Data Processing Agreement

Effective October 24, 2026

This Data Processing Agreement ("DPA") is between [company] ("Guidely", "we", "us") and the customer that has agreed to our Terms of Service ("Customer", "you"). It sets out how we process Customer Data for you. As the Terms say, it forms part of them once signed. To sign it, email legal@guidelytech.com and we'll send you a copy to countersign.

If this DPA conflicts with the Terms, this DPA wins for the processing of Personal Data. If it conflicts with the Standard Contractual Clauses, the Clauses win.

1. Definitions

• Data Protection Laws: the laws that apply to the processing of Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law with the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act.
• Customer Data: as defined in the Terms: information about your End Users that the SDK or API sends to the Service from your apps, such as events, traits, session recordings, errors and Scout conversations.
• Personal Data: any Customer Data that relates to an identified or identifiable natural person.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data we process for you.
• Subprocessor: a third party we engage to process Personal Data for you.
• Standard Contractual Clauses or SCCs: the clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).

"Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR. "Business", "service provider", "sell" and "share" have the meanings given in the California Consumer Privacy Act.

2. Roles and scope

You are the controller of Personal Data in Customer Data, or a processor acting for your own customers, and we are your processor (or your subprocessor). This DPA covers only that processing. It doesn't cover the account information of the people who sign in to Guidely, which we handle as a controller under our Privacy Policy.

Annex I describes the processing: its subject matter, nature and purpose, duration, and the types of Personal Data and data subjects.

3. Our obligations

We will:

1. Follow your instructions. We process Personal Data only on your documented instructions, unless the law requires otherwise, in which case we'll tell you first unless the law forbids it. The Terms, this DPA, your settings in the Service (such as retention, capture and Scout settings) and the integrations you connect are your instructions. If we believe an instruction breaks Data Protection Laws, we'll tell you.
2. Keep it confidential. Everyone we authorise to process Personal Data is bound by confidentiality.
3. Keep it secure. We apply the technical and organisational measures in Annex II (section 4).
4. Help with data subject requests. The Service lets you find, export and delete an End User's data yourself. If a data subject contacts us directly about Customer Data, we'll pass the request to you and won't answer it ourselves unless you ask us to.
5. Help with your other obligations. Taking into account the nature of the processing and the information available to us, we'll reasonably help you with security, breach notifications, data protection impact assessments and prior consultations with supervisory authorities.
6. Not sell or share it. We won't sell or share Personal Data, keep or use it for any purpose other than providing the Service, or combine it with personal information we receive from anyone else, except as Data Protection Laws allow a service provider to do. We don't use Customer Data to train AI models.

4. Security

We implement and maintain the technical and organisational measures in Annex II, which are designed to protect Personal Data against a Personal Data Breach. We may update them as technology and threats change, but we won't reduce the overall level of protection they give.

5. Personal Data Breaches

If we become aware of a Personal Data Breach, we'll notify you without undue delay, and in any event within 72 hours. We'll send the notice to your workspace owners by email. It will describe, as far as we know them at the time, the nature of the breach, the categories and approximate number of data subjects and records affected, its likely consequences, and the measures we've taken or propose. We'll add details as we learn them. We'll take reasonable steps to contain the breach and limit its effects. Notifying you isn't an admission of fault.

6. Subprocessors

You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed at guidelytech.com/security (Annex III).

• Before a new Subprocessor starts processing Personal Data, we'll update that list and email your workspace owners at least 30 days in advance.
• You may object on reasonable data protection grounds within those 30 days. We'll then work with you in good faith on an alternative. If we can't find one within 30 days of your objection, you may end the affected part of the Service and we'll refund any prepaid fees for it.
• We bind each Subprocessor by written contract to data protection obligations no less protective than this DPA, and we remain responsible to you for its performance.

Services you connect yourself, such as Slack, Linear, Jira, Confluence, Intercom, or Anthropic using your own API key, are not our Subprocessors. We send them data on your instructions.

