. Clause 7 (docking) applies. Clause 9(a) uses Option 2, general written authorization, with 30 days' prior notice under section 4. The optional independent dispute-resolution language in Clause 11 does not apply. Clause 17 uses Option 1 and the law of Ireland. Clause 18(b) designates the courts of Ireland, without restricting a data subject's rights under Clause 18(c).

Annex I.A to the SCCs. Customer's legal name, registered address, registration number if applicable, and contact are those in the Agreement or its account records. Its activity is using the service in Annex 1; its role is controller/data exporter. Rerove's name and address are in section 1, its contact is security@rerove.app, its activity is providing that service, and its role is processor/data importer. Each party's binding acceptance of the Agreement constitutes its signature to the SCCs and UK Addendum where applicable, effective when this DPA is incorporated.

Annex I.B to the SCCs. Annex 1 supplies the data subjects, categories, exclusions, frequency, nature, purposes, and subprocessing description. Retention follows section 8 and the Privacy Policy schedule incorporated there. Sensitive data is not permitted.

Annex I.C to the SCCs. The competent supervisory authority follows Clause 13: the authority for Customer's EU establishment, its Article 27 representative where required, or a Member State where affected data subjects are located when no representative is required. The applicable authority is identified in the Agreement or Customer's account records.

Annex II and subprocessor information. Annex 2 supplies the technical and organizational measures. The maintained Subprocessors page supplies the authorized providers under general authorization; each onward transfer agreement must contain the required provider-specific appendix information.

United Kingdom. For restricted transfers covered by UK data-protection law, the ICO International Data Transfer Addendum, version B1.0, including mandatory Part 2 as revised under its section 18, is incorporated. Table 1 uses the parties, contacts, signatures, and effective date in SCC Annex I.A above. Table 2 identifies Decision 2021/914, Module 2, and the SCC selections above; Module 3 is completed in the onward agreement. Table 3 uses Annex 1, section 8, Annex 2, and the Subprocessors page as mapped above. Table 4 selects both importer and exporter. The Addendum's mandatory substitutions, including UK law, courts, and supervisory authority, govern UK transfers.

Switzerland. For transfers governed by the Swiss Federal Act on Data Protection (FADP), the SCCs apply with references to the GDPR read as references to the FADP where appropriate. The Federal Data Protection and Information Commissioner is the competent authority for the Swiss aspects. References to a Member State do not exclude data subjects in Switzerland from bringing proceedings in Switzerland under Clause 18(c). For Swiss-only transfers, Clause 17 is governed by Swiss law and Clause 18(b) designates the competent courts of Switzerland. Where both the GDPR and FADP apply, the EU and Swiss authorities and data-subject rights apply in parallel.

Rerove assists with required transfer assessments, supplementary measures, and government-access requests under the applicable transfer terms.