Optiarms Inc., doing business as D.A.R.Y.L. Labs (“Daryl Labs,” “we” or “us”) uses a small number of service providers to run Daryl Shield. A provider that processes customer personal data on our behalf is a “subprocessor” under our Data Processing Addendum (the “DPA”). This page is Annex III of the DPA. It also describes the providers that handle data for which we are the controller, as explained in our Privacy Policy.
1. How we choose and bind subprocessors
Before we engage a subprocessor, we review its security and privacy practices. Each is bound by a written agreement that limits its use of the data to providing its service to us and imposes data protection obligations no less protective than those in the DPA. We remain responsible to our customers for our subprocessors’ performance. Today every subprocessor processes data in the United States; we will give notice before that changes.
2. Current subprocessors
| Role | Purpose | Data processed | Location |
|---|---|---|---|
| Hosting and scheduled jobs | Serves the website, dashboard and API, and runs scheduled scans, digests and maintenance jobs. | All data in transit through the Service, including account data and customer-system data; request logs. | United States |
| Database | Stores the Service’s records, with row-level security on every tenant table, encryption at rest and backups. | Account, billing-status and audit data; customer-system data (schema metadata, policy text, grants, function definitions, request shapes with hashed end-user IDs, estimated row counts); encrypted connection tokens. | United States |
| Cache and rate limiting | Holds short-lived counters that protect sign-in, forms, the Check and the API from floods. | IP addresses or account identifiers as counter keys, expiring within minutes to a day. | United States |
| Email delivery | Sends sign-in links, approval requests, notifications, digests and receipts by email. | Recipient email addresses and the content of the message. | United States |
| Payment processing | Takes payments, manages subscriptions, issues invoices and handles affiliate payouts. | Billing contact details, payment card or bank details (collected directly by the processor), plan and invoice records. | United States |
| AI model provider | Drafts policy fixes when fix drafting is in use. Processes requests under API terms that bar training on them. | Schema metadata, policy text and finding details needed to draft a fix. Never table rows or row contents. | United States |
The AI model provider is used only when fix drafting is in use. It receives the structural information needed to draft a fix, never the contents of your database. We do not use customer data to train any model, and we use provider settings that limit retention where they are offered.
3. Integrations you connect
When you connect Supabase, GitHub, Slack or your deploy platform to Daryl, we exchange data with that service because you asked us to: we read your database structure from Supabase, open pull requests on GitHub, post approval cards to the Slack channel you choose, and receive deploy events from your deploy platform. These services are not our subprocessors. You choose them, you have your own agreement with each of them, and they process data under that agreement and their own policies. You can disconnect any of them at any time, and we then delete the connection’s tokens.
4. Planned subprocessors
The following roles support features that are not yet available. Each will be added to the current list, and customers emailed, at least 30 days before it begins processing customer data, with the same right to object.
| Role | Purpose | Data processed | Location |
|---|---|---|---|
| Isolated compute | Runs the policy engine and the replay sandbox, in short-lived machines that are destroyed after each run. | Policy text, schema metadata and request shapes with hashed end-user IDs. | United States |
| Key management service | Holds the non-exportable keys that sign receipts and wrap each organization’s data keys. | Hashes of receipts to be signed, and wrapped data keys. No customer data in readable form. | United States |
| Public transparency-log anchoring | Records a fingerprint of our public log so anyone can check it has not been rewritten. | Hashes only. | United States |
| Error monitoring | Collects error reports so we can find and fix faults. | Error messages and technical context, with personal data scrubbed before sending where possible. | United States |
5. Changes and notifications
We update this page before a new subprocessor processes customer data, and we email the account owners of every customer organization at least 30 days in advance. Anyone else can subscribe to change notices by emailing hello@getdaryl.com with the subject “Subprocessor updates.” In an emergency, such as replacing a provider that has failed or become a security risk, we may give shorter notice, and will give it as soon as we reasonably can. Removing a subprocessor does not require notice, but we will update this page.
6. Your right to object
Under section 7.3 of the DPA, a customer may object to a new subprocessor on reasonable data protection grounds within the notice period by writing to hello@getdaryl.com. We will work with you in good faith on an alternative. If we cannot find one within 30 days, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
7. Getting the named list
We describe our subprocessors by role on this page. Customers may request the names of the companies in each role by writing to hello@getdaryl.com. We provide the named list under confidentiality and keep it current with the notices described above. Questions about this page go to the same address or to the address at the end of this document.
Contact
Optiarms Inc., doing business as D.A.R.Y.L. Labs
6545 Market Ave N, Ste 100
Canton, OH 44721
hello@getdaryl.com
Other documents: Terms · Privacy · DPA · Acceptable use · Disclosure · Cookies · Hardening terms · Affiliate terms