Data processing addendum.

Your sessions can contain other people’s personal data. For that data you are the controller and we are your processor. This addendum is part of the terms for every customer; there is nothing extra to sign.

Effective 21 October 2026. Version 2026-10-21.

This addendum (“DPA”) is between you and Lay Sheth (trading as plottypus), Siddharth Nagar, Indore 452009, Madhya Pradesh, India (“we”). It covers any personal data in your sessions that you or your organisation control (“customer personal data”). To have it name your company, email hello@plottypus.com with the company’s name, address and privacy contact.

1. Roles#

You are the controller of customer personal data. We are your processor. For your account, billing, analytics and our logs we are a separate controller under the privacy policy; this DPA doesn’t cover that data.

2. Instructions#

• We process customer personal data only on your documented instructions: the terms, this DPA, and how you use and set up the service.
• We tell you if we think an instruction breaks data protection law.
• We process it otherwise only if the law requires it, and tell you first unless the law forbids it.
• We don’t use it to train any model, sell it, or use it for our own purposes. One exception: the copy shared through Help improve plottypus, which is on unless the user turns it off, per account, per project or from the CLI. For that copy we are a separate controller, and we use it only to test and improve plottypus. For your organisation’s code, turn sharing off for that project. Content-free product metrics are not customer personal data.

3. Confidentiality#

Everyone we let process customer personal data is bound to keep it confidential. Today that is only us.

4. Security#

We keep the measures in Annex 2. We may improve them but won’t make them weaker overall.

5. Subprocessors#

• You give general permission for the subprocessors in Annex 3.
• We bind each by a written contract with data protection terms no weaker than this DPA, in substance, with one exception below. We stay responsible to you for them.
• We email you 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can’t fix it, you can end the affected service and get a refund of prepaid, unused fees.
• Exception, until our first paying customer: reviews run on Anthropic’s consumer Claude service under our own account, with model training turned off. Anthropic processes that data under its consumer terms and privacy policy, and keeps it 30 days with training off. There is no data processing agreement with Anthropic for it. Before we take the first payment, we move reviews to Anthropic’s commercial API (with its DPA) or Amazon Bedrock (under the AWS DPA), and email you.

6. Helping you#

• If a person asks us directly about customer personal data, we pass the request to you and don’t answer it ourselves unless you tell us to. The dashboard lets you download and delete data, which covers most requests.
• We give you reasonable information for your impact assessments and consultations with authorities.

7. Breaches#

We tell you without undue delay, and within 48 hours, after we learn of a breach affecting customer personal data: what happened, what data and roughly how many people, the likely effects, what we did, and a contact. We update you as we learn more.

8. Deletion and return#

• Traces are deleted 30 days after a session’s last activity; findings and session summaries after 90 days. Backups expire 30 days after that.
• Disconnecting a machine stops new data. Its sessions, findings and traces are deleted when the customer asks, 7 days after the request; the customer can cancel until then.
• You can delete your whole account at any time in the dashboard, and download your data first. To delete one session, email us.
• When the terms end, we delete customer personal data within 30 days, and backups expire within 30 more, unless the law requires us to keep it.

9. Audits#

We give you the information you reasonably need to show we meet this DPA, including written answers to a security questionnaire once a year. If that isn’t enough, or an authority requires it, you may audit us once a year, at your cost, with 30 days’ notice, during business hours, under a duty of confidence.

10. International transfers#

• We process customer personal data in India (AWS Mumbai). The model provider processes it in the US (Annex 3).
• EU: where your transfer to us is under GDPR, the EU standard contractual clauses (Commission Decision 2021/914), Module 2 (controller to processor), apply and are part of this DPA. Clause 7 (docking) applies; clause 9 option 2 (general authorisation, 30 days); the optional language in clause 11 does not apply; clause 17: Irish law; clause 18: courts of Ireland. Annexes 1 to 3 here fill in the SCC annexes.
• UK: the UK International Data Transfer Addendum (version B1.0) applies with the same details.
• Switzerland: the SCCs apply with the FADP as governing law where needed.
• Anthropic, until our first paying customer: no SCCs or DPA cover the onward transfer to Anthropic (section 5).

11. Liability and order#

Liability under this DPA is subject to the limits in the terms, as far as the law allows. If this DPA and the terms conflict, this DPA wins for customer personal data. If the SCCs conflict with anything, the SCCs win.

Annex 1: Details of processing#

Annex 2: Security measures#

Only measures we run today:

• Encryption at rest: AWS EBS encrypted volumes; S3 server-side encryption (AES-256) for backups.
• Encryption in transit: HTTPS for the site, dashboard and API; the CLI connects over TLS.
• Machine tokens and one-time connect codes stored only as SHA-256 hashes.
• Trace files readable only by the service account; we open them only to fix a fault or answer the customer.
• The reviewer reads files only inside the session’s folders, never deny-listed files, and runs only read-only git diff, log, blame and show on the customer’s machine.
• Best-effort secret filtering and a file deny list on the customer’s machine before sending.
• Server logs filter tokens and known key formats, and are kept 14 days.
• Automatic deletion of traces (30 days) and backups (30 days).
• Customer controls: pause, exclude folders, disconnect a machine, delete a machine’s sessions, download data, delete the account, uninstall.

Annex 3: Subprocessors for customer personal data#

The full list of everyone who handles data for us is on the subprocessors page.