Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the organisation that uses Garasu (“Customer”) and Kameron Tanseli (“Processor”). It applies when Customer Content includes personal data and UK GDPR, EU GDPR, or similar law treats Customer as controller and us as processor.

Account emails, billing identity (when it exists), and visitor analytics are described in the Privacy Policy — we are controller of that information. This DPA covers Customer Content: projects, experiments, learnings, member-provided experiment metadata, and MCP payloads.

Using the Service, or signing up for an organisation, includes this DPA. If you need a signed copy, use the support form.

1. Roles

Customer is the controller (or a processor acting for a controller). Kameron Tanseli is the processor. Each party will comply with data-protection law that applies to its role.

2. Details of processing

3. Instructions

We will process Customer Content only on Customer’s documented instructions: using the Service, these Terms, this DPA, and configuration in the app or MCP. We will tell Customer if, in our opinion, an instruction infringes UK or EU GDPR, unless the law prohibits that notice.

Customer instructs us not to use Customer Content to train a model of our own. Inference to generate embeddings, matches, and titles is part of the Service. OpenRouter routes inference. Customer Content may be processed by Google (embeddings), OpenAI (embedding fallback and learning titles/summaries), Xiaomi (learning-title fallback). Those providers see prompt text from experiment names, hypotheses, result summaries, and learning titles. All AI endpoints we call are configured not to train on your data. We do not train a Garasu model of our own on Customer Content. OpenAI, Google, and Xiaomi models are hosted on United States servers. All models we call through OpenRouter are served from the United States. We do not extract or redact personal information from experiment hypotheses, names, or other metadata. You are responsible for not putting personal data in Customer Content you send to Garasu.

4. Confidentiality and personnel

People who process Customer Content are under confidentiality duties and only access it as needed to operate, support, or secure the Service.

5. Security

We take appropriate technical and organisational measures for a small SaaS product: TLS in transit, hashed passwords, row-level security between organisations, API keys for MCP, and access limited to the operator. We will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Content, including facts we know and measures taken.

6. Subprocessors

Customer authorises the subprocessors listed at /subprocessors, including OpenRouter and model providers that receive prompt text. We will post new subprocessors on that page. Customer may object on reasonable data-protection grounds via the support form. If we cannot accommodate the objection, Customer may stop using the affected feature or delete the account.

We will impose data-protection terms on subprocessors that are no less protective than this DPA in substance.

7. International transfers

Customer Content may be processed in the United Kingdom, the EEA, and the United States. OpenAI, Google, and Xiaomi models are hosted on United States servers; all models we call through OpenRouter are served from the United States. For restricted transfers we rely on standard contractual clauses (and the UK addendum where required) entered into by us or by the relevant subprocessor, or on another lawful mechanism.

8. Assistance

Taking into account the nature of processing, we will help Customer respond to data subject requests, DPIAs, and consultations with a supervisory authority, through the product (access, export via MCP, deletion) and the support form. We may charge a reasonable fee for assistance that goes beyond the ordinary Service.

9. Audit

We are a solo-operated service and do not hold a SOC 2 report. On written request we will provide available security information. On-site audits are limited to what is reasonable, no more than once per year unless a breach requires more, and at Customer’s expense.

10. Return and deletion

When the account ends, Customer may export via the app and MCP, then we will delete Customer Content from live systems as described in the Privacy Policy, unless law requires retention.

11. Liability

Liability under this DPA follows the limitation of liability in the Terms of Service, except that nothing excludes liability that cannot be limited under data-protection law.

12. Order of documents

If this DPA conflicts with the Terms on processing Customer Content, this DPA controls. UK and EU standard contractual clauses control over this DPA where they apply and conflict.