Data Processing Addendum

1. Roles

The Customer is the Controller of personal data it uploads to Rytain. Rytain acts as Processor and processes that data only on the Customer's documented instructions.

2. Scope and purpose

Rytain processes personal data solely to provide the Services described in the Agreement, including hosting, storage, AI generation, support and billing.

3. Sub-processors

• Cloud hosting and database (Supabase / Cloudflare).
• Payments (Razorpay).
• Email delivery (transactional email provider).
• AI providers used to generate user-requested output.

An up-to-date list is available on request. We will notify Customers of material changes with at least 30 days' notice.

4. Security

Rytain implements appropriate technical and organizational measures including encryption in transit and at rest, role-based access control, audit logging, and least-privilege staff access.

5. International transfers

Where personal data is transferred across borders, Rytain relies on appropriate safeguards (such as Standard Contractual Clauses) where required by law.

6. Data subject rights

Rytain will assist the Customer in responding to data subject requests (access, correction, deletion, portability) using available product features and support.

7. Breach notification

Rytain will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data.

8. Deletion and return

On termination, the Customer can export workspace data for 30 days. After that, personal data is deleted from active systems within 30 days and from backups within 90 days.

9. Signing the DPA

Enterprise and agency customers can request a counter-signed copy of this DPA. Use our Legal contact form or email legal@rytain.com.

10. More info

See our Privacy Policy, Terms and Cookie Policy.