Molar Labs — legal
Effective date: October 15, 2026 · Last updated: October 26, 2026
This Data Processing Addendum (“DPA”) applies when Molar processes personal data on behalf of a customer through the Molar service.
Template. This is our standard DPA template. It has not yet been reviewed by legal counsel. It becomes binding only when both parties sign it. If your company has its own DPA, send it to us and we will review it. To execute it, email pratik@molar.it with your company’s legal name and address.
1. Parties and roles
The customer named in the signed DPA is the controller. Molar Labs (“Molar”), operated by Pratik Rana, Bengaluru, India, is the processor. Molar Labs is not yet an incorporated company. This DPA forms part of the Terms of Service or other agreement under which the customer uses Molar (the “Agreement”). If this DPA conflicts with the Agreement on data protection, this DPA wins.
“Personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given in applicable data protection law, including the GDPR, the UK GDPR and India’s Digital Personal Data Protection Act, 2023, where they apply.
2. Details of processing
| Subject matter | Providing the Molar service: running browser tasks and checks against the customer’s applications, storing results, and exporting tests. |
|---|---|
| Duration | The term of the Agreement, plus the deletion periods in section 9. |
| Nature and purpose | Collection, recording, storage, analysis by AI models, display and deletion of data, only to provide the service as the customer instructs. |
| Categories of data | Account data of the customer’s users (name, email, organization, role). Target URLs, goals and test inputs. Saved test logins. Run artifacts: screenshots, browser video, network captures (HAR), Playwright traces and step logs, which contain whatever personal data the tested pages display or send. Messages delivered to Molar test inboxes. |
| Data subjects | The customer’s users of Molar. Test account holders. Any person whose data appears in the applications the customer asks Molar to test. |
| Special categories | None intended. The customer should not submit special categories of data unless agreed in writing. |
3. Customer instructions
Molar processes personal data only on the customer’s documented instructions. The Agreement, this DPA and the customer’s use of the service are those instructions. If Molar believes an instruction breaks data protection law, it will tell the customer. If the law requires Molar to process data in another way, Molar will tell the customer first unless the law forbids it.
The customer is responsible for having a lawful basis to process the data and for being authorized to test the applications it points Molar at.
4. Confidentiality
Molar limits access to personal data to the people who need it to run and support the service. Each of them is bound by a duty of confidentiality.
5. Security
Molar maintains the technical and organizational measures described on its security page. In summary:
- TLS for all traffic to the service
- Row-level security in the database that limits each request to the signed-in organization
- Saved logins encrypted at rest
- Hosted browsers in locked-down containers that cannot reach private or internal network addresses
- Saved logins typed only on the customer project’s own hosts
- A recent multi-factor check before sensitive actions, such as saving a login
- Encrypted database backups every 6 hours, stored outside the application server
- Automatic deletion of run artifacts after 5 days
Molar may change these measures if the overall level of protection does not go down.
6. Subprocessors
The customer authorizes Molar to use the subprocessors listed on the subprocessors page. Molar binds each subprocessor to data protection terms at least as protective as this DPA and remains responsible for its performance.
Molar will give the customer at least 30 days’ notice by email before adding or replacing a subprocessor. The customer may object in writing on reasonable data protection grounds within that 30-day period. The parties will then discuss it in good faith. If they cannot resolve it, the customer may terminate the affected part of the service and receive a refund of any prepaid fees for it.
7. Data subject requests
Taking into account the nature of the processing, Molar will help the customer respond to requests from data subjects to access, correct, delete, restrict or export their data. If Molar receives such a request directly, it will pass it to the customer and not respond itself unless the customer asks it to.
8. Personal data breaches
Molar will notify the customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting the customer’s data. The notice will describe what happened, the data and people affected as far as known, the likely consequences and the steps taken. Molar will update the customer as it learns more and will help the customer meet its own notification duties.
9. Deletion or return at the end
When the Agreement ends, the customer may export its data for 30 days. After that, Molar will delete the customer’s personal data from the live service, unless the law requires Molar to keep it. Run artifacts are deleted earlier, 5 days after creation. Copies in encrypted backups are deleted when those backups expire, within 365 days, and are not used in the meantime except to restore the service.
10. Audits and information
On written request, Molar will provide the information reasonably needed to show that it meets this DPA, such as written answers to security questionnaires and descriptions of its controls. Molar does not currently hold third-party certifications such as SOC 2 or ISO 27001. If that information is not enough, the parties will agree on the scope, timing and cost of any further audit, which must respect the confidentiality of Molar’s other customers.
Molar will also help the customer with data protection impact assessments and consultations with authorities where they relate to Molar’s processing.
11. International transfers
Molar hosts the service in India (Microsoft Azure, Central India region). Some subprocessors process data in other countries, mainly the United States, as listed on the subprocessors page. Where the law requires a transfer mechanism, such as for data from the EEA, the UK or Switzerland, the parties will use the Standard Contractual Clauses (or the UK Addendum) approved for that transfer, which are incorporated into this DPA by reference.
12. General
This DPA stays in effect as long as Molar processes the customer’s personal data. Liability under this DPA is subject to the limits in the Agreement, except where the law does not allow it. This DPA is governed by the same law as the Agreement.
To execute this DPA, email pratik@molar.it. We will send a version for signature with your details filled in.