Agerius Data Processing Addendum
Last updated: September 30, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between the customer identified in an Order ("Customer") and Shoon's LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA ("Agerius") for the Agerius services.
This DPA applies when Agerius processes personal data contained in Customer repositories or materials on Customer's behalf. Customer is the controller and Agerius is the processor for that processing. If Customer acts as a processor for another controller, Customer is the processor and Agerius is its subprocessor.
1. Definitions
"Applicable Data Protection Law" means privacy and data-protection law applicable to the processing, including the EU GDPR and UK GDPR where applicable.
"Customer Personal Data" means personal data contained in repositories, pull requests, policies, product materials, or instructions that Agerius processes on Customer's behalf to provide the service.
"Subprocessor" means a third party engaged by Agerius to process Customer Personal Data on Customer's behalf.
The terms controller, processor, personal data, processing, and data subject have the meanings given by Applicable Data Protection Law.
2. Processing instructions
Agerius will process Customer Personal Data only:
- to provide, secure, and support the services described in the Order;
- on Customer's documented instructions, including the Order and use of service controls;
- as described in this DPA; or
- where required by applicable law, in which case Agerius will inform Customer before processing unless the law prohibits notice.
Agerius will promptly tell Customer if, in its reasonable opinion, an instruction violates Applicable Data Protection Law.
Customer instructs Agerius to retrieve selected repository content through the GitHub App, process it transiently, transmit selected content to approved AI inference providers, and generate the contracted analysis and documents.
3. Details of processing
| Item | Description |
|---|---|
| Subject matter | Automated technical analysis of Customer's software repositories and related materials |
| Duration | The applicable Order, plus the limited deletion and backup periods stated below |
| Nature and purpose | Retrieval, transmission, automated analysis, classification, generation of findings and document drafts, support, and service security |
| Data subjects | Customer personnel, contractors, developers, users, and other individuals whose information appears in Customer materials |
| Personal data | Names, commit email addresses, usernames, identifiers, repository metadata, source-code contents, configuration, product descriptions, policy contents, and other personal data included by Customer |
| Sensitive data | Not required or intended; may be processed incidentally if Customer includes it in supplied materials |
Customer must not intentionally provide production datasets, secrets, credentials, or sensitive personal data unless expressly agreed in writing with appropriate safeguards.
4. Confidentiality and personnel
Agerius will ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only where needed.
Agerius personnel do not review Customer source code as part of normal service delivery. Human access requires Customer permission unless necessary to address a security incident or comply with law.
5. Security
Agerius will maintain measures appropriate to the nature and risk of processing, including:
- scoped GitHub App access;
- access controls for operational systems;
- transient processing rather than intentional persistent source-code storage;
- commercial API access for AI inference providers;
- filtering designed to keep customer contents and credentials out of ordinary application logs;
- prompt revocation or deletion of repository credentials when access ends; and
- procedures for handling security incidents and deletion requests.
Customer is responsible for selecting repositories, controlling installation access, removing unnecessary secrets and production data, and maintaining its own backups.
6. Subprocessors
Customer authorizes the subprocessors below for the stated purposes:
| Subprocessor | Purpose | Typical processing location |
|---|---|---|
| GitHub, Inc. | Repository hosting and GitHub App access | Global / United States |
| Fly.io, Inc. | Application infrastructure | Selected and distributed regions |
| OpenAI, L.L.C. | Automated AI inference | United States and configured regions |
| Anthropic, PBC | Automated AI inference | United States and provider infrastructure |
| Resend / Plus Five Five, Inc. | Transactional email | United States |
| Purelymail LLC | Email hosting | United States |
| PostHog, Inc. | Privacy-reduced product analytics | Configured EU hosting |
| Functional Software, Inc. (Sentry) | Error monitoring | Provider infrastructure |
Polar acts as merchant of record for checkout and processes buyer and transaction data under its own terms. It is not authorized through this DPA to receive Customer repository content.
Agerius will impose data-protection obligations on each Subprocessor that are appropriate to the services it performs. Agerius remains responsible for Subprocessor performance to the extent required by Applicable Data Protection Law.
Agerius may replace or add a Subprocessor by updating the list and giving active Customers reasonable advance notice where required. Customer may object on reasonable data-protection grounds before the new Subprocessor begins processing its data. The parties will work in good faith on a reasonable alternative. If none is reasonably available, either party may terminate the affected service, and Agerius will refund prepaid fees covering the unused terminated period.
7. AI-provider handling
Agerius will use commercial API access and will not intentionally opt Customer content into general model training.
Provider systems may retain API inputs and outputs for abuse prevention or service operation. Standard retention can be up to 30 days unless a different provider configuration or contractual control applies. Agerius will not use persistent provider features for Customer source code unless disclosed and agreed.
8. Data-subject requests
Taking into account the nature of processing, Agerius will provide reasonable assistance to Customer in responding to requests to exercise privacy rights. If Agerius receives a request relating to Customer Personal Data, it will direct the requester to Customer and notify Customer where legally permitted. Agerius will not independently respond on Customer's behalf unless instructed or legally required.
9. Security incidents
Agerius will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data. The notice will provide available information reasonably needed for Customer's legal obligations, including the nature of the incident, affected data, likely consequences, and mitigation taken or proposed.
Notification is not an admission of fault or liability. Customer is responsible for notifications to regulators and affected individuals unless applicable law assigns that duty to Agerius.
10. Assistance and compliance information
Agerius will provide reasonable information necessary to demonstrate compliance with this DPA and will assist Customer with data-protection impact assessments and regulator consultations where required, taking into account the nature of processing and information available to Agerius.
No more than once annually, unless required following an incident or by a regulator, Customer may request reasonable documentation or an audit concerning processing under this DPA. Audits must protect other customers, confidential information, and system security, and must not unreasonably disrupt operations. The requesting Customer bears reasonable external audit costs unless the audit identifies a material breach by Agerius.
11. Return and deletion
Agerius does not intentionally persist Customer source code on its own storage. Transient source content is cleared when the relevant processing completes.
Unless applicable law requires retention or Customer instructs otherwise:
- GitHub App access ends when authorization is revoked or the service terminates;
- intermediate findings are deleted within 30 days after final delivery or service termination;
- delivered reports and generated policy documents retained for support are deleted within 12 months after delivery or termination; and
- routine backups expire within approximately 5 days after deletion from active systems.
On written request, Agerius will delete or return Customer Personal Data sooner where reasonably possible, except for information required by law or reasonably necessary to establish, exercise, or defend legal claims.
AI-provider copies are deleted under the applicable provider configuration and contract, ordinarily within up to 30 days for standard commercial API processing, subject to misuse enforcement and legal requirements.
12. International transfers
Customer authorizes processing in the United States, Armenia, and the locations used by authorized Subprocessors.
Where Customer Personal Data protected by the EU GDPR is transferred to a country without an applicable adequacy decision, the parties incorporate the European Commission's 2021 Standard Contractual Clauses, Module Two where Customer is a controller and Module Three where Customer is a processor. The optional docking clause applies; the supervisory authority and governing-law selections will be those applicable to Customer where the clauses require an EU selection.
For transfers protected by the UK GDPR, the applicable EU Standard Contractual Clauses are supplemented by the then-current UK International Data Transfer Addendum. If another mandatory transfer mechanism applies, the parties will reasonably cooperate to implement it.
If this section conflicts with mandatory terms of an incorporated transfer mechanism, that mechanism controls for the transfer.
13. Customer obligations
Customer represents that:
- it has a lawful basis and all notices, rights, and permissions needed for Agerius to process Customer Personal Data under the Order;
- its instructions comply with Applicable Data Protection Law;
- it will not intentionally provide data outside the agreed scope; and
- it has assessed that the service and security measures are appropriate for its intended use.
14. Liability and precedence
Liability arising under this DPA is subject to the limitations in the Terms to the extent permitted by Applicable Data Protection Law.
If this DPA conflicts with the Terms concerning processing of Customer Personal Data, this DPA controls. An incorporated mandatory transfer mechanism controls over both for the transfer it governs.
This DPA is governed by the governing-law and dispute provisions in the Terms, except where an incorporated transfer mechanism requires otherwise.