Data Processing Agreement for Customers

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person that you submit to the Services.
"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
"Services" means the Brazilnut predictive analytics platform and related services.
"Subprocessor" means any third party engaged by Brazilnut to process Personal Data.

2. Scope and Purpose

Brazilnut processes Personal Data solely for providing the Services, including:

Storing and managing your uploaded datasets
Training machine learning models on your data
Generating predictions and analytics
Providing platform functionality and support

3. Our Commitments

Brazilnut agrees to:

Process Personal Data only on your documented instructions
Ensure authorized personnel are bound by confidentiality obligations
Implement appropriate technical and organizational security measures
Notify you of any Personal Data breach without undue delay
Delete or return Personal Data upon termination of services
Assist with data subject rights requests (access, rectification, erasure)

4. Security Measures

Measure	Implementation
Encryption in transit	TLS 1.3 for all data transmission
Encryption at rest	AES-256 for stored files
Credential encryption	Fernet symmetric encryption
Authentication	Passwordless: single-use email codes (hashed at rest) and Google OAuth; no passwords stored
Access logging	Comprehensive audit trail
Tenant isolation	Logical separation via tenant_id

5. Subprocessors

We use the following subprocessors to deliver our Services:

Subprocessor	Purpose	Security
Render.com	Application hosting	SOC 2 Type II certified
Cloudflare R2	Object storage	SOC 2, ISO 27001 certified
PostgreSQL (Render)	Database	Encrypted connections

6. Data Retention and Deletion

Active Data: Retained while your account is active
Post-Termination: 30 days to export, then permanently deleted
On-Demand: Request deletion at any time via security@brazilnut.ai
Cascade: Deletion includes all models, predictions, and files

7. Breach Notification

If we become aware of a Personal Data breach, we will notify you without undue delay and provide: the nature of the breach, categories of data affected, likely consequences, and remediation steps taken.

8. Data Transfers

Personal Data may be transferred to and processed in the United States. For transfers outside the EEA, we rely on Standard Contractual Clauses where applicable and our subprocessors' compliance certifications.

9. Contact

For DPA-related inquiries or to request a signed copy, contact us at security@brazilnut.ai