Data Processing Addendum
Resolute Labs, Inc. · Effective date: October 23, 2026
This Data Processing Addendum (including its Schedules, this “DPA”) forms part of the Resolute Terms of Service or other written agreement for the Services between Resolute Labs, Inc., a Delaware corporation (“Resolute”), and the customer that has accepted that agreement (“Customer”). This DPA is incorporated into the Terms of Service by reference and applies automatically, without separate acceptance or signature, to every Organization Customer and to any other Customer on whose behalf Resolute processes Personal Data of other people. It takes effect when Customer accepts the Terms of Service or first connects a data source, whichever is earlier, and governs the Customer Personal Data described below. Customer may request a countersigned copy under Section 15.
The agreement into which this DPA is incorporated is the “Services Agreement.” A person using another entity’s workspace without authority to bind that entity cannot accept or execute this DPA on its behalf. For an individual acting solely for personal purposes, this DPA applies only insofar as that person is legally capable of acting as a controller for covered processing. Schedule 1 describes the processing; Schedule 2 the security measures and scope limitations; Schedule 3 the subprocessor and integration inventory; Schedule 4 the international transfer terms.
1. Definitions and interpretation
1.1 “Applicable Data Protection Law” means privacy, personal-data-protection, and information-security laws applicable to the relevant party and processing activity, including, only if and to the extent applicable, the California Consumer Privacy Act as amended (CCPA), other applicable U.S. state comprehensive privacy laws, Regulation (EU) 2016/679 (EU GDPR), and UK GDPR. Mere accessibility of the Services from a jurisdiction does not, by itself, establish applicability.
1.2 “Customer Personal Data” means Personal Data that Resolute processes on behalf of Customer in providing Customer-directed Services as specified in Schedule 1. It includes personal data in connected issue-tracker content, customer-supplied AI prompts, relevant AI outputs, saved derived configurations, and related material when such information relates to an identifiable person and is processed on Customer’s behalf. It does not, merely because a person also uses Customer’s workspace, automatically encompass Resolute’s independent-controller processing of marketing, account administration, security of its own business, customer relationship, or merchant-of-record transaction data; actual roles depend on the particular use and law.
1.3 “Personal Data,” “processing,” “controller,” “processor,” “service provider,” “contractor,” “business,” “sell,” and “share” have their statutory meanings where the relevant law applies; otherwise Personal Data means information relating to an identified or reasonably identifiable natural person. “Subprocessor” means a third party engaged by Resolute to process Customer Personal Data for Resolute in performance of Customer-directed Services, and excludes an independent controller or a third-party tracker selected and controlled by Customer unless that party separately qualifies as a Resolute subprocessor for a specific activity.
1.4 “Personal Data Breach” means a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Resolute or its Subprocessors, insofar as that concept is required by Applicable Data Protection Law. For other processing, it means an actual unauthorized access to, acquisition of, or disclosure of Customer Personal Data in systems for which Resolute or its Subprocessors are responsible. Unsuccessful attempts without compromise and events solely affecting an independent Customer-selected tracker are not, without more, Personal Data Breaches of Resolute.
1.5 “Documented Instructions” comprise this DPA, Schedule 1, the applicable order and agreed Services configurations, Customer’s authorized requests and commands transmitted through the Services or API/MCP, and supplementary written lawful instructions acknowledged by Resolute. No instruction authorizes activity prohibited by law. “Business Day” means a weekday other than a public holiday in California.
2. Roles; scope; Customer responsibilities
2.1 For Customer Personal Data, Customer is controller (or a processor lawfully instructing Resolute for its controller) and Resolute is processor or service provider, as applicable. Where Customer is itself a processor, Customer warrants that its instructions and appointment of Resolute are authorized by the relevant controller; this DPA does not itself bind that upstream controller.
2.2 The parties acknowledge that Resolute may process other Personal Data in an independent role, such as public-site visitors and waitlist records, its direct account/business relationship administration, independent security and billing records, and Paddle’s merchant-of-record transactions, subject to the actual allocation of purposes and means. This DPA does not reclassify such processing or relieve either party of separate legal duties. If a particular account, invitation, organization, telemetry, or billing record is processed on Customer’s behalf rather than for independent purposes, it remains Customer Personal Data notwithstanding its technical location.
