Data Processing Addendum

1. Roles and instructions

The customer is controller (or processor acting for another controller) and Apphelm is processor. Apphelm processes Customer Personal Data only on documented instructions in the agreement, product configuration, support request or applicable law. The customer is responsible for lawful instructions, notices and data-subject requests.

2. Processing details

Subject: product telemetry, reliability, replay, feature-flag delivery, account and integration services. Duration: the service term plus deletion/backup cycle. People: customer personnel and end users of customer products. Data: identifiers, pseudonymous IDs, internet/electronic activity, product events, performance/error data, coarse device/location, optional masked replay and customer-supplied account context. Sensitive data: not intended; prohibited capture fields must remain blocked.

Consented autocapture: where the customer enables it, Apphelm processes page views, page exits, clicks, form submissions and field-change types as hashed element paths with coarse coordinates. Input values, passwords and element text are never processed. Password, email, telephone, card, IBAN, national-identifier, one-time-code, contenteditable and explicitly masked elements are excluded entirely, as are the customer’s blocked route prefixes. Autocapture is disabled per product by the customer and can be sampled.

Heatmaps: daily aggregates of consented clicks by hashed selector and normalized coordinate, retained as rollups. No screenshots or page content are processed.

Error grouping: browser and server exception type, message and stack, scrubbed of email addresses, credentials, tokens and query strings before storage, with group and volume caps.

Feature flags: flag configuration lookups keyed by a customer-supplied distinct identifier, plus profile traits and segment membership the customer already holds, used only to decide targeting. Evaluation does not require analytics consent because it is configuration delivery rather than measurement; flag exposure events are recorded only where analytics consent exists. Segment- and trait-targeted evaluation happens server-side only.

3. Processor duties

• Confidentiality commitments for authorized personnel.
• Appropriate technical and organizational security measures.
• Reasonable assistance with rights requests, DPIAs, consultations and compliance information.
• Notice without undue delay after confirmed Personal Data Breach, with available scope and remediation information.
• Deletion or return after termination unless law requires retention.
• Audit information and reasonable remote review; on-site audit only where necessary and appropriately scoped.

4. Subprocessors and transfers

The customer gives general authorization for the published subprocessors. Apphelm remains responsible for their processing obligations. Restricted international transfers use an adequacy mechanism or applicable Standard Contractual Clauses; UK and Swiss adaptations apply where required. Apphelm does not currently offer EU-only storage or processing; a workspace's region setting is recorded as a preference.

5. SCC particulars

For EU transfers, Module Two applies where customer is controller and Module Three where customer is processor. Clause 7 docking applies; option 2 general authorization applies with the published notice process; the competent supervisory authority and governing law follow the customer exporter’s EEA establishment where the Clauses require; otherwise an eligible EU member-state law and courts will be selected. The description in section 2, security overview and subprocessor list complete Annexes I–III.

6. Contact and execution

This DPA is accepted with the Apphelm agreement and does not require a second signature unless procurement requires one. Use the support form for a countersigned copy or security materials.