Data Processing Addendum

For account and submission data you provide, Extention acts as a data processor and you act as the data controller. For our own billing and audit records, Extention acts as a controller.

Object storage (AWS S3 or Cloudflare R2), managed Postgres and Redis hosting, Razorpay and PayPal for payment processing, and a transactional email provider. We notify customers before adding a new sub-processor.

Encryption of OAuth tokens at rest, signed-URL access to stored artifacts, hosted-checkout-only payment handling, webhook signature verification on every payment event, and an append-only audit log of review and payment transitions.

We notify affected customers without undue delay after becoming aware of a personal data breach, including the nature of the breach and the measures taken.