Data Processing Agreement

1. Roles and scope

For Customer Data that contains Personal Data relating to your end users, you are the Controller and we are the Processor acting solely on your documented instructions. Your instructions are set out in the Terms of Use, this DPA, and your use and configuration of the Service (including your capture, masking, and retention settings). You are responsible for the accuracy, quality, and lawfulness of the Personal Data and of the means by which you acquired it, and for establishing a lawful basis for the processing.

The subject matter, duration, nature, and purpose of the processing, the types of Personal Data, and the categories of data subjects are described in Annex A. We will process Personal Data only for the purpose of providing and supporting the Service and will not sell it, share it for cross context behavioral advertising, retain, use, or disclose it for any other purpose, or combine it with data from other sources except as permitted by Data Protection Laws.

2. Processor obligations

We will process Personal Data only on your documented instructions, including with regard to international transfers, unless required to act otherwise by law that applies to us; in that case we will inform you of the legal requirement before processing, unless the law prohibits it. We will promptly inform you if, in our opinion, an instruction infringes Data Protection Laws.

We ensure that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations. We will provide you with reasonable assistance, taking into account the nature of the processing and the information available to us, to help you meet your obligations for security, data protection impact assessments, prior consultation, and responses to data subjects.

3. Security

We implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, as described in Annex B. These include encryption of Personal Data in transit, envelope encryption of durable hosted artifact copies, sealed authenticated encryption of connector credentials, one way hashing of API keys and tokens, access controls, and a client side redaction layer that masks values for sensitive fields before capture. By default, the browser SDK also masks text nodes, keystrokes, and form values in page snapshots before capture. Input events use the same deny biased redaction policy as request payloads, and you can explicitly unmask one element or block an element and its contents. When object storage is configured without the deployment artifact key, durable uploads are disabled rather than written without encryption. You are responsible for configuring capture, redaction, and access in a way appropriate to the sensitivity of your data.

4. Subprocessors

You provide general authorization for us to engage subprocessors to help deliver the Service. Our current subprocessors are listed in Annex C and, in more detail, in the Privacy Policy. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance. Where we have not yet executed a written data processing agreement with a subprocessor, that subprocessor is identified as such in Annex C and we rely on its published terms until an agreement is executed; we remain responsible for its performance either way. We will give you reasonable prior notice of any new subprocessor (by updating the list and, on request, notifying you), and you may object on reasonable data protection grounds; if we cannot reasonably address your objection, you may terminate the affected part of the Service.

5. Data subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights. The hosted API supports deletion of sessions matched to indexed pseudonymous account and optional user identifiers. If we receive such a request directly, we will not respond except on your instructions, and will refer the data subject to you, unless legally required to respond.

6. Personal data breach

We will notify you without undue delay, and in any event within seventy two (72) hours, after becoming aware of a personal data breach affecting Personal Data we process for you, and will provide the information reasonably available to us to help you meet your own notification obligations. Our notification is not an acknowledgement of fault or liability.

7. International transfers

Where we process Personal Data originating from the EEA, UK, or Switzerland in a country that has not received an adequacy decision, the transfer is governed by the applicable Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), which are incorporated into this DPA by reference and completed with the details in the Annexes. In the event of a conflict, those clauses prevail over this DPA with respect to the transfer they govern.

8. Return and deletion

On expiry or termination of the Service, or earlier on your instruction, we will delete Personal Data processed on your behalf in accordance with your plan's retention window and our routine purge processes, unless applicable law requires retention. Completed session deletion removes database rows, local artifacts, object storage copies, derived evidence, and data subject index entries. Completed tenant deletion also removes tenant projects, tenant scoped credentials, tokens, connector records, capture settings, and tenant memberships, while retaining a scrubbed tombstone only for required audit and receipt records. Hosted login identities are removed when identity provider management credentials are configured. Otherwise the deletion receipt identifies that remaining action. Receipts and administrative audit events are written within the deletion transaction. Session and evidence data is purged from storage and our database at the end of the applicable retention window. We target deletion within seven days and commit to complete a valid request within 30 days. A tenant account deletion request has a 14 day cancellation window before physical purge.

9. Audit

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on your written request no more than once per year (or following a personal data breach), allow for and contribute to an audit, including through up to date third party reports or questionnaires where available. On site audits, where warranted, are conducted on reasonable notice, during business hours, subject to confidentiality, and in a manner that does not disrupt our operations.

10. CCPA terms

To the extent the CCPA applies, we act as a service provider and certify that we understand and will comply with these restrictions: we will not sell or share Personal Data, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than the services specified in the Terms, and will not combine it with personal information from other sources except as the CCPA permits.

11. Liability

Each party's liability arising out of or related to this DPA is subject to the exclusions and limitations of liability set out in the Terms of Use, and any reference to the liability of a party means the aggregate liability of that party under the Terms of Use and this DPA together.

Annex A: Details of processing

• Subject matter and duration: capture and diagnosis of software defects for the duration of the Service and the applicable retention window.
• Nature and purpose: recording session evidence and assembling fix ready context to help engineers and, where enabled, AI coding agents diagnose issues.
• Categories of data subjects: your end users, employees, testers, and other individuals who interact with your applications instrumented with the Service.
• Types of Personal Data: as determined by your capture and masking configuration, for example identifiers, interaction and network metadata, redacted payloads, console output, environment and feature flag state, and, where enabled, backend spans and row level database changes. You are instructed not to capture special category data or payment card data.
• Data inventory: account identifiers and membership records; project configuration and access records; captured session and evidence artifacts; pseudonymous account and user identifiers used for data subject deletion; connector credentials when enabled; and audit and deletion receipt records.

