Skip to content

Data processing agreement

Last updated: October 29, 2026

This agreement is part of the terms between you and Garm Tech B.V. ("we", "us"), and covers the personal data evalship processes on your behalf. You accept it by accepting the terms, so there's nothing to sign. For a copy signed by us, email hello@evalship.com. Where this agreement and the terms differ, this agreement governs that personal data.

1. Scope and roles

Customer personal data is personal data in what your workflows, repositories and coding agent send to evalship: eval results, pull request titles and descriptions, diffs and file excerpts, and setup reviews. Annex 1 describes the processing.

For customer personal data, you are the controller and we are your processor under the GDPR. If you process it for your own client, as an agency does, you are their processor and we are your sub-processor; you confirm that your client allows you to use evalship for it.

Sign-in details, account and billing records and invites are outside this agreement: we are their controller, as Data and privacy describes.

2. Your instructions

We process customer personal data only on your documented instructions: the terms, this agreement, your settings in evalship (such as Eval inputs and outputs and Model notes) and other instructions we agree to in writing. If the law requires other processing, we tell you first, unless the law forbids that. If we think an instruction breaks the GDPR, we tell you.

3. Confidentiality

Everyone we allow to process customer personal data is bound to keep it confidential. Today that is only the founder.

4. Security

We keep at least the measures in Annex 2 and on the security page. We may change them as evalship changes, but never in a way that lowers the overall protection of customer personal data.

5. Sub-processors

You authorize the sub-processors listed under Sub-processors. Before a new one gets customer personal data, we update that list and email everyone on the sub-processor notice list at least 14 days ahead; to join it, email hello@evalship.com. Within those 14 days you may object on reasonable data protection grounds. If we can't resolve the objection, you may end the service, and we refund the unused part of the current billing period.

Each sub-processor is bound by written terms that protect customer personal data at least as well as this agreement does. We remain responsible to you for their processing.

6. Transfers outside the EEA

evalship runs on Railway in the United States, and several sub-processors are US companies. These transfers rely on the providers' standard contractual clauses or, where a provider is certified, the EU-US Data Privacy Framework.

7. Helping you

  • Requests from data subjects. If someone asks us to access, correct or delete their data in your content, we pass the request to you and don't answer it ourselves. We help you answer it: with the product's settings and deletion, and on request.
  • Your other obligations. We help you with security, breach notifications, data protection impact assessments and prior consultations (GDPR articles 32 to 36), as far as the nature of the processing and the information we have allow.

8. Personal data breaches

If a breach affects customer personal data, we email your account's owners without undue delay, and within 72 hours of learning of it. We say what we know: what happened, which data and people are likely affected, the likely consequences and what we've done, and we send updates as we learn more. Attempts that don't get through, such as scans or failed sign-ins, aren't breaches.

9. Deletion and return

While you use evalship, customer personal data is deleted as Retention describes. You can delete more yourself by turning off Eval inputs and outputs or removing a repository from the App, or ask us at hello@evalship.com.

When you uninstall the App, we delete customer personal data 30 days later, once any subscription has ended, as Retention describes. It is gone from every backup within 3 months after that. Before then, on request, we send you a copy of the eval results we hold, as JSON. What remains afterwards names no one and isn't personal data.

10. Audits

We make available the information you need to check that we meet this agreement: this agreement, the security page, and our answers to your security questionnaire once a year. If that isn't enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our processing once a year, with 30 days' notice, during business hours and at your own cost. An audit never gives access to other customers' data.

11. Liability, term and changes

Liability under this agreement is subject to the limits in the terms, except where the law doesn't allow them. This agreement applies for as long as we process customer personal data. It is governed by Dutch law, and disputes go to the courts of Amsterdam, the Netherlands, as in the terms.

We may update this agreement as the terms allow, and we email account owners at least 14 days before a material change takes effect. A change never lowers the protection of customer personal data, unless the law requires it.

Annex 1: The processing

  • Subject matter and duration: running evalship for your repositories, while the App is installed and until deletion under section 9.
  • Nature and purpose: storing and comparing eval results; showing them on evalship.com and in pull request comments, checks, badges and emails; with Model notes on, a model's notes on pull requests; the setup review your coding agent writes.
  • Types of personal data: whatever your eval inputs, outputs, failure messages, names and metadata, pull request titles and descriptions, diffs, file excerpts and setup reviews contain, such as names, contact details and free text from your product's users; GitHub logins of pull request authors, and of members who send results from their machines.
  • Data subjects: your product's users and customers whose data appears in your evals or repositories; your staff and other contributors.
  • Special categories: not intended. Don't send health, biometric or other special category data, or data about criminal convictions; if your evals use it, turn off Eval inputs and outputs.
  • Sub-processors and retention: as listed under Sub-processors and Retention.

Annex 2: Security measures

The security page describes each of these in detail.

  • Access to your data: people GitHub gives access to the repository and people your account's owners invite. Changes need push access. A sign-in by email shows only the organizations that invited the person, and a sign-in lasts 30 days at most.
  • Our access: only the founder, through a read-only admin view that needs a GitHub sign-in. Every provider account that reaches evalship's code, servers or data needs a passkey or two-factor, and the founder's laptop disk is encrypted.
  • Access to your repositories: a read-only GitHub App on the repositories you choose, with tokens that reach one repository, expire within an hour and are kept only in memory.
  • Encryption: HTTPS only, with HSTS. Railway, our host, encrypts the database at rest, and it has no public address: evalship reaches it over Railway's private network, encrypted with WireGuard. GitHub sign-in tokens are encrypted in the database with keys kept outside it.
  • Data minimization: no clones and no files kept, only capped excerpts. Owners can turn off eval inputs and outputs, and model notes.
  • Logs and error reports: no request bodies, sign-in links or database query contents.
  • Untrusted input: webhooks act only with a valid signature; results files are size-limited; a fork's results never count as your default branch's.
  • Deletion: by plan and on uninstall, as Retention describes; backups kept up to 89 days.
  • Vulnerability management: static analysis and dependency audits on every change, and security reviews of the code, the latest on October 29, 2026. Vulnerabilities can be reported to security@evalship.com.
  • Incidents: notice within 72 hours, as in section 8.