Data processing addendum

This data processing addendum ("DPA") is part of the terms of service between you (the "customer") and Zuzo Studio LLC ("Zuzo Studio", "we"). It applies when we process personal data on your behalf while providing Xodia, and data protection laws such as the GDPR, the UK GDPR or US state privacy laws apply to that processing.

It doesn't cover personal data we use for our own purposes, such as your account, billing and sign-in records. The privacy policy covers that. If you need a signed copy for your records, email hello@zuzostudio.com.

For personal data in your workspace, you are the controller, or a processor acting for your own client, and Zuzo Studio is your processor, or subprocessor. You are responsible for having a lawful basis for the data you put into Xodia and for any notices or consents your sites and their visitors need.

We process the data only on your documented instructions. The terms of service, this DPA, your settings and how you and your team use Xodia are those instructions. We'll tell you if we believe an instruction breaks data protection law, and we won't process the data for any other purpose unless the law requires it, in which case we'll tell you first unless the law forbids that.

Only people who need it to run or support Xodia can access your data, and each of them is bound to keep it confidential.

We keep technical and organizational measures in place to protect your data, including:

• encrypted connections, and environment variables and access tokens encrypted at rest;
• each project's preview in its own isolated sandbox, with outgoing network access limited to an allow-list;
• short-lived, narrowly scoped tokens for connected services such as GitHub;
• role-based access within your workspace, and access to production limited to people who need it;
• bot checks on sign-up and sign-in, and limits on repeated sign-in attempts.

The security page describes these in more detail. We may improve them over time, but we won't reduce the overall level of protection.

You authorize us to use the subprocessors on our subprocessors page. Each is bound by a written agreement with data protection obligations at least as protective as this DPA, and we remain responsible for their work.

Before we add or replace one, we update that page and email the owners of paid workspaces at least 30 days ahead, unless we must act sooner to keep Xodia running or secure. If you object on reasonable data protection grounds, tell us within that time and we'll try to find a solution. If we can't, you may cancel the affected plan, and we'll refund any amount you've paid for the time after the change takes effect.

Taking into account what we can reasonably do, we'll help you answer requests from people exercising their data protection rights, and provide information you reasonably need for data protection impact assessments or questions from a regulator. Most data in a project you can view, export or delete yourself in the app or in your own repository. If a request about your data comes to us directly, we'll pass it to you rather than answer it ourselves.

If we become aware of a breach of security that leads to the accidental or unlawful loss, change, disclosure of or access to your personal data, we'll tell the owners of the affected workspace without undue delay. We'll share what we know about what happened, the data involved and what we're doing about it, and update you as we learn more. Telling you isn't an admission of fault.

You can export your sites at any time: projects connected to GitHub are already in your own repository, and for code stored with Xodia you can ask us for a copy before you close your account. When you delete your account, we delete your workspaces' data straight away and copies in backups within 30 days, except where the law requires us to keep it.

We'll make available the information reasonably needed to show we meet this DPA, mainly by answering your written questions. If that isn't enough, or a regulator requires it, you may audit our compliance once a year with at least 30 days' notice, at your own cost, by an auditor bound to confidentiality, in a way that doesn't disrupt Xodia or put other customers' data at risk.

Zuzo Studio is based in the United States, and our subprocessors process data in the United States and other countries. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (module two, or module three where you are a processor) apply to the transfer, with the UK Addendum and the Swiss changes where those laws apply. This DPA supplies the information the clauses need, and if they conflict with this DPA, the clauses win.

Each party's liability under this DPA is subject to the limits in the terms of service, as far as the law allows. If this DPA conflicts with the terms of service about personal data, this DPA wins. We may update it to reflect changes in the law or in Xodia; we'll change the date at the top and tell you before a significant change takes effect, and we won't reduce the protection it gives your data.