2.3 Customer determines and must provide lawful bases, required notices and consents, and valid authority for the source systems, Personal Data and processing it directs. Customer remains responsible for its connected tracker’s permissions, configurations, classifications and backup/source records, and for access granted to its members, agents, administrators and external AI agents. The Services may access, edit, or delete records in connected systems within granted permissions. Human in-app confirmation controls do not apply universally to independent API/MCP calls; credentials used by Customer-authorized external agents may enable actions without another in-app approval.
2.4 Customer shall not intentionally submit payment-card account numbers, protected health information subject to HIPAA, or other specially regulated or sensitive data requiring controls beyond Schedule 2 without prior written agreement covering the relevant legal and security obligations. This provision does not remove obligations imposed by law for incidental Personal Data actually received, nor represent that Customer Personal Data cannot contain information about minors. Customer must evaluate age-specific and sensitive-data requirements of its own processing.
3. Instructions; California-specific restrictions
3.1 Resolute shall process Customer Personal Data only on Documented Instructions, including to provide, host transiently, transmit, visualize, organize and analyze connected tracker data, store user-selected views/settings, provide user-requested AI inference, execute authorized tracker write-backs, authenticate customer-directed access where applicable, provide customer support and troubleshooting, protect the Services, and meet obligations imposed by law, all as more specifically stated in Schedule 1. If legally required to process without instructions, Resolute will inform Customer before processing unless prohibited by law.
3.2 Resolute shall promptly inform Customer if, in its reasonable opinion, a documented instruction infringes Applicable Data Protection Law, except where prohibited by law, and may suspend the affected instruction pending clarification. Resolute has no duty to independently classify every item inside Customer’s trackers, but this does not excuse mandatory processor duties.
3.3 To the extent Resolute acts as a CCPA service provider or contractor with respect to Customer Personal Data, Customer discloses such data only for the specific business purposes in Schedule 1. Resolute shall not sell or share that information, retain, use, or disclose it outside the limited and specified purposes, for a different commercial purpose, or outside the direct business relationship, except as expressly permitted by the CCPA and regulations. Resolute shall not combine it with Personal Data from other customers, its direct interactions or third parties except where the CCPA permits such combining. Resolute shall comply with applicable CCPA requirements and afford the same level of privacy protection required of covered businesses for those data.
3.4 Resolute will not use Customer Personal Data to train its own general-purpose AI or machine-learning models, for targeted advertising, or to construct cross-customer identifiable profiles. Processing of prompts and relevant outputs by an AI inference Subprocessor must be limited by the written arrangement required under Section 6 and applicable law. Resolute uses, or has requested, zero data retention terms with its AI inference Subprocessor. Under those terms, the Subprocessor does not store prompts or responses at rest after the API response is returned, subject to the Subprocessor’s eligibility rules for models and features and to its retention of content flagged by its safety systems or legally required to be held.
3.5 Resolute may create and use aggregate or deidentified information only to the extent derived and maintained in conformity with Applicable Data Protection Law (including restrictions on reidentification, use and disclosure where legally prescribed), and may not use this permission as a substitute for an authorization required for Customer Personal Data. Any separate controller use must have an independent lawful basis.
3.6 To the extent Resolute acts as a processor under the comprehensive privacy laws of other U.S. states (including the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Texas Data Privacy and Security Act, and similar laws), Resolute shall: process Customer Personal Data only on Customer’s documented instructions and for the purposes in Schedule 1; ensure that each person processing it is subject to a duty of confidentiality; delete or return Customer Personal Data at the end of the Services as provided in Section 8; make available to Customer the information necessary to demonstrate compliance; allow and cooperate with reasonable assessments under Section 9; and engage Subprocessors only under a written contract meeting the requirements of Section 6.
4. Personnel confidentiality; security
4.1 Resolute will limit access to Customer Personal Data to persons with a legitimate need for the Services and bind those persons to confidentiality commitments or an appropriate legal duty. Access will be subject to reasonably appropriate controls.
4.2 Resolute shall implement and maintain technical and organizational measures appropriate to the risks of processing Customer Personal Data and applicable security requirements, taking into account the state of the art, implementation cost, processing context, scope and purpose, and risk to individuals. Schedule 2 describes the measures in place as of the Effective Date.
4.3 Resolute may update security measures to reflect technology or risks without materially reducing the overall level of protection required by Applicable Data Protection Law. If a change materially impairs an agreed protective measure, Resolute will notify affected Customer as required by law and cooperate in proportionate remediation.