7. International transfers

We host the Service in the United States, and our Subprocessors process Personal Data there. Where Data Protection Laws require a transfer mechanism for Personal Data leaving the European Economic Area, the United Kingdom or Switzerland, the following apply and are incorporated into this DPA by reference:

• EEA: the SCCs, Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer. Clause 7 (docking clause) applies. In Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 6. The optional wording in Clause 11 doesn't apply. In Clause 13, the competent supervisory authority is the one that applies to you. In Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland. Annexes I to III of the SCCs are completed by Annexes I to III of this DPA.
• United Kingdom: the UK Addendum. Table 1 is completed with the parties' details in this DPA, Table 2 with the SCC modules and options above, and Table 3 with the Annexes of this DPA. In Table 4, either party may end the Addendum as set out in its Section 19.
• Switzerland: the SCCs as set out for the EEA, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority where the transfer is subject to Swiss law.

8. Audits

We'll make available the information reasonably needed to show that we comply with this DPA. On request, and no more than once a year, we'll answer a written security questionnaire and give you our current security documentation and any third-party audit reports we hold. If that isn't enough to meet a requirement of Data Protection Laws or a supervisory authority, you may audit our processing of Personal Data. You must give at least 30 days' written notice, conduct the audit during business hours, avoid disrupting the Service, keep what you learn confidential, and bear its cost. You may use an independent auditor bound by confidentiality who doesn't compete with us.

9. Return and deletion

You can export and delete Customer Data in the Service at any time. When the Terms end, we delete Customer Data as the Terms describe: you have 30 days to ask us to help export it, and we then delete it from our systems. Backups expire on their normal cycle, which is currently 7 days. We keep only what the law requires us to keep, and this DPA continues to protect it while we hold it.

10. Your obligations

You are responsible for having a lawful basis for the Personal Data you send to the Service, including any notices and consents your End Users need, and for configuring the Service accordingly. That includes masking, consent mode and retention, and not sending special categories of data. Your instructions must comply with Data Protection Laws.

11. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Laws don't allow them. This DPA lasts as long as we process Personal Data for you.

Annex I: Description of the processing

Parties. Data exporter: the Customer named in the signed DPA, using the Service as described in the Terms, contact as given at signature. Data importer: [company], [address], contact privacy@guidelytech.com, providing the Service.

Annex II: Technical and organisational measures

• Hosting and network: Amazon Web Services, us-east-1. The database runs in private subnets with no public access. Application containers run on AWS Fargate. Secrets are kept in AWS Secrets Manager.
• Encryption in transit: TLS 1.2 or higher for the dashboard, APIs and media. Plain HTTP is redirected to HTTPS. Database connections use TLS.
• Encryption at rest: the database and file storage are encrypted. Storage buckets block public access and accept only TLS connections. API keys and tokens for connected services are encrypted with AES-256-GCM.
• Authentication: passwords are hashed with bcrypt. Session tokens are random 256-bit values, stored only as hashes and revocable. Sign-in with GitHub or Google uses OAuth 2 with signed state. Workspaces choose which sign-in methods their members may use. Password sign-in supports two-step verification (an authenticator app with one-time recovery codes), which new workspaces require and any workspace can require. Login attempts and codes are rate limited.
• Access control: workspace roles (Owner, Admin, Editor, Viewer) with per-member permissions. Every request is checked against the workspace that owns the resource. Public SDK keys expose only published configuration for one environment, limited to allowed origins.
• Logging: an audit log of workspace actions, visible to admins, and application and database logs in Amazon CloudWatch.
• Application security: all author HTML is sanitised on the server and again in the runtime. Uploaded files are checked by content. Mutating dashboard requests are CSRF-protected. Rate limits apply to every public endpoint. Outbound fetches are protected against server-side request forgery.
• Data minimisation: the SDK drops properties whose names look like secrets or card data. Session recordings always mask form inputs and can mask all text. Consent mode and analytics opt-out are available. Page URL collection can be turned off. Scout sends Anthropic only what a reply needs (see the Privacy Policy).
• Retention and deletion: expired events and recordings are deleted automatically. An End User's data can be deleted in one step from the dashboard or API.
• Availability and backups: daily automated database backups kept for 7 days, with point-in-time restore. Infrastructure is defined in code and deployed from version control.
• People: access to production systems is limited to the people who operate the Service, and they are bound by confidentiality.

More detail is in our security documentation.

Annex III: Subprocessors

The current list, with each Subprocessor's purpose, the data it receives and its location, is at guidelytech.com/security. Changes follow section 6.

Contact

Questions about this DPA: legal@guidelytech.com. Privacy requests: privacy@guidelytech.com.

[company], [address]