Data Processing Agreement. How we handle data on your behalf.

01About this agreement and when it appliesLink copied

This agreement is between Reqursor Technologies ("Reqursor", "we", "us"), a company based in Rotterdam, The Netherlands, and the business that uses Reqursor ("you", "the customer"). It is part of the Terms of Service and meets the requirements of article 28 of the General Data Protection Regulation (GDPR).

Reqursor Development and Reqursor Platform are now one product, Reqursor. Some of our other documents and our earlier websites still use the earlier names. In this agreement, Reqursor Development means the part of Reqursor that works on your code, and Reqursor Platform means the part that changes online stores, which is in early access, by invitation.

It applies where we process personal data on your behalf as your processor. That happens in five situations:

• Hosted instances. Where we host Reqursor for you, the instance runs on servers that we operate. The tickets, run history and audit log in it, and the copies of your repositories that the agent works on, can contain personal data.
• Reqursor Credits. When you use Reqursor Credits, your model requests pass through our relay on their way to the model provider. The requests can contain personal data, for example names or email addresses in code, tickets, comments or files.
• The assistant on our allowance. Reqursor Intelligence is the assistant panel in the dashboard. On a self-hosted installation, an Owner or Admin chooses between your own key and our monthly allowance. If they choose our allowance, the assistant's questions go through our relay to Anthropic, with the ticket, run, plan, finding and project details the assistant read to answer. These can contain personal data. We act as your processor for this content, and the relay handles it as it does a credits request. We pay for these questions, and no credits are used. If they choose your own key, the questions go straight to your provider and this situation does not arise.
• Support material. When you send us material for support, such as a diagnostics bundle, logs or attachments, that contains personal data. We are the controller for the contact details of the person who writes to us, and your processor for the attachments, logs and files they send.
• Online stores, in early access. For the online store part of Reqursor, which changes online stores that we run for you, we process the personal data contained in or generated by those stores, such as the data of your shoppers, and the store setup data that Reqursor manages for them.

It does not apply where we are the controller. We are the controller for the account, license, billing and usage data we use to run licenses, credits, billing and the online store dashboard, and for the other data described in our Privacy Policy. With a self-hosted license and your own key, your prompts go straight from your server to your provider and we do not receive them, so this agreement then applies only to support material, and to the assistant's questions if an Owner or Admin chooses our monthly allowance. If a person signs in with their own Claude account, the prompts of the tickets that person runs go from the installation to Anthropic under that person's own agreement, and Anthropic is not our sub-processor for them.

This agreement forms part of the agreement under the Terms of Service from the moment you accept them, by starting a trial, activating or buying a license or using Reqursor (for the online store part, in early access, from the moment we run a store or give a dashboard account to you), and you do not need to sign it. If you need a signed copy, email [email protected] and we sign it.

02Terms usedLink copied

"Personal data", "controller", "processor", "data subject", "processing", "personal data breach", "supervisory authority" and "special categories of personal data" have the meaning they have in the GDPR. "Applicable data protection law" means the GDPR and any national implementing or supplementary laws of the Netherlands, together with any other data protection or privacy laws that apply to the processing of personal data under the Terms of Service. "Customer personal data" means the personal data that we process on your behalf under this agreement. "Sub-processor" means a processor that we engage to process customer personal data. "Standard contractual clauses" means the standard contractual clauses of the European Commission for the transfer of personal data to third countries, adopted by Implementing Decision (EU) 2021/914, or any successor clauses.