5. Personal Data Breach
5.1 Resolute shall notify Customer without undue delay after becoming aware of a Personal Data Breach. The obligation is triggered by the applicable legal definition and level of awareness; Resolute will not defer a legally required notice until all investigative facts are confirmed. Notice will be sent to Customer’s account security/contact email or another designated security address, subject to legal restrictions.
5.2 To the extent reasonably available, notice shall describe the nature and approximate scope of the Personal Data Breach, relevant categories of affected information and individuals, measures taken or planned, and a contact for follow-up. Resolute may provide information in phases as it becomes reasonably available and will take reasonable steps to investigate, contain, and mitigate the event consistent with its actual capabilities and legal duties.
5.3 Customer controls required notice to individuals and regulators to the extent law assigns that role to Customer. Resolute will provide assistance reasonably needed for those obligations under Section 7. No notice is an admission of fault; this DPA does not create an automatic duty to pay monitoring, public relations, forensic, regulatory or other third-party costs beyond the Services Agreement and nonwaivable law.
6. Subprocessors and third parties
6.1 Customer grants general written authorization to Resolute’s current Subprocessors identified in Schedule 3 for their stated roles, subject to required contractual protections. Resolute may appoint other Subprocessors to support the Services, provided it gives Customer advance written notice of a material addition or replacement where required by Applicable Data Protection Law, including a reasonable opportunity to object before the new Subprocessor processes Customer Personal Data. Notification may be delivered by customer email or an account notice capable of being retained; a static list alone is not sufficient where advance notice is mandatory.
6.2 Customer may object in writing on reasonable, documented data-protection grounds within fifteen (15) calendar days after notice (or any longer minimum required by law). Resolute will consider reasonable mitigation, an alternative or a supported technical limitation. If no reasonable resolution is available and law requires an objection remedy, either party may terminate the affected Services on written notice, with any prepaid-fee remedy governed by the Services Agreement and nonwaivable law. The parties will not treat silence as authorization where affirmative consent is mandatory.
6.3 Resolute shall bind each Subprocessor by written terms imposing data-protection obligations appropriate to its services and no less protective of Customer Personal Data than the obligations applicable to Resolute to the extent required by Applicable Data Protection Law. Resolute remains responsible to Customer for a Subprocessor’s performance of delegated data-protection obligations as required by law. No separate right to direct an independent Customer-selected tracker or its actions is conferred.
6.4 The classification and data categories in Schedule 3 are activity-specific. Paddle, as merchant of record for its own direct sale and payment functions, is not automatically a processor of Customer Personal Data under this DPA. Customer-authorized Linear, Jira, Shortcut and GitHub accounts are not treated as Resolute Subprocessors merely because Customer elects to connect them. Where the facts show a particular different role, the parties will comply with the actual legal relationship.
7. Individual requests; regulatory assistance
7.1 Considering the nature of processing, the data available to Resolute and its actual functionality, Resolute shall provide reasonable assistance, including appropriate technical and organizational measures where possible, to enable Customer to respond to legally valid requests for access, correction, deletion, portability, restriction, objection and other applicable rights. Customer remains responsible for verifying requester identity, deciding legal exemptions and communicating its response unless law allocates a different duty.
7.2 Resolute will, where feasible and lawful, refer a direct request relating to Customer Personal Data to Customer rather than independently determine its merits; this does not limit Resolute’s separate duties for data it processes as controller. Customer should specify the relevant account, tracker and records to support manual handling. The absence of self-service deletion is not a contractual waiver of a legal erasure duty.
7.3 Taking into account the nature of processing and information available, Resolute shall reasonably assist Customer with legally required security assessments, data-protection impact assessments, consultation with regulators, and breach notifications. Requests beyond ordinary product functionality may be subject to a reasonable, pre-disclosed cost allocation insofar as legally permitted; no fee conditions a mandatory right that law requires to be free.
8. Return, deletion, retention; exit assistance
8.1 During the Services term, Customer generally retains and controls source tracker records in its chosen third-party systems. Resolute’s core tracker API processing is transient, but certain saved configurations, AI-related results, agent activity records, identity/connection records, logs and other information may persist as described in Schedules 1 and 2. Browser localStorage drafts remain on devices controlled by the user; deleting an account at Resolute does not remotely erase data from those devices or from Customer’s independent trackers.
