Data Processing Addendum

This addendum applies when the code you run on Ignitify handles personal data of other people.

For that data, you are the controller and Ignitify is the processor. You decide why and how the data is used. We process it on your behalf.

For the data of your account, such as the owner email address, Ignitify is a controller. That case is in the Privacy Policy.

Subject matter: running your code, and storing and returning its inputs and outputs.

Duration: as long as your account exists, until the data is deleted as in section 08.

Nature: we receive, store, build, run and return the data, and we delete it. A run receives a payload and returns a result, each limited to 10 KiB. We store your task source and built images. We read the console output of a VM when you ask for it.

Purpose: to provide the service to you.

Types of data: whatever your code and your payloads contain. We do not look at it and we do not know what it is. You decide what you send. Do not send data that the law treats as specially protected unless you have the right to do so.

Data subjects: the people the data is about, for example your customers, your users or your staff.

We process this data only on your documented instructions. Your instructions are this addendum, the terms, and what you do through the API and the command line tool.

If we think an instruction breaks the law, we tell you.

We apply these measures. They are the same as in the Privacy Policy, section 07.

Every run has its own Firecracker microVM with its own kernel. A VM never serves two customers.

Requests and queries are tied to the account of the API key.

API keys are stored as hashes. Stored secrets are encrypted with AES-256-GCM under a key for each account.

VMs can reach the public internet only. They cannot reach other VMs or the private networks of the platform.

Credentials are redacted from the request records.

We make no claim of certification and give no guarantee of a result.

You give us a general authorisation to use the sub-processors in the annex (section 10). We update the annex when the list changes.

If a person asks you to use a right over data we process for you, we help you as far as we can, with the means we have. If a person writes to us directly, we pass the request to you.

If we learn of a breach of security that affects the personal data we process for you, we tell you without undue delay, by email to the owner address of the account. We give you the facts we have, and we add more as we learn them.

During the agreement you can read your runs, results and usage through the API and the command line tool, and so take your data out.

When your account is deleted, the records are marked deleted and hidden, and the encryption key of the account is destroyed, so stored secrets cannot be recovered. At present the records are not erased from the database at the same moment, and nothing erases them later by itself. Request and audit records are removed after 180 days. See the Privacy Policy, section 04.

To have data removed from the database, write to admin@ignitify.dev.

Where the data is stored, and whether it crosses a border, is not yet described.

Missing: The country and region of the servers, and the legal ground for any transfer out of the area of the customer.

Infrastructure provider. Receives: everything the platform stores, including account data and run data. Purpose: the machines and the database. Location: not stated yet. Name: not stated yet.

GitHub Pages. Receives: the requests of visitors to the website. It does not receive account data or run data. Purpose: hosting the website. Location: not stated.

Namecheap. Receives: domain name lookups for ignitify.dev. It does not receive account data or run data. Purpose: DNS. Location: not stated.

Google. Receives: the sign-in of the people who sign in to Ignitify with a Google account. It sends us their Google account id, email address and name. It does not receive run data. Purpose: sign-in. Location: not stated.

No other sub-processor is used today.

Missing: The name and the location of the infrastructure provider. The locations of GitHub Pages, Namecheap and Google have not been confirmed either.