Data processing addendum

Roles

For the personal data inside your projects (the teammates you invite, the readers who connect an AI assistant through your bridges, the readership counts and access logs of your docs, and anything personal in your specs and pages) you are the controller and SCRIVT LIMITED is the processor. This addendum forms part of the Terms of service for every business customer, no signature needed; countersigned copies are available on request at hello@palt.io.

Our commitments as processor

• process personal data only on your documented instructions; running the service is the standing instruction
• encrypt credentials we must use again (readers’ OAuth tokens, client secrets, bridge access tokens) at rest with AES-256-GCM, hash passwords and API keys, and encrypt all traffic in transit
• restrict access to personnel bound by confidentiality
• engage only the listed subprocessors, and give notice before adding one so you can object
• assist with data-subject requests and, where required, breach notification without undue delay
• delete personal data at the end of the relationship: account deletion does this immediately, with backups ageing out within 7 days

Transfers

Production data lives in London, United Kingdom. Where a subprocessor processes data outside the UK or EEA, transfers rest on adequacy decisions or standard contractual clauses.

Audit

We answer reasonable written security questionnaires and make available the information necessary to demonstrate compliance with this addendum.