8.2 At the end of covered Services, or on an earlier lawful written instruction, Resolute shall, at Customer’s choice, return or delete Customer Personal Data within a reasonable period consistent with the nature of the information and applicable law, and shall delete existing copies unless retention is required by applicable law. Where electronic return in a commonly used format is technically feasible for retained Customer Personal Data, Resolute will facilitate it reasonably; this does not promise a bulk export of records that remain only in Customer’s source tracker. Customer may direct deletion without return.
8.3 A lawfully retained copy shall remain subject to confidentiality, security and purpose limitations, shall not be used for active Services processing, and shall be removed when the legal retention requirement ends. Where limited residual technical copies cannot immediately be removed, Resolute must restrict their access and use and delete them in accordance with legally permissible secure disposition practices; this sentence does not create a blanket exception to mandatory erasure. Resolute shall reasonably document completion or explain a legally permitted impediment when requested.
8.4 Resolute completes deletion and return requests within thirty (30) days of a valid request and retains Customer Personal Data no longer than the periods stated in Schedule 1. Closing an account, removing a member, disconnecting a tracker, and revoking separately issued API/MCP tokens are different actions; the parties must specifically address any remaining credentials to prevent unintended access.
9. Compliance information; verification and audits
9.1 Upon a reasonable written request, Resolute will make available information within its possession or control necessary to demonstrate compliance with applicable processor-contract obligations, subject to protection of security-sensitive material, third-party confidentiality and other customers’ information. Existing documented controls, questionnaires and relevant independent assessment materials, if available, may be supplied as the initial method of verification.
9.2 Where Applicable Data Protection Law provides a controller with reasonable assessments, audits, inspections, testing or verification rights, Resolute will allow and cooperate with those rights, including a qualified independent assessor where an applicable law permits that alternative. Scope, timing, confidentiality, personnel and access arrangements will be reasonable and proportionate, designed to avoid compromising other customers, security or the Services. The parties will first consider less intrusive evidence where sufficient, but shall not impose a categorical bar on on-site or technical review required by law.
9.3 If Customer identifies a material breach or impermissible use, Resolute will reasonably cooperate with lawful corrective measures. Where the CCPA applies, Customer may take reasonable and appropriate steps to confirm consistent use and, after notice, stop and remediate unauthorized use; Resolute shall notify Customer if it determines that it can no longer meet its applicable CCPA obligations. Any audit expense allocation applies only to the extent law allows.
10. International processing and transfers
10.1 Resolute processes Customer Personal Data in the United States using the Subprocessors and locations identified in Schedule 3. Resolute does not currently offer EU or UK data residency.
10.2 Where Applicable Data Protection Law restricts the transfer of Customer Personal Data to Resolute in the United States (a “Restricted Transfer”), the parties agree as follows. (a) For transfers subject to the EU GDPR, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (the “EU SCCs”) are incorporated into this DPA by reference, with Module Two (controller to processor) applying where Customer is a controller and Module Three (processor to processor) applying where Customer is a processor, completed as set out in Schedule 4. (b) For transfers subject to the UK GDPR, the EU SCCs as incorporated under (a) apply as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the “UK Addendum”), completed as set out in Schedule 4. (c) For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with the modifications set out in Schedule 4. Customer’s acceptance of the Services Agreement constitutes its execution of the EU SCCs and the UK Addendum as data exporter, and Resolute’s offering of this DPA constitutes its execution of them as data importer.
10.3 If a Restricted Transfer cannot lawfully be made under Section 10.2, Resolute may suspend the affected processing until a lawful transfer mechanism is in place, and the parties will cooperate in good faith to establish one. On request, Resolute will provide Customer with a countersigned copy of the EU SCCs and the UK Addendum as completed under Schedule 4.
11. Government requests; conflicts
11.1 Each party will respond to binding government process directed to it as legally required. Where legally permitted and appropriate for Customer Personal Data, Resolute will provide notice of compelled disclosure and seek to limit disclosure to what is legally required.
11.2 The parties will cooperate to address material conflicts between legal obligations and documented instructions. Neither party must violate Applicable Data Protection Law as a condition of performance.
12. Liability; indemnification; remedies
12.1 Except where nonwaivable Applicable Data Protection Law or a valid mandatory transfer instrument provides otherwise, the limitations of liability, disclaimers, indemnification provisions, dispute-resolution provisions and payment remedies of the Services Agreement apply to this DPA and to all claims arising from it, and claims are aggregated under the same cap; this DPA does not establish a separate or additional liability cap or uncapped security/privacy indemnity.
