Data Processing Addendum. How we process personal data for you.

Scope and roles.

This addendum is part of the Terms of Service and applies whenever Rapid Review, Inc. (“Rapid Review”) processes personal data for the Customer in providing the service (“Customer Personal Data”). It applies with the data protection laws that govern that processing, in particular the GDPR, the UK GDPR and Switzerland’s FADP.

The Customer is the controller of Customer Personal Data, or a processor for its own controller; Rapid Review is the Customer’s processor, or its sub-processor. Rapid Review is a controller only of the data its Privacy Policy describes, such as accounts, billing and support.

For Customer Personal Data, this addendum wins over the Terms, and the standard contractual clauses win over this addendum.

The processing.

• Subject and purpose: reviewing the Customer’s pull requests through the GitHub App, storing the records, learnings and parts of code that reviews use, showing them in the app, and support.
• Duration: for the term of the Terms, then until deleted under this addendum.
• Nature: collection from GitHub, storage, analysis by AI models, transmission to sub-processors, display and deletion.
• Data subjects: the Customer’s developers and organization members, the authors and reviewers of pull requests and issues, including outside contributors, and people named in code or text.
• Categories of data: GitHub ids and logins, names and email addresses in commits and code, the text of pull requests, issues and comments, replies in Rapid Review’s threads, organization roles, and the actions in the audit log.
• Special categories: none are intended. The Customer can leave files out of reviews in .rapid-review.yml.

Instructions and confidentiality.

Rapid Review processes Customer Personal Data only on the Customer’s documented instructions: the Terms, this addendum, the app’s settings and the repository’s .rapid-review.yml. It tells the Customer if it believes an instruction breaks data protection law, and processes otherwise only where the law requires it, telling the Customer first where the law allows.

Everyone at Rapid Review who may access Customer Personal Data is bound to confidentiality, and gets access only as far as their work needs it.

Security.

Rapid Review keeps technical and organizational measures appropriate to the risk (Art. 32 GDPR), at least these:

• data in transit is encrypted with TLS, and data at rest is encrypted by the hosting provider;
• GitHub tokens in the app are sealed with AES-GCM; sessions are random and expire after seven days;
• Changes to files that look like secrets, such as .env files, private keys and credentials, are never sent to a model, whatever the repository’s include rules say.
• The Rapid Review app shows reviews and findings only to people who can see the repository on GitHub, and only as long as GitHub shows it to them.
• staff access to the operator’s tools is limited and protected by passwords and, where set up, single sign-on;
• changes to review settings and learnings are recorded in the account’s audit log;
• the hosting provider keeps backups for restoring the databases;
• security reports sent to the security address reach a person, never only an automatic reply.

Rapid Review may improve these measures, but never lowers their overall level.

Sub-processors.

The Customer authorizes Rapid Review to use the sub-processors on its Sub-processors page. Rapid Review binds each by written contract to data protection duties no weaker than these, and remains responsible for them.

Rapid Review announces a new sub-processor on that page at least 30 days before it processes Customer Personal Data. The Customer may object within that time, on reasonable data protection grounds, by writing to privacy@rapidreview.dev. If we can’t resolve the objection, the Customer may end the Terms, and gets the refund the Terms describe. Where a sub-processor must change at once to keep the service secure or running, we announce it as soon as we can, with the same right to object.

Assistance.

Rapid Review passes on to the Customer any request from a data subject about Customer Personal Data, and helps the Customer answer it, through the app’s settings, deletion of learnings and on request, at no charge.

It helps the Customer, with the information it has, to secure the processing, to notify breaches, and with data protection impact assessments and prior consultations (Art. 32 to 36 GDPR).

Personal data breaches.

Rapid Review notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay, and at the latest 48 hours after becoming aware of it, with what is known then: what happened, the data and people likely affected, the likely consequences, and what it is doing about it. It adds what it learns later. A notice is not an admission of fault.

Deletion and return.

When the account’s owner asks, while the Terms run or after they end, Rapid Review deletes the Customer Personal Data it stores within 30 days, unless the law requires it to keep some. On request before then, it gives the Customer the learnings, settings and findings it holds, in a common format. The code itself stays in GitHub. On request, Rapid Review confirms the deletion in writing.

Audits.

Rapid Review gives the Customer, on request, the information needed to show that it meets this addendum. Where that isn’t enough, the Customer, or an auditor bound to confidentiality, may audit once a year on 30 days’ notice, during business hours and without disrupting the service. Each party bears its own costs, unless the audit finds that Rapid Review broke this addendum.

International transfers.

Rapid Review, Inc. is in the United States. For Customer Personal Data from the European Economic Area, the parties enter into the standard contractual clauses of the European Commission’s Decision (EU) 2021/914, which are incorporated here by reference: Module 2 where the Customer is a controller, and Module 3 where it is a processor, with the Customer as data exporter and Rapid Review as data importer.

• Clause 7 (docking) applies; the option in Clause 11 doesn’t.
• Clause 9: option 2, general authorization, with the notice this addendum gives.
• Clause 13: the supervisory authority responsible for the Customer, or for its representative in the EU.
• Clauses 17 and 18: the law and courts of Germany.
• Annex I is the section on the processing; Annex II the section on security; Annex III the sub-processors page.

For data from the United Kingdom, the UK’s International Data Transfer Addendum to those clauses applies; for data from Switzerland, the clauses apply with the FADP in place of the GDPR, and the Federal Data Protection and Information Commissioner as authority.

If an authority demands Customer Personal Data, Rapid Review tells the Customer where the law allows, and challenges a demand it considers unlawful.

Liability and term.

The Terms’ section on liability applies to this addendum, except where the law doesn’t allow liability toward data subjects or authorities to be limited.

This addendum lasts as long as Rapid Review processes Customer Personal Data. Rapid Review changes it only where the law requires or in the Customer’s favor, and announces a change 30 days before it takes effect.