Data Processing Addendum

1.Parties and how this DPA applies

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (or other agreement) between the customer that owns a RuleFix workspace (“Customer”) and:

• Legal name: Vinkura Innovations Network Private Limited (“RuleFix”)
• Registered office: 197, Chaudhary Mohalla, Gulab Nagar, Bareilly, Uttar Pradesh 243003, India
• CIN: U63999UP2025PTC219516
• Website: rulefix.in

It applies automatically whenever RuleFix processes personal data contained in Customer Data on Customer's behalf. Customer is the Data Fiduciary (under the DPDP Act, 2023) or controller (under the GDPR); RuleFix is the Data Processor. Where Customer is itself a processor for its own client, RuleFix is a sub-processor and Customer passes on its client's instructions. If this DPA conflicts with the Terms on data protection, this DPA prevails. Customers who need a countersigned copy can request one at legal@rulefix.in.

“Customer Data” means the code, findings, code excerpts, website scan results, project details and other material submitted to the Service by or for Customer. RuleFix's handling of account data (sign-in, billing, consent records) is governed by our Privacy Policy, where RuleFix acts as an independent Data Fiduciary.

2.Details of the processing

• Subject matter

  Description

  Providing the RuleFix Service: analysing code and websites for compliance and security issues, storing findings, and suggesting fixes.

• Duration

  Description

  The term of the Agreement, plus the deletion period in section 9.

• Nature and purpose

  Description

  Receiving code by MCP, API, GitHub App or public repository URL; fetching public website pages; running rules in memory; storing findings and encrypted excerpts; generating AI fix suggestions when requested; displaying results to authorised workspace members.

• Types of personal data

  Description

  Whatever personal data appears in Customer Data — typically names, email addresses, usernames or identifiers in code, comments, configuration, commit metadata, test fixtures or web pages; and identifiers of Customer's workspace members.

• Data principals / data subjects

  Description

  Customer's personnel and contractors; individuals whose data appears in Customer's code or websites (for example Customer's end users).

• Special categories

  Description

  Not intended. Customer must not deliberately submit them (see the Acceptable Use Policy).

3.Customer's instructions

RuleFix processes Customer Data only on Customer's documented instructions. The Agreement, Customer's configuration of the Service (for example which repositories, websites and frameworks to scan, and whether to request AI fixes) and actions taken through the dashboard, API or MCP are Customer's complete instructions. RuleFix will tell Customer if it believes an instruction breaks data protection law, and may suspend the affected processing until it is clarified.

RuleFix will not sell Customer Data, use it to train AI models, or process it for its own purposes, except to create aggregated, de-identified service metrics that do not identify Customer or any individual, or where the law requires (in which case RuleFix will tell Customer first unless the law forbids it).

Customer is responsible for having a lawful basis, giving any notices and obtaining any consents needed for RuleFix to process the personal data in Customer Data, and for being authorised to scan the websites and code it submits.

4.Confidentiality of personnel

RuleFix ensures that everyone it authorises to process Customer Data is bound by confidentiality obligations, receives appropriate data-protection training, and has access only where needed to provide, secure or support the Service.

5.Security measures

RuleFix maintains reasonable security safeguards, as required by the DPDP Act and Rules and GDPR Article 32, appropriate to the risk. They currently include:

• Encryption in transit (TLS 1.2+, HSTS) and at rest (AES-256 storage and backup encryption by our hosting provider).
• Application-layer encryption of code excerpts with AES-256-GCM and a per-workspace derived key, bound to the workspace and field.
• Code submitted for scanning processed in memory and not stored; secrets redacted before any code is sent for an AI fix.
• Row-level security isolating workspaces; findings writable only by RuleFix servers; least-privilege access to production.
• API keys stored as keyed hashes; scoped, revocable and optionally expiring keys; request size and rate limits.
• An append-only, database-generated audit log of security-relevant workspace actions; access and request logging to detect misuse.
• Backups for continuity, and secure development practices with automated checks.

RuleFix may update these measures as long as the overall level of protection is not reduced. Our Security page describes our current posture, including what we do not yet claim.

6.Sub-processors

Customer gives general authorisation for RuleFix to use the sub-processors on our Sub-processors page. RuleFix will impose data-protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.

RuleFix will give at least 30 days' notice of a new or replacement sub-processor by updating that page and emailing workspace owners who ask to be notified (email privacy@rulefix.in). Customer may object on reasonable data-protection grounds within that period; we will discuss a fix in good faith, and if we can't resolve it, Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees.

7.Help with rights requests and compliance

If RuleFix receives a request from an individual about Customer Data, it will pass it to Customer without undue delay and not respond itself except to redirect them, unless Customer authorises it. Taking into account the nature of the processing, RuleFix will help Customer respond to requests to access, correct, complete, update or erase personal data, and to nominations and grievances, mainly through the Service's own tools (export, delete projects and findings, delete the workspace).

RuleFix will also give reasonable help with Customer's data protection impact assessments, consultations with regulators and breach obligations, based on the information available to it.

8.Personal data breaches

RuleFix will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, so Customer can meet its own deadlines — including the DPDP Rules' requirement to inform the Data Protection Board and affected individuals, and its detailed report within 72 hours. The notice will describe, as far as known: the nature, extent, timing and location of the breach; the data and individuals affected; likely consequences; measures taken or proposed; and a contact person. RuleFix will update Customer as more becomes known, take reasonable steps to contain the breach and prevent recurrence, and report to CERT-In where its Directions require.

Notifying Customer is not an admission of fault.

9.Deletion and return

During the term Customer can export and delete Customer Data using the Service. When the Agreement ends, Customer may export Customer Data for 30 days. After that, RuleFix deletes Customer Data from live systems within a further 30 days, and from backups as they roll off, unless the law requires RuleFix to keep it — in which case it stays protected by this DPA and is used for nothing else.

Because RuleFix keeps security logs for the period required by CERT-In and the DPDP Rules, limited log records (such as IP addresses and request metadata, never code) are deleted when that period ends.

10.Information and audits

RuleFix will make available information reasonably necessary to show compliance with this DPA — such as this document, our security documentation and answers to reasonable security questionnaires — and, once available, independent audit reports. If that isn't enough to meet a regulator's requirement, Customer may, at its own cost and with at least 30 days' notice, carry out (or appoint an independent auditor bound by confidentiality to carry out) an audit, no more than once a year unless required after a breach or by a regulator, during business hours and without access to other customers' data.

11.International transfers

RuleFix may process Customer Data in India and in the countries where its sub-processors operate, as listed on the Sub-processors page. RuleFix will comply with any restriction the Government of India notifies under the DPDP Act on transfers to particular countries.

Where the GDPR or UK GDPR applies to Customer Data and it is transferred to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) — Module Two (controller to processor) or Module Three (processor to processor), as applicable — and, for the UK, the International Data Transfer Addendum, are incorporated by reference, with the details in section 2 completing their annexes, the security measures in section 5 as Annex II, and the governing law and courts being those of Ireland for the Clauses. RuleFix will apply supplementary measures such as encryption where appropriate.

12.Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them to be limited. This DPA lasts as long as RuleFix processes Customer Data.