12.2 No limitation applies to a liability or remedy that applicable law makes nonwaivable. Nothing in this DPA limits regulators’ powers or third-party rights arising under binding mandatory transfer clauses.
13. Order of precedence; relationship to Services Agreement
13.1 If the provisions directly conflict, a mandatory applicable law or valid mandatory international-transfer clause controls to the extent required; next this DPA controls solely concerning processing of Customer Personal Data; then the Services Agreement controls other matters. This DPA does not override customer orders on pricing, duration or product entitlement, nor expand the license to Customer Content beyond uses permitted by the Services Agreement and applicable law.
13.2 To avoid duplicated remedies, Sections 12 and 13 of this DPA preserve the Services Agreement's otherwise enforceable financial and dispute provisions. The Privacy Policy describes factual practices but does not independently create broader processing rights or displace mandatory DPA duties. AI features, agent access, customer authorization and commercial risk allocations are governed by the Services Agreement, subject to this DPA's priority for covered Customer Personal Data and nonwaivable law.
14. Term; changes; cooperation
14.1 This DPA remains effective for so long as Resolute processes Customer Personal Data under the Services Agreement and for retained data to the extent its obligations necessarily survive. A change to this DPA that materially affects Customer’s rights must be agreed through a legally effective amendment or assent process; a website update alone is not treated as consent where written authorization is required.
14.2 If a court or regulator determines that a provision is invalid, it will be limited only as necessary and the remaining DPA survives. The parties shall cooperate in good faith to amend processing obligations when materially required by changed law without silently expanding processing purposes.
15. Notices and execution
15.1 Customer notices under this DPA, including security-related requests and Subprocessor objections, may be sent to Resolute at steven@resolute.fyi unless a different address is designated in an agreed order. Resolute will send notices to the account’s designated Customer contact unless formally changed. Urgent security notices should also use any operational security channel communicated by Resolute.
15.2 Customer accepts this DPA by accepting the Services Agreement, and no separate signature is required. On request, the parties may also sign this DPA, including the EU SCCs and the UK Addendum as completed under Schedule 4, by electronic or other valid signature using the signature block below. Signature confirms, and is not a condition of, the application of this DPA.
| Customer | Resolute Labs, Inc. | |
|---|---|---|
| Legal name | [Legal name of contracting Customer] | Resolute Labs, Inc. |
| Address | [Customer business address] | Available on request |
| Signature | ||
| Name | ||
| Title | ||
| Date |
SCHEDULE 1: PROCESSING DESCRIPTION
This schedule is the parties’ processing specification and describes the limited and specific business purposes for California service-provider requirements when applicable. Particular fields depend on Customer-enabled features and connected permissions; this schedule does not authorize unrelated use.
| Item | Description |
|---|---|
| Subject matter | Processing of Customer-directed third-party issue-tracker content, derived customer workspace configurations, user-submitted AI inputs, relevant outputs and related Customer Personal Data to provide Resolute graph-engineering, visualization, integrations and AI features. |
| Duration | From activation of the applicable Customer account/integration through the Services term, plus limited processing for completion of deletion/return and retention only as required or permitted by applicable law under Section 8. |
| Nature and operations | Collection/retrieval on request; access, reading, organization, structuring, visualization, short-lived caching, analysis, transmission to authorized vendor for inference, production of AI-generated outputs, saved settings/views and authorized edits or write-backs to customer-selected trackers; customer support and necessary troubleshooting/security processing. |
| Specific permitted purposes | (1) Retrieve and visualize tickets, relationships, projects and work dependencies from systems Customer connects; (2) compute requested blocker, estimate and graph analyses; (3) deliver AI inference Customer invokes; (4) execute Customer-authorized ticket/metadata/comment/relationship changes through the selected integration or API/MCP; (5) persist saved views, filters, display and graph settings; (6) supply customer-related support, fault diagnosis, abuse prevention and protection of the Services, where consistent with law. |
| Data subjects | Customer personnel and authorized users in their controller capacity; issue-tracker assignees, authors, commenters, mentioned persons, project participants and other individuals referenced in Customer Content; invitees and organization members only insofar as their information is processed on Customer’s behalf. |
