Data Processing Addendum

1. Overview

This Data Processing Addendum (the “DPA”) supplements our Privacy Policy by giving you the operational detail you need to assess whether using hardiktrehan.com is appropriate for your jurisdiction and compliance needs. It covers our subprocessor list, the legal bases we rely on, how international transfers are handled, and how to exercise data-subject rights.

2. Controller / processor roles

For personal data of visitors and registered users of the Site, Nyza Creations LLC is the data controller. The subprocessors listed below are our processors (or in some cases independent controllers — Stripe and Google Analytics 4 act as independent controllers for fraud detection and aggregated analytics respectively).

For AI inputs you submit, you remain the controller of any personal data you choose to include — please don’t. The underlying AI providers act as processors with respect to those inputs.

3. Subprocessor list

The current subprocessors we use, what they do, the categories of data they receive, and where they process it. We update this list when we add or remove a subprocessor; subscribers will be notified by email of any material changes.

4. International transfers

We are based in the United States, and the majority of our subprocessors process data in the U.S. For transfers of personal data of EEA, UK, or Swiss residents out of those jurisdictions, we rely on the appropriate safeguards under Articles 44-49 of the GDPR, primarily the Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) and the UK Information Commissioner’s International Data Transfer Addendum. Where a subprocessor is certified under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension, we rely on that certification.

Several of our underlying AI model providers (DeepSeek, Moonshot, Qwen) are headquartered in China. OpenRouter typically proxies requests via U.S.-based infrastructure to those providers; if this matters for your compliance posture you should not use those specific models on the Site or assume those data flows are acceptable. The model picker in each tool tells you which provider is in use.

5. Security measures

• TLS 1.2+ for all data in transit between you and the Site.
• Firebase security rules enforce row-level access on Firestore.
• Server-side authentication checks on every billing endpoint and credit-ledger operation.
• Stripe handles all card data — it never enters our environment (PCI scope is reduced to SAQ-A).
• Secrets stored in environment variables and provider secret-managers (Google Secret Manager, GitHub Actions secrets).
• SSH access to hosting droplets restricted to key-based authentication.
• Monthly review of subprocessor SOC 2 reports / privacy attestations where available.
• Regular dependency updates and Dependabot alerts.

6. Breach notification

If we become aware of a personal-data breach that creates a risk to the rights and freedoms of individuals, we will:

• Notify the competent supervisory authority within 72 hours where required (Article 33 GDPR).
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights (Article 34 GDPR).
• Notify affected U.S. residents in line with the breach-notification statute of their state.
• Provide the nature of the breach, categories and approximate number of affected individuals, likely consequences, and measures taken or proposed to address it.

7. Data-subject rights (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, you have the following rights under the GDPR / UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure (“right to be forgotten”) — request deletion in defined circumstances.
• Restriction — request that we stop processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your supervisory authority — the list is at edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise any of these rights, email legal@hardiktrehan.com from the address on your account (or include enough information for us to verify it’s you). We respond within 30 days, extendable by 60 days in complex cases with notice.

8. California rights (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell or share.
• Access a copy of the personal information we hold.
• Request deletion subject to statutory exceptions.
• Request correction of inaccurate personal information.
• Limit use of sensitive personal information.
• Opt out of the sale or sharing of personal information.
• Not be retaliated against for exercising these rights.

We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA / CPRA. We honor the Global Privacy Control (GPC) signal as an opt-out request. To exercise California rights, email legal@hardiktrehan.com.

9. Other U.S. state privacy laws

Residents of states with comprehensive privacy laws — Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Oregon (OCPA), Texas (TDPSA), Montana (MTCDPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (INDPA), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA) and others taking effect in 2025-26 — have similar rights to access, correct, delete, and obtain a portable copy of personal information, plus opt-outs of targeted advertising, sale, and profiling. Email legal@hardiktrehan.com to exercise these rights; we respond within the timelines required by each statute.

10. Retention

See section 5 of the Privacy Policy for our retention schedule. In short: account records until you delete them; billing records for at least 7 years (tax); server logs for up to 90 days; AI inputs/outputs are not retained on our infrastructure beyond the duration of the request (the AI providers’ own retention applies separately — most offer zero-retention modes for paid API usage, which we use where available).

11. Contact

DPA questions, data-subject requests, and EU/UK representative inquiries: legal@hardiktrehan.com.