Annex B: Security measures

• Encryption of Personal Data in transit using TLS. Durable hosted object store artifact copies use per tenant envelope encryption with a data key wrapped by the deployment artifact key. When object storage is configured without that key, durable uploads are disabled. The local capture staging volume is outside this cloud encryption layer.
• Connector credentials sealed with authenticated encryption using AES 256 GCM and not readable back by us.
• API keys and CLI tokens stored only as one way hashes; passwords managed by our identity provider and never stored by us.
• Client side redaction layer that masks values for sensitive fields before capture, including password, email, and telephone inputs, elements marked as sensitive, and field names matching configured redaction rules; browser SDK masking by default for text nodes, keystrokes, and form values in page snapshots before capture; deny biased redaction for input events; recording of input values switchable off entirely through capture configuration; tenant scoped access controls; routine purge of evidence at the end of the retention window.

Annex C: Subprocessors

• Supabase: authentication and database hosting.
• WorkOS: single sign on for organizations that enable it, and, where a tenant also enables directory sync, SCIM based directory provisioning, covering SSO identity assertions and, for directory synced tenants, SCIM events carrying employee email, name, group membership, and directory state, which we use to suspend, reinstate, and revoke access for tenant members automatically. Group membership events are received but not currently acted on. A directory event never creates a membership: a member record is created when that person first signs in and their verified email domain matches the tenant. Deprovisioning suspends the membership and deletes the hosted authentication identity rather than deleting the membership record. Processing is in the United States. Data reaches WorkOS for every tenant that signs in through it; directory sync events reach us only where a tenant enables SCIM. The WorkOS account and its API credentials are ours, not the tenant's, so under the same account ownership test applied to Composio below, WorkOS is our subprocessor. We have not executed a data processing agreement with WorkOS. You may object to this subprocessor on the grounds set out in section 4.
• Railway: application hosting.
• Cloudflare R2: durable object store copies of session evidence artifacts and, where a project administrator has turned on repository code reading for a project, the raw repository source chunk text and file paths from which the code index is built. These objects carry per tenant envelope encryption.
• Cloudflare Turnstile: bot protection on public submission forms, receiving the visitor's IP address and the challenge token submitted with that form. Our configuration requires it for public submissions on the live service. We have not confirmed an executed data processing agreement or a processing location for this subprocessor; you may object to it on the grounds set out in section 4.
• Amazon Web Services (Simple Email Service and Simple Notification Service): transactional and product email, covering recipient address and message content, and delivery event notifications for that mail. Our configuration requires each live deployment to send through either this subprocessor or Resend, and records that the United States deployment uses this one; we cannot determine from configuration alone which provider a given deployment runs, so both are listed as engaged. We have not confirmed an executed data processing agreement for this subprocessor; you may object to it on the grounds set out in section 4.
• Upstash Vector and Cloudflare Vectorize: hosted vector indexes for the repository code index, receiving embedding vectors derived from repository source chunks together with project identifier, repository name, file path, start and end line, chunk key, embedding model name, and index generation, namespaced by tenant identifier. Neither receives the source text itself. Both are optional configuration and are engaged only where repository code indexing is turned on for a project; where both are configured the Upstash index is used. Our configuration notes record that the Cloudflare index is globally distributed with no region control, which is why a deployment that must keep the index in a single region configures the Upstash index instead. We have not confirmed an executed data processing agreement or a processing location for either; you may object to them on the grounds set out in section 4.
• Stripe: payment processing and billing.
• OpenRouter and the AI model provider selected for an AI diagnosis request (on by default, and a tenant may turn it off): AI assisted diagnosis using derived structural metadata plus short, bounded payload snippets with secrets stripped; embeddings computed over redacted bundle text for issue similarity search; and, only where a project administrator turns on Let AI read code for that project, raw repository source chunk text with repository, path, and line provenance and no secret stripping. By default all model requests, including code carrying requests, embedding requests, a short model authored summary of findings from a similar earlier issue, and bug signature and error family strings used to group related issues, are sent with provider preferences that require zero data retention and deny data collection, so the gateway routes them only to a provider serving them under those terms and rejects the request when none is available. That routing is enforced by the gateway rather than verified by us on each response. An organization administrator can remove that restriction for the whole workspace, through a request that must repeat an exact acknowledgement sentence and that we record in the audit log with the administrator who made it. While it is removed, every model request other than an embedding request may reach a provider that retains prompt content or uses it to train its models. Embedding requests stay restricted either way, and any administrator can restore the restriction at any time.
• PostHog: aggregate, tenant level product metrics and marketing site analytics.
• Resend: transactional and product email for deployments configured to use it, covering recipient address and message content.
• Composio: integration gateway for connectors we do not integrate directly, covering the authorization for the connected tool and the arguments and results of the calls we make to it, processed in the United States. Data reaches Composio only where a tenant enables a gateway backed connector. Unlike the customer directed connections described in the Privacy Policy, the gateway account is ours rather than yours, so Composio acts as our subprocessor. Composio's MCP Gateway page claims a zero data retention architecture in which tool call payloads and credentials are never stored, while its own API documentation describes a Logs endpoint that returns the full request payload and response body for a given tool call. Those claims cannot both be true of the path we use, we have not resolved which one is, and we therefore treat payloads as retained by Composio. We have not executed a data processing agreement with Composio and have not located its subprocessor list. You may object to this subprocessor on the grounds set out in section 4.

Contact

Questions about this DPA can be sent to contact@crumbtrail.ai.