03What we process and whyLink copied

• Subject matter and purpose. Where we host your instance, we store and run it for you. We forward your model requests to the model provider and return the answers, and we count the usage for credits. The usage records we keep are controller data, as section 1 says. We handle the support material you send us in order to help you. For online stores, we process the personal data contained in or generated by the stores, and the store setup data (store definitions, design settings, page layouts, managed settings and the history of changes). The purpose is solely to provide, secure and support Reqursor under the Terms of Service and your instructions.
• Nature of the processing. For a hosted instance, we store the data in it on servers that we operate and process it as the software works on your tickets. For credits, the relay receives and checks each request in memory, forwards it and returns the answer. It does not store the request or the answer. For support, we receive, read and keep the material for as long as we need it to help you. For online stores, it includes hosting, running and monitoring stores, building and deploying changes, isolating each store, storing and deleting data and, where you use the AI chat, sending the store settings needed for a task to the AI provider.
• Duration. For a hosted instance, for as long as we host it for you, until we delete it as section 11 says. For credits, for as long as you use them, and only in transit through our relay. For support material, until the support request is closed, and no longer than we need it. For online stores, for as long as we run your stores, and for any further period in which we must or may keep the data under this agreement or the law, after which it is deleted or returned as section 11 says.
• Types of personal data. Any personal data that is in your tickets, code, comments, files, commit data or tool results that you send. It can include names, email addresses, usernames and other identifiers. For online stores it can also include identification and contact details (such as name, email address and postal and billing address), order and purchase records, and any other personal data that you or your shoppers put into a store. You decide what that is.
• Categories of data subjects. People whose data appears in your material, such as your employees, contractors, customers and users, and for online stores the shoppers and account holders of your stores and your own team members and clients.

Online stores: what stays where

This applies to the online store part of Reqursor, in early access. Product catalogs, customer orders, media and store settings that Reqursor does not manage stay in each store's own isolated storage. We do not access or read this data, except while we move an existing store to Reqursor for you: then only with your explicit consent, read-only and only for as long as the move takes.

When you use the AI chat for a store, the store settings sent to our AI provider, Anthropic, are limited to one organization per request and kept to the minimum needed for the task. Passwords, API keys and other credentials, orders, products and customer records are never included.

Sensitive data

Reqursor is not designed for special categories of personal data (such as health data) or data about criminal convictions, and we offer no safeguards beyond those in this agreement.

• For code, tickets, credits and hosted instances, do not send such data through Reqursor Credits or store it in a hosted instance. If you do, you do so on your own responsibility, and you must have a legal basis and have checked that these safeguards, including that Anthropic may keep requests for a limited time, are enough for you.
• For the online store part, you must not use it for such data unless we have agreed otherwise in writing.

04Your instructions and your responsibilitiesLink copied

We process customer personal data only on your documented instructions, including on transfers to a third country, unless Union or Member State law that applies to us requires otherwise. In that case we tell you before the processing, unless that law forbids it on important grounds of public interest. This agreement, the Terms of Service and your use of the product are your instructions. That includes your choice of a license that we host and that runs on Reqursor Credits, which sends your requests to Anthropic and to our other sub-processors, and your choice to use the AI chat of an online store, which sends store settings to Anthropic. We tell you without delay if we think an instruction breaks data protection law.

You decide the purposes and means of the processing. You are responsible for having a legal basis for the data you send, for giving the notices that the law requires to the people concerned, and for the instructions you give us. If you process the data for someone else as their processor, you confirm that you are authorized to give us these instructions, and we act as your sub-processor on the terms of this agreement. Each of us is responsible for the obligations that apply to it under applicable data protection law.

05ConfidentialityLink copied

We make sure that the persons authorized to process customer personal data have committed themselves to confidentiality or are under an appropriate statutory duty of confidentiality, and we limit access to those who need it to provide Reqursor.

06SecurityLink copied

We take appropriate technical and organizational measures to protect customer personal data, as article 32 of the GDPR requires, taking into account the state of the art, the costs, the nature, scope, context and purposes of the processing and the risk to the people concerned.

