1. Scope

This Data Processing Addendum ("DPA") is incorporated into the Terms of Service and applies when a Customer processes personal data that is subject to the GDPR, UK GDPR, CCPA, or similar privacy laws, and routes that data through ReverseMask.

2. Roles

The Customer is the Data Controller, or a Data Processor acting on behalf of its own end clients. ReverseMask is strictly an automated, stateless sub-processor and transient conduit. ReverseMask does not direct the purposes or means of processing.

3. Nature, purpose, and duration of processing

ReverseMask processes personal data for the duration of a single HTTP request, for the sole purpose of masking that data before it reaches a language model and unmasking tool-call output on return. No personal data is retained after the response is returned.

4. Zero persistent storage

ReverseMask does not store, archive, or retain Customer personal data submitted to the masking or proxy endpoints after the HTTP response. The only records kept are the aggregate counters and license metadata described in the Privacy Policy.

5. Customer responsibilities

The Customer warrants that it has all necessary legal bases, notices, and consents to (a) transmit data through ReverseMask and (b) transmit data to its chosen upstream language model providers (for example OpenAI or Anthropic). ReverseMask is not responsible for the Customer's choice of upstream provider or that provider's handling of data.

6. Sub-processors

ReverseMask uses Render (hosting and logs), Cloudflare (DNS and edge), Polar.sh (billing), and Resend (transactional email). These are listed in the Privacy Policy.

7. Data subject requests

ReverseMask will assist the Customer, as required by law, to respond to data subject requests. Because ReverseMask holds no retained personal data, the primary response is handled by the Customer and its own systems.

8. Security

Masking uses AES-256-GCM encryption held in the vault bundle, which remains in the Customer's control. ReverseMask's stateless design means there is no at-rest personal data to breach.

9. Liability and termination

Liability is governed by the Terms of Service. On termination, there is no personal data to return or delete because none was retained.