| Personal Data types | Issue titles, descriptions, comments and free text; user/assignee names, handles, email or usernames if present, identifiers, status, priority, estimates, due dates, labels, dependency/issue metadata, project and milestone associations, linked pull-request metadata; AI prompts and generated descriptions/explanations where identifiable; agent activity reported through the MCP interface (issue identifiers and keys, branch names, pull-request links, agent progress text and questions, and users' answers); customer-directed workspace configurations and relevant diagnostic metadata. |
| Processing locations | United States for Render, Neon, WorkOS, Anthropic and PostHog. Paddle, as merchant of record for its own functions, processes billing data in the United Kingdom and the United States. Transfers are governed by Section 10. |
| Storage/retention characteristics | Third-party tracker records are fetched live and are not stored in Resolute’s application database; they exist in server memory for the duration of a request and in a browser memory cache for approximately five (5) minutes. AI run inputs are held in server memory for the duration of the run. Agent activity reported through the MCP interface, which references tracker issues and may contain text about them, is stored in the database and visible only to the reporting user. Saved views, settings, daily activity records and agent activity persist in the database until the account is deleted. Application logs, error records and analytics events are retained for a limited period as needed to operate, troubleshoot and secure the Services. Billing records are retained seven (7) years. Drafts saved in a user’s browser remain under the user’s control. Deletion requests are completed within thirty (30) days under Section 8. |
| Customer rights and duties | Control source systems and integration scopes; issue authorized instructions; manage users and agents; verify legality and disclosures; direct return/deletion and exercise rights/verification under this DPA. |
| Resolute obligations | Process according to DPA and lawful instructions, maintain appropriate security/confidentiality, use lawful Subprocessors and assist rights/breach/assessment requests; return/delete covered data where required. |
SCHEDULE 2: TECHNICAL AND ORGANIZATIONAL MEASURES
This schedule describes the measures in place as of the Effective Date. Resolute may update them under Section 4 without reducing the overall level of protection.
| Domain | Service measures and boundaries |
|---|---|
| Authentication and access | WorkOS-hosted authentication; sealed session cookie httpOnly, secure, SameSite=Lax with seven (7) day duration; organization membership/roles and access management through WorkOS/Neon. Customer administrators control members and connected systems. |
| Encrypted transport and storage | The Services use HTTPS for network transmission and database encryption at rest. |
| Integration secrets | Tracker OAuth/API credentials are maintained in WorkOS Vault; Neon holds connection pointers and metadata. Disconnecting an integration is designed to remove the Vault secret and related connection row. |
| API/MCP credentials | External agent bearer tokens are issued individually by Resolute on request; only SHA-256 hashes of tokens are stored. MCP tokens can authorize tracker read/write within token-owner permissions. Tokens are revoked on request and are not tied to workspace membership. |
| Data minimization and transient flows | Issue-tracker content generally passed browser → Resolute/Render API → source tracker and processed transiently, not stored as whole issue records in Neon. Browser memory cache has freshness period of approximately five (5) minutes. AI inputs are held in server memory for the duration of the run; some derived settings, selected results, agent activity records and local-browser drafts persist. |
| AI inference segregation | Inference requests originate from backend to Anthropic; PostHog receives AI usage metadata such as model, duration, token counts and run ID, not prompt text. Anthropic processes inference requests under the zero data retention terms described in Section 3.4. |
| Logs and monitoring | Application logs and errors sent by OpenTelemetry to PostHog; may include request/user identifiers, procedure names, errors and sometimes IP addresses. Render maintains platform-level request logs. Operational logging is separate from optional product analytics and is retained for a limited period. |
| Customer/device side | User-browser localStorage may retain Spec → Graph drafts containing issue text. These drafts are under the user’s control and can be cleared through the browser. Customer-selected trackers and Customer devices are not covered by Resolute’s technical controls except as law otherwise requires. |
| Incident response / continuity | Application and error logging with alerting through PostHog, and Personal Data Breach notification without undue delay under Section 5. |
| Audit / certifications | Compliance information and verification rights are provided under Section 9. |
| Retention / deletion | Retention periods as stated in Schedule 1; deletion and return requests completed within thirty (30) days under Section 8. |
Shared responsibility: Customer is responsible for permissions and content in independent trackers, appropriate credentials/agent scopes, identity authorization, reviewing AI outputs and any authorized write-backs, and maintaining source records. Resolute remains responsible for safeguards legally required for Customer Personal Data in its own systems and those of its Subprocessors.
