1. Parties and roles
This addendum is part of the Terms of Service between you (“Customer”) and Selfmade Ninja Academy (“Provider”). It applies whenever personal data that you are responsible for is stored or processed on the service — on your workspaces, in managed databases, in snapshots, or in transit over the platform network (“Customer Data”).
For Customer Data you are the controller, or a processor acting for your own controller; we are your processor. Under India’s Digital Personal Data Protection Act, 2023 the same roles are called Data Fiduciary and Data Processor. For the data about you as our account holder we are the controller, and the Privacy Policy applies instead. It applies to every account automatically; a countersigned copy is available from privacy@selfmade.ninja.
2. What the processing is
| Subject matter | Hosting and operating virtual machines and the services attached to them |
|---|---|
| Nature | Storage, transmission, snapshotting, and the administrative operations you trigger through the console, the API or the MCP server |
| Purpose | Providing the service you have contracted for |
| Duration | The term of the agreement, plus the deletion period in section 9 |
| Categories of data and of data subjects | Determined by you. We do not inspect Customer Data and cannot enumerate it. |
| Location | Hyderabad, India |
3. Instructions
We process Customer Data only on your documented instructions. Your instructions are the Terms, this addendum, and the actions you take through the console, the API and the MCP server. We do not act on an instruction we believe breaks the law that applies to us, and we tell you when that happens. We do not use Customer Data for any purpose of our own.
4. Confidentiality
The people who can reach the control plane are bound by confidentiality obligations. They reach a workspace only through the control plane, only when a task requires it, and every command sent is recorded. Access to the contents of a workspace happens only in the situations the Privacy Policy lists.
5. Security
We keep the technical and organisational measures described at /security, and that page is honest about what is not in place — in particular that there is no third-party certification and no off-host backup yet. Taking account of that, you decide what you put on the service and what copies you keep elsewhere. Where a measure changes, that page changes; we will not lower the overall level of protection during the term without telling you.
6. Sub-processors
You authorise the sub-processors listed at /subprocessors. Each is bound by written terms at least as protective as this addendum, and we remain responsible to you for their work. We email account holders at least 30 days before adding or replacing one. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected service and we refund any prepaid unused period.
7. Data subject requests and assistance
Because you hold root, most requests from your data subjects — access, correction, erasure — you can answer yourself, directly on the machine. If a request reaches us that concerns Customer Data we forward it to you promptly and do not answer it ourselves unless you ask us to or the law requires. We help you, at reasonable cost where the work is substantial, with data-protection impact assessments and consultations with a supervisory authority insofar as they concern our processing.
8. Personal data breaches
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Data, we notify you without undue delay and in any case within 72 hours of becoming aware of it, to the account email and the security contact if one is named. The notice includes what we know about the nature of the breach, the data and subjects likely affected, the likely consequences and the measures taken or proposed, and it is updated as we learn more. We do not tell your data subjects or your regulator on your behalf unless you ask or the law requires. Incidents that meet the CERT-In thresholds are also reported to CERT-In, as the directions of 28 April 2022 require of us.
9. Return and deletion
You can copy your data out at any time: you have root, SSH and your own snapshots. When you delete a workspace its disk and its snapshots are deleted and the deletion is verified before the console reports it. When the agreement ends we delete any remaining Customer Data within 30 days, except what a law requires us to keep — the 180-day log retention under the CERT-In directions is the one that applies — which is kept only for that purpose and then deleted.
10. Audits
We make available the information reasonably necessary to demonstrate compliance with this addendum, starting with /security and /subprocessors. We do not hold a SOC 2 or ISO 27001 report and will not pretend to; if you need one, the honest answer today is that we cannot supply it. Once a year, on 30 days’ notice and at your cost, you or an independent auditor you appoint may audit our compliance in a way that does not expose other customers’ data.
11. International transfers
Customer Data is stored in Hyderabad, India. India has no adequacy decision from the European Commission or the United Kingdom, so where you are subject to the GDPR or UK GDPR the transfer to us is made under the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914 — Module Two where you are a controller, Module Three where you are a processor — and, for the UK, the International Data Transfer Addendum to those clauses. Both are incorporated into this addendum by reference, with you as data exporter and Selfmade Ninja Academy as data importer, the optional docking clause included, the governing law and forum for the clauses being those of an EU member state (or of England and Wales under the Addendum), and the annexes completed by section 2 and by /security and /subprocessors. Onward transfers to sub-processors outside India are made under the same instruments or an adequacy decision.
12. India
Where you are a Data Fiduciary under the DPDP Act, this addendum is the contract under which we act as your Data Processor. We process only for the purposes you specify, keep the security safeguards above, tell you of a breach as section 8 says, and erase Customer Data as section 9 says, unless retention is required by law.
13. General
Liability under this addendum is subject to the limits in the Terms. Where this addendum and the Terms conflict on the processing of personal data, this addendum wins; where the Standard Contractual Clauses conflict with anything, they win. This addendum lasts as long as we hold Customer Data. It is governed by the laws of India, courts of Chennai, Tamil Nadu, except where the Standard Contractual Clauses require otherwise.