Version 3 · effective 2026-08-09 · changes from v2
Data Processing Addendum
1 · Roles
For your account data you are the controller and we are the processor. For the Reddit corpus the position is more complicated and is set out in the Reddit Content Notice; we do not pretend the distinction away.
2 · Scope and duration
We process only to provide the service, for as long as your account is open, and for the thirty-day purge window after it closes. Categories of data and of data subject are annexed.
3 · Security
Encryption in transit and at rest, least-privilege access, an append-only audit log, and the measures described on the security page. Personnel with access are under confidentiality obligations that survive their employment.
4 · Sub-processors
The current list is published and subscribable. We give thirty days' notice before adding one, with a right to object. That notice includes what the sub-processor will do and where it sits — a name alone is not enough to object to.
5 · Transfers
Adequacy where it exists, Standard Contractual Clauses as the fallback, with a transfer impact assessment on file.
6 · Breach and deletion
We notify you without undue delay and in any case within 72 hours of becoming aware. On termination we delete or return, at your choice.