Data Processing Addendum

Scope and roles

This Addendum applies when Rika Labs processes personal data in customer app data, organization data, logs or other content on a customer’s behalf. The customer is the controller or equivalent business deciding why and how that data is processed. Rika Labs is the processor or service provider and processes it only to provide, secure and support Akter Cloud, follow documented instructions, meter and bill the service, and comply with law.

Customer runtime data includes the action log, checkpoints, pages, index and retained history in one Akter-created S3-compatible store bucket per environment incarnation. Tigris is the storage provider; customers do not supply a runtime database or bucket. Account, authentication, billing and other control-plane records, and Alchemy infrastructure state, remain on PlanetScale. The control plane runs on Akter 0.1 and holds no customer runtime data. Jobs may still use customer variables to call external services. Depending on the application, runtime content may include data about its end users; customers determine the categories.

Usage records include committed actions, stored data, retained history, compute unit-hours and job-attempt seconds. Job seconds are shown but not billed; views, reads and watches are not metered. Account processing and any independent legal obligations are subject to the applicable agreement and law.

Customer instructions

The customer is responsible for its notices, lawful basis, instructions, permissions and responses to data-subject requests. The customer must not submit data it is not authorized to process.

Security and confidentiality

The service uses account access controls, transport security and encryption for customer environment variables at rest in the control-plane database. Personnel access and confidentiality obligations are subject to the applicable agreement and law. Stores are separate per environment incarnation, not bucket prefixes. Runner storage access is restricted to its environment’s bucket, and platform storage credentials are kept out of customer-variable listings and builders. This page makes no particular credential-lifetime, provider-encryption or certification guarantee.

Risk-appropriate security measures and notification of a confirmed personal-data breach are subject to applicable law and the customer’s agreed data-processing terms. Contact security@akter.dev for security incidents.

Subprocessors

The providers and purposes are listed on the Subprocessors page, including Tigris for customer runtime storage and PlanetScale for control-plane records. Authorization, contractual obligations, responsibility and change notice are subject to the applicable agreement and law.

Assistance and deletion

Requests for access, correction, export, erasure or other assistance go to support@akter.dev. Assistance and return obligations are subject to the applicable agreement and law; this page does not promise a runtime export facility, a SQL dump or return of all actor data. The account personal-data export identifies stores and retirement dates.

Per-actor deletion followed by framework garbage collection is the erasure path for an individual end user’s data. History retention is 7 days on Free and 30 days on paid tiers; deleting live state does not immediately purge history. Environment, project or organization deletion immediately fences serving and retires the affected stores. After 30 days, a durable job empties and deletes each retired bucket; failed provider steps remain pending and retry. The retirement obligation survives removal of the owning records. There is no customer-facing undelete, immediate provider-purge promise or guaranteed completion exactly at the 30-day boundary.

Personal account deletion leaves a surviving organization’s stores intact; a sole owner must transfer ownership or complete organization deletion first. Akter does not add store versioning, replication or a separate backup copy in 0.2.0. Account, billing, security and accounting records may remain under the lawful exceptions described in the Privacy Policy. Ordinary store retirement is not the administrative teardown of disposable pull-request preview stages, which has no 30-day wait.

International transfers and contact

Processing and international transfers are subject to applicable law and the applicable agreement. Object-data placement alone does not settle where provider metadata, support access or other service processing occurs. There is no global-storage or customer-selectable residency guarantee. See the official location sources and limitations on the Subprocessors page. Questions go to support@akter.dev; security incidents go to security@akter.dev.