Data Processing Addendum

Last updated: 13 June 2026

This Addendum forms part of the Terms of Service between the customer (“Controller”) and Pauhu AI Ltd (“Processor”) and applies where the Processor processes personal data on the Controller’s behalf under Article 28 GDPR.

1. Subject Matter and Duration

Subject matter: provision of the Pauhu Fusion Compiler. Duration: the term of the subscription, plus the retention periods in the Privacy Policy.

2. Nature, Purpose and Data

• Nature/purpose: composing code in response to the Controller’s bounded requests and operating the subscription.
• Categories of data subjects: the Controller’s authorised users.
• Categories of data: account identifiers, request payloads as submitted by the Controller, usage receipts, truncated IP addresses. The Controller controls what its requests contain and should avoid including personal or sensitive data it does not need to.

3. Processor Obligations

• process personal data only on documented instructions from the Controller;
• ensure persons authorised to process are bound by confidentiality;
• implement appropriate technical and organisational measures (Art. 32);
• assist the Controller with data-subject requests and with Articles 32–36, as far as reasonable;
• on termination, delete or return personal data, save where retention is required by law.

4. Sub-processors

We will give notice of intended changes to sub-processors and allow the Controller to object on reasonable data-protection grounds.

5. International Transfers

Composition is performed in the EU. The only transfer to a third country is to Stripe (USA) for payment, relying on the EU Standard Contractual Clauses and Stripe’s EU–US Data Privacy Framework certification.

6. Audit

We make available information necessary to demonstrate compliance with Article 28 and will contribute to audits on reasonable notice, subject to confidentiality and the security of other customers.