Data processing addendum

01

Roles and instructions

The customer is the controller or business, and Chinmay Raj Nataraj, operating Mergent, is the processor or service provider, except where each party acts as an independent controller for its own account, billing, security, and legal-compliance data. Mergent processes customer personal data only on documented instructions, including those given through use of the service.

02

Processing details

• Subject matter: providing agent-assisted bug remediation, repository integrations, previews, pull requests, support, and related platform features.
• Duration: the term of the customer’s use, plus the limited retention period described in the Privacy Policy.
• Nature and purpose: hosting, retrieval, analysis, generation, transmission, troubleshooting, security, and deletion.
• Data subjects: customer users, testers, developers, repository contributors, and people identified in submitted content.
• Data types: account and contact data, identifiers, repository content and metadata, bug reports, prompts, comments, logs, and support communications.

03

Confidentiality and security

Mergent ensures that people authorised to process customer personal data are bound by confidentiality obligations and applies appropriate technical and organisational measures proportionate to the risk. Current measures are described on the Security page.

04

Subprocessors

The customer authorises Mergent to use subprocessors needed to provide the service. Current subprocessors include GitHub (source control integration), OpenAI (model inference), Supabase and database infrastructure (authentication and storage), Vercel (hosting and previews), Stripe (billing), and Resend (transactional email). Mergent remains responsible for subprocessors to the extent required by applicable data-protection law.

05

International transfers

Where customer personal data is transferred across borders without an adequacy decision, the parties will rely on a valid transfer mechanism required by applicable law, including relevant standard contractual clauses or UK safeguards where applicable.

06

Assistance

Taking into account the nature of processing and information available, Mergent will reasonably assist the customer with data-subject requests, security obligations, breach notifications, impact assessments, and regulator consultations. The customer remains responsible for responding to requests and determining whether its use is lawful.

07

Security incidents

Mergent will notify the customer without undue delay after becoming aware of a confirmed personal-data breach affecting customer personal data and will provide available information reasonably needed for the customer’s response. Notification is not an admission of fault.

08

Deletion and return

At the end of the service, Mergent will delete or return customer personal data on request, unless law requires retention. Residual copies in backups may remain until overwritten under normal retention cycles and will remain protected.

09

Audit information

Mergent will provide information reasonably necessary to demonstrate compliance with this DPA. Audits must be legally required, coordinated in advance, limited in scope, subject to confidentiality, and avoid unreasonable disruption. The customer is responsible for its audit costs unless a material breach by Mergent is found.

10

Order of precedence

If this DPA conflicts with the Terms of Service on personal-data processing, this DPA controls. To request a signed copy or discuss additional legally required terms, contact us below.