SCHEDULE 3: SUBPROCESSORS AND EXTERNAL SERVICES
The following providers support the Services as of October 2026. Inclusion is limited to each vendor’s activity as a Subprocessor of Customer Personal Data; not every item of data that vendor handles is covered by this DPA. The list may be updated through the notification and objection process in Section 6.
| Vendor | Relevant service and covered data | Reported location/status |
|---|---|---|
| Render Services, Inc. | Application hosting/API transmission; customer tracker data in transit, account/session data and platform request logs as applicable. | United States; active |
| Neon, Inc. | Managed database for saved configurations or other customer-controlled workspace records containing Personal Data, where applicable; also independent account/business records. | United States; active |
| WorkOS, Inc. | Authentication, organization membership, invitation and Vault functions; customer-directed member identities/connection credentials where on Customer’s behalf. | United States; active |
| Anthropic, PBC | User-invoked AI inference using selected tracker content and prompts, possibly identifiable outputs. Processed under the zero data retention terms described in Section 3.4. | United States as described; active |
| PostHog, Inc. | Analytics, flags, logging and error tracking; Customer Personal Data only when appearing in service diagnostic or customer-directed telemetry. | United States (US Cloud); active |
Not designated as Resolute Subprocessors solely by these functions
Paddle.com Market Limited: currently integrated but not live; intended merchant of record for direct checkout, tax, payment processing, invoicing and refunds. Its role for a given operation depends on the actual allocation of purposes and means. Customer-directed integrations: Linear Orbit, Inc.; Atlassian Jira Cloud; Shortcut Software Co.; GitHub, Inc. (Microsoft). Customer directly authorizes accounts and their permissions; GitHub currently reports pull-request status display only. An actual change in processing relationship will be addressed under applicable law.
Change notification and objection
Advance notice of a material new or replacement Subprocessor must be given as required by Section 6 before relevant processing, with the legally required opportunity to object. Resolute shall maintain a current list available to Customers. Contact for objections: steven@resolute.fyi.
SCHEDULE 4: INTERNATIONAL TRANSFER TERMS
A. EU SCCs. The EU SCCs are incorporated under Section 10.2(a) with the following selections: Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general written authorization) applies with a notice period of fifteen (15) days, consistent with Section 6; the optional language in Clause 11(a) does not apply; under Clause 13 and Annex I.C, the competent supervisory authority is the authority of the EU member state in which Customer or its EU representative is established or, where Customer is not established in the EU, the authority of the member state in which the data subjects are located; under Clause 17, Option 1 applies and the governing law is the law of Ireland; and under Clause 18(b), the courts of Ireland have jurisdiction. Where Module Three applies, Customer warrants that its controller has authorized the appointment of Resolute.
B. Annexes. Annex I.A (list of parties): the data exporter is Customer, identified by the legal name, address, and contact details in its Resolute account, acting as controller (Module Two) or processor (Module Three); the data importer is Resolute Labs, Inc., postal address available on request, contact steven@resolute.fyi, acting as processor. Annex I.B (description of transfer): Schedule 1. Annex I.C (competent supervisory authority): as stated in paragraph A. Annex II (technical and organizational measures): Schedule 2. Annex III (list of subprocessors): Schedule 3.
C. UK Addendum. The UK Addendum is incorporated under Section 10.2(b) with the following selections: Table 1 (parties) is completed with the information in paragraph B; Table 2 (selected SCCs, modules and selected clauses) refers to the EU SCCs as incorporated under paragraph A; Table 3 (appendix information) refers to Schedules 1, 2 and 3; and under Table 4, neither party may end the UK Addendum as set out in Section 19 of the UK Addendum.
D. Switzerland. For transfers subject to the Swiss Federal Act on Data Protection (“FADP”), the EU SCCs apply with these modifications: references to the GDPR are read as references to the FADP; the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner; and, for transfers governed exclusively by the FADP, the governing law and courts under Clauses 17 and 18 are those of Switzerland.
E. Transfer impact assessment; precedence. On request, Resolute will provide reasonable information to support Customer’s transfer impact assessment. If the EU SCCs or the UK Addendum conflict with this DPA or the Services Agreement, the EU SCCs or the UK Addendum control to the extent of the conflict for the Restricted Transfer concerned.