Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between [Company legal name], Tax ID (RUT) [Tax ID (RUT)] ("Wutbug" or the "Processor") and the customer who contracts the Service (the "Customer" or the "Controller"). It applies when Wutbug processes Personal Data of the Customer's End Users. In the event of a conflict with the Terms on data protection matters, this DPA prevails.

#1. Definitions

• Data Protection Law: Regulation (EU) 2016/679 ("GDPR") and United Kingdom law where applicable; Chile's Ley 19.628 and Ley 21.719 that amends it, from its entry into force; California's CCPA/CPRA; and any other applicable law.
• Personal Data: the End User data that the SDK captures and sends to the Service, and the data the Customer provides with setUser() or setMetadata().
• Controller, Processor, Subprocessor, Processing, Data Subject and Security Incident: with the meaning given to them by the Data Protection Law (in the GDPR, "controller", "processor", "sub-processor", "processing", "data subject" and "personal data breach").

#2. Roles

The Customer is the Controller of the processing and determines its purposes and means: it installs the SDK and configures masking, auto-capture, retention and integrations. Wutbug is the Processor and processes the Personal Data only on behalf of the Customer. For purposes of the CCPA/CPRA, Wutbug acts as a "service provider".

#3. Details of the processing

#4. Customer instructions

Wutbug processes the Personal Data only on the Customer's documented instructions, which are: these Terms and this DPA, the configuration the Customer makes in the SDK and the Dashboard, and the actions of its authorized users (for example, creating a task in an integration). If, in Wutbug's opinion, an instruction infringes the Data Protection Law, we will inform the Customer.

#5. Confidentiality

Wutbug ensures that the persons authorized to process the Personal Data are bound by confidentiality obligations and access it only when necessary to provide the Service, give support requested by the Customer or comply with the law.

#6. Security measures

Wutbug applies the technical and organizational measures described in Security, including:

• Masking and redaction of sensitive data in the browser, before it is sent.
• Encryption in transit (TLS) and at rest.
• Integration credentials encrypted with AES-256-GCM; API and MCP tokens and the project secret key stored only as a SHA-256 hash.
• Access control by team and role; share links and the reporter's page protected with random, non-indexable tokens.
• Database access only from the application servers, with row-level security (RLS) enabled on all tables.
• Configurable retention and automatic deletion.

Wutbug may update these measures provided that the overall level of protection is not reduced.

#7. Subprocessors

The Customer gives Wutbug general authorization to engage the Subprocessors published at Subprocessors. Wutbug:

• Imposes on each Subprocessor data protection obligations equivalent to those of this DPA.
• Notifies the Customer at least 30 days in advance before adding or replacing a Subprocessor, by updating the list and by email to the team owners.
• If the Customer objects on reasonable data protection grounds, the parties will seek an alternative in good faith; if there is none, the Customer may terminate the affected Service and receive a pro rata refund of prepaid amounts.
• Remains liable to the Customer for the performance of its Subprocessors.

The integrations and AI assistants that the Customer connects (Slack, Linear, Jira, Notion, Asana, MCP clients) are not Wutbug Subprocessors: they act on the Customer's instructions and under the Customer's direct relationship with those third parties.

#8. Data subject rights

Wutbug will assist the Customer, to a reasonable extent, in responding to requests for access, rectification, erasure, objection, portability or blocking. The Customer can search for a person's reports in the Dashboard (by email or text). To erase individual reports, the Customer may request it at [Contact email] and Wutbug will delete them within 10 business days [update once the option to delete reports exists in the Dashboard]. If a data subject writes directly to Wutbug, we will forward the request to the Customer without responding on our own behalf, unless the law requires it.

#9. Security Incidents

Wutbug will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a Security Incident affecting the Customer's Personal Data. The notification will describe, to the extent known: the nature of the incident, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. Wutbug will cooperate so that the Customer can comply with its own obligations to notify the authority (for example, 72 hours under the GDPR, or the Agencia de Protección de Datos Personales de Chile) and the data subjects.

#10. Assistance and audits

Wutbug will make available to the Customer the information necessary to demonstrate compliance with this DPA and will cooperate with impact assessments and consultations with the authority where appropriate. The Customer may request an audit once a year, with 30 days' notice, during business hours, at its own cost and subject to confidentiality; an attempt will first be made to satisfy it with documentation and certifications from the Subprocessors.

#11. Deletion and return

• During the subscription, reports are deleted automatically when the retention period that the Customer configures expires (7 to 365 days per project).
• The Customer may delete the entire team at any time from the Dashboard, and request the deletion of specific reports or projects. Deleting a team deletes all of its projects, reports, recordings and integrations.
• Upon termination of the subscription, Wutbug will delete the remaining Personal Data within 30 days, unless the law requires it to be retained. Backups are deleted according to their cycle, at most [N] days later.
• Before deletion, the Customer may export its reports [to be completed: export mechanism].

#12. International transfers

Personal Data is stored in the United States. For transfers from the European Economic Area, Switzerland or the United Kingdom, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor) and, where applicable, Module 3 (processor to processor), and the UK Addendum. For Chile, the parties will apply the appropriate safeguards required by Ley 21.719 and the Agencia de Protección de Datos Personales.

#13. Customer obligations

The Customer represents that it has a legal basis for the processing, that it informs its End Users (it may use the suggested text), that it configures masking appropriately for the data its application displays, and that it will not instruct Wutbug to process data in a manner contrary to the Data Protection Law.

#14. Liability and term

Each party's liability under this DPA is governed by the limitation of liability in the Terms, to the extent permitted by the Data Protection Law. This DPA remains in force for as long as Wutbug processes Personal Data on behalf of the Customer.

#15. Signature

This DPA is accepted together with the Terms. If you need a signed copy, write to us at [Contact email].