Data Processing Agreement

1. Scope and Roles

You act as controller and we act as processor of personal data submitted to or collected by the Service on your behalf ("Customer Personal Data"). If you act as a processor for another controller, we act as your sub-processor and you must have authority to give us instructions. Each party will comply with applicable data protection law, including the GDPR and UK GDPR where applicable.

Processing covers collection, storage, retrieval, analysis, transmission, and deletion to provide session replay, analytics, diagnostics, site chat, and the AI features you use. It continues for the duration of the Service and until the data is returned or deleted under this DPA.

Data subjects are visitors and users of your websites or applications and people whose information you submit. Depending on your configuration, data includes device and user identifiers, IP addresses, page content and snapshots, interactions, events and purchases, logs, network data, chat messages and attachments, contact details, and AI inputs and results. The Service is not intended to process special-category personal data or criminal-offence data. Our own account, billing, and service usage data is covered by the Privacy Policy.

2. Your Instructions

We will process Customer Personal Data only on your documented instructions, including for international transfers. The Terms, this DPA, your settings, and your use of the Service constitute those instructions. You are responsible for the lawfulness of your instructions and for providing notices and obtaining any required consents. You may send additional instructions to our contact below.

If law requires other processing, we will inform you before processing unless the law prohibits this. We will promptly inform you if, in our opinion, an instruction infringes applicable data protection law.

3. Confidentiality and Security

We will limit access to authorized people who need it to provide the Service and are bound by confidentiality obligations. We will maintain technical and organizational measures appropriate to the risks of processing, including access controls, encryption in transit and at rest, measures to maintain confidentiality, integrity, availability and resilience, procedures to restore access after an incident, and regular assessment of those measures. We will provide further information reasonably needed to assess these measures on request.

4. Sub-processors

You authorize us to use the providers listed in the Privacy Policy to the extent they process Customer Personal Data to deliver their described services. We will give you at least 30 days' advance notice by email of a new or replacement sub-processor, allowing you to object on reasonable data protection grounds before it begins processing your data.

We will work with you to resolve an objection. If no reasonable solution is available, you may terminate the affected Service before the change and receive a refund of unused prepaid fees for it. We will bind each sub-processor to data protection obligations offering equivalent protection to this DPA and remain responsible for its performance of those obligations.

5. Assistance and Incidents

Taking account of the nature of processing and information available to us, we will assist you with data subject requests and your obligations concerning security, breach notifications, data protection impact assessments, and consultation with supervisory authorities. We will promptly forward requests relating to your Customer Personal Data and will not respond on your behalf unless instructed by you or required by law.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will provide available information about its nature, affected data, likely consequences, and mitigation measures, with updates as information becomes available, and cooperate with your response.

6. Return and Deletion

When processing services end, we will, at your choice, return or delete Customer Personal Data and delete existing copies, unless applicable law requires retention. You may also instruct us to delete data during the Service. Any copies awaiting deletion in backups will be isolated from further use, except as required by law, and deleted through the applicable backup retention cycle. We will confirm the applicable deletion schedule on request. Moving to the Free plan continues the Service and does not itself constitute an instruction to delete data.

7. Compliance Information

We will make available information necessary to demonstrate compliance with this DPA and applicable processor obligations, including Article 28 of the GDPR where applicable. We will allow and contribute to audits and inspections by you or your appointed auditor. The parties will coordinate reasonable arrangements to protect confidentiality, security, and other customers' data without preventing the exercise of these rights.

8. International Transfers

We will transfer Customer Personal Data internationally only in accordance with applicable data protection law and your instructions. Where a transfer requires additional safeguards, we will put the applicable transfer mechanism in place before making that transfer, such as standard contractual clauses and any required UK addendum. You may request information about processing locations and applicable safeguards using the contact below.