Reqursor Credits and the relay

• The relay encrypts the connection with TLS.
• The relay does not store requests or answers. It reads them in memory only for as long as it needs to check them and to count the usage.
• The relay logs only what it needs to run the service, and never a request body, a query string or a header value. Access logs are kept for at most 30 days.
• The relay does not forward your license credentials, cookies or Reqursor headers to the provider. It forwards the checked request and a short list of standard headers, and it adds our own provider credentials.
• The relay accepts only standard fields of a model request, applies request and spending limits per license, and can be switched off by us.
• Usage records carry no code or ticket text. The relay deletes delivered records 7 days after delivery. A record that our license server rejects stays on the relay, with identifiers and token counts only, until we have reviewed and deleted it.

Online stores, in early access

• Each store runs in its own isolated environment, with its own private network and storage. No store can reach another store's data, and no organization can see another organization's stores, settings or status.
• All data in transit is encrypted with TLS, with certificates for every store and custom domain issued and renewed automatically.
• Secrets such as passwords and API keys are encrypted at rest and never stored in plain text in logs or change history. Account passwords are stored as a salted hash.
• Changes are confirmed by you before they take effect, checked before they go live, recorded, and reversible to a prior state.
• Your team members have role-based access (Admin, Operator, Viewer), and multi-factor authentication where the dashboard asks for it.
• Hosting is in the EU, in data centers in Germany.

Our Security page describes our controls in more detail. We do not state controls there or here that we do not operate. We review and improve our measures as the risks and the technology change.

07Sub-processorsLink copied

You give us a general written authorization to engage sub-processors. The current list, with what each one does and where, is on our Sub-processors page. It replaces any list in this agreement.

• We will tell you at least 30 days before we add or replace a sub-processor, by email to the contacts on your license or your account and by updating the list. Keep those contact addresses up to date, because we send notices there.
• You can object to a new sub-processor on reasonable grounds relating to data protection, by email to [email protected] within 30 days of our notice. If you do not object in time, the change takes effect at the end of the notice period. We work with you in good faith to find a solution. For code, tickets and credits, we do not send customer personal data to the new sub-processor while your objection is open. For online stores, where practical, we do not send customer personal data to the new sub-processor until we have discussed your objection.
• If we cannot find a solution, for code, tickets and credits, you can ask us to change your license to a self-hosted license with your own key, which sends no model request of a ticket or run through our relay (and, if an Owner or Admin chooses your own key for the assistant, none for the assistant either). You can also end your subscription by written notice before the change takes effect, and we then refund the prepaid fees for the period after the end date. Credits you have bought stay on your balance, as the Refund, Cancellation and Credits Policy says.
• If we cannot find a solution, for online stores, you can stop using the affected part and cancel by written notice before the change takes effect, and we then refund the prepaid fees for the period after the end date, if your order provides for it.
• We have a written agreement with each sub-processor that imposes data protection obligations that meet article 28(4) of the GDPR. We remain responsible to you for what our sub-processors do.

08International transfersLink copied

We are established in the European Union. We do not transfer customer personal data to a country outside the European Economic Area, or to an international organization, unless the transfer has an appropriate safeguard under applicable data protection law. When we transfer customer personal data to a sub-processor outside the European Economic Area, for example because Anthropic may process data there, we rely on an adequacy decision of the European Commission or on the standard contractual clauses for transfers to processors (module 3).

If a competent authority or the law that applies to you requires a transfer safeguard for personal data that we return to you outside the European Economic Area, and no other safeguard applies, the parties will conclude the standard contractual clauses that fit that situation, which at the date of this agreement is module 4 (processor to controller) of Decision (EU) 2021/914. We sign them on request, and we agree with you in writing the choices that the clauses leave open before they apply. The clauses prevail over this agreement where they conflict.

09Helping youLink copied

We help you meet your obligations under the GDPR, taking into account the nature of the processing:

• Requests from data subjects. If a data subject asks us to use their rights over customer personal data (access, rectification, erasure, restriction, portability and objection), we send them to you and tell you, unless the law forbids it, and we do not answer except on your documented instructions. We help you with technical and organizational measures, as far as possible. The relay does not store prompts or answers, so we hold none there, but Anthropic may keep requests and answers for a limited time, as section 11 says. We help you with the support material we hold.
• Exporting your data from online stores. For the online store part, the Data Export feature lets you export your data in standard formats (JSON and CSV).
• Security, breaches, impact assessments and consultations. We give you the information you reasonably need for your obligations under articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultations with a supervisory authority.

10Personal data breachesLink copied

We tell you without undue delay after we become aware of a personal data breach that affects customer personal data, including a breach at a sub-processor, by email to the contacts on your license or your account. We tell you what we know about the nature of the breach, the data and the people concerned, the likely consequences and the measures we take, and we update you as we find out more. You decide whether and how to tell the supervisory authority and the people concerned. We do not tell a supervisory authority or data subjects in your name without your prior written instruction, except where the law requires it.

11Retention, deletion and returnLink copied

• Credits. The relay does not store customer personal data, so there is nothing for us to return or delete there. Our sub-processor Anthropic may keep requests and answers for a limited time under its commercial terms, and we cannot delete them earlier or return them to you. We have no zero-retention agreement with Anthropic.
• Support material. At your choice, we return or delete the support material that contains customer personal data when we no longer need it for the support request, or earlier if you ask us to.
• Online stores. We keep customer personal data in line with the retention periods in our Privacy Policy: store definitions for as long as the organization exists, deployment artifacts for 90 to 365 days depending on their type, audit logs for 365 days and AI interaction logs for 30 days. When you delete your account, a 7-day grace period starts. During it, stores keep serving traffic but team access is revoked. After the grace period the stores go offline, and all data is permanently purged within 30 days after the grace period ends. Before that, you can export your data with the Data Export feature.
• When we stop providing the services to you, or earlier on your written request, we delete or, at your choice, return the customer personal data we still hold, including the data in an instance that we host for you, and we delete existing copies, unless Union or Member State law requires us to keep them. We confirm in writing on request that we have done so.

The usage records, financial records and the other data we hold as a controller are covered by our Privacy Policy and are not customer personal data.

12Information and auditsLink copied

We give you the information you reasonably need to show that we meet this agreement and article 28 of the GDPR. We first answer your questions and security questionnaires in writing, if you send them to [email protected]. If that is not enough, you can have an audit carried out by you or an independent auditor bound by confidentiality, once a year, and also whenever a supervisory authority requires it or after a personal data breach that affects customer personal data. You give at least 30 days' notice (less where the authority requires it). The audit takes place during business hours without unreasonable disruption, it does not give access to the data of other customers, and it is at your cost.

13LiabilityLink copied

The liability limits of the Terms of Service apply to this agreement, and one limit applies to the Terms of Service and this agreement together. They do not limit the rights of data subjects against either of us under article 82 of the GDPR, or any liability that cannot be limited by law. If standard contractual clauses apply under section 8, clause 12 of those clauses prevails.

14Term, order of precedence and lawLink copied

This agreement lasts as long as we process customer personal data for you. If it conflicts with the Terms of Service, an order or a license agreement on the processing of personal data, this agreement prevails. We may update this agreement for a valid reason, such as a change in the law, and we tell you 30 days in advance, as the Terms of Service describe for changes. A change never reduces the protection that article 28 of the GDPR requires and never changes standard contractual clauses that apply.

Dutch law applies, and the District Court of Rotterdam (Rechtbank Rotterdam) has exclusive jurisdiction, as the Terms of Service state, without limiting the rights of data subjects or any mandatory jurisdiction under applicable data protection law. If a provision of this agreement is invalid or unenforceable, the other provisions remain in force, and we replace the provision with a valid one that comes closest to its intent.

15ContactLink copied

For questions about this agreement, to ask for a signed copy or to object to a sub-processor, contact us:

• Legal: [email protected]
• Privacy: [email protected]
• Security questionnaires: [email protected]
• Contact form: reqursor.com/contact
• Reqursor Technologies, Rotterdam, The Netherlands.