Data Processing Addendum

Last updated: October 24, 2026

1. Parties and roles

This DPA is between the customer that accepted the Terms of Use (“Customer”) and Traceway Tech, Inc. (a Delaware corporation), Dallas, TX, United States (“Traceway”). For the personal data contained in Customer Data (defined in the Terms), Customer is the controller, or a processor acting for another controller, and Traceway is Customer's processor. For the account, billing and security data of Customer's users, Traceway is an independent controller, as described in the Privacy Policy, and that data is not covered by this DPA.

2. Definitions

“Data Protection Law” means every law that applies to the processing of personal data under this DPA, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection. “Personal data”, “controller”, “processor”, “data subject”, “processing” and “personal data breach” have the meanings given in the GDPR. “Customer Personal Data” means the personal data in Customer Data. “Sub-processor” means a third party Traceