data processing addendum.

The customer that connects a GitHub organization to slashscore Teams is the controller. WIN GRAVITY SRL is the processor. Words such as personal data, processing, controller, processor, data subject and supervisory authority have the meaning the GDPR gives them.

The data we hold about the customer's own account holders for running their accounts is outside this addendum; we are its controller, and the privacy notice covers it.

subject matter

reading the connected GitHub organization’s history and turning it into a private map and reports

duration

while the GitHub App is installed, then deletion as below

nature and purpose

collection through the GitHub API, storage, analysis and display to the customer’s authorised users, and emailed reports to them

data subjects

members of the customer’s GitHub organization, and outside contributors who appear in the history of its connected repositories

personal data

GitHub id, login, display name and avatar URL; organization membership; commit, pull request, review and issue activity with its dates, sizes and AI agent attribution, as listed in the privacy notice

special categories

none

We process the data only on the customer's documented instructions. The terms, this addendum, and the customer's choices in the product (which repositories to connect, whom to invite, which reports to send) are those instructions. If we are ever required by law to process it otherwise, we tell the customer first unless the law forbids it. If we believe an instruction breaks data protection law, we say so.

Everyone at WIN GRAVITY SRL with access to customer data is bound to keep it confidential, and has access only as far as their work needs it.

We keep the technical and organisational measures in the annex below, appropriate to the risk as Article 32 requires. We may improve them, never weaken them.

The customer authorises the subprocessors on the subprocessor list. We bind each one to data protection terms no weaker than these, and we remain responsible for them.

Before adding or replacing one, we email owners and update the list at least 30 days ahead. A customer may object on reasonable data protection grounds within that time; if we cannot address the objection, the customer may end the agreement and is refunded any prepaid fees for the time after it ends.

Data is stored in the European Union. Where a subprocessor outside the European Economic Area processes it, the transfer relies on the European Commission's Standard Contractual Clauses or, where the recipient is certified, the EU-US Data Privacy Framework.

We help the customer answer data subject requests, and pass on any request we receive directly without answering it ourselves. Most requests can be met in the product or by removing a repository; for the rest, email us. We also give the customer the information it reasonably needs for a data protection impact assessment or a consultation with a supervisory authority.

We notify the customer without undue delay, and within 48 hours of becoming aware of a breach affecting its data. The notice says what happened, what data and how many people are affected, the likely consequences, and what we are doing about it, and we update it as we learn more.

When the GitHub App is uninstalled, we delete all of the organization's data at once. It then falls out of the database provider's backups when their restore window passes. The data comes from the customer's own GitHub organization, which keeps the original, so there is nothing to return.

On request we provide the information needed to show we meet this addendum. If that is not enough, the customer, or an auditor bound to confidentiality, may audit us once a year with 30 days' notice, during business hours, at the customer's cost, and more often after a breach or at a supervisory authority's request.

Liability under this addendum follows the terms. Where this addendum and the terms conflict on the processing of personal data, this addendum wins. Questions go to privacy@slashscore.com.

tenant isolation

every customer table carries Postgres row-level security keyed to the organization; the application’s database role can read one organization at a time and owns nothing

least privilege

the GitHub App asks for read-only permissions, and only commit history endpoints are called under Contents

minimisation

no source code, diffs, paths, commit messages, issue or pull request text, or commit emails are stored

encryption

HTTPS in transit; GitHub user tokens encrypted at rest; storage encrypted by the database provider

access

sign-in through GitHub or one-time email links, no passwords; signed, HTTP-only, host-only session cookies; roles for owner, admin and member

secrets

credentials held in the hosting provider’s encrypted environment, never in code

resilience

managed database with point-in-time restore

deletion

organization data removed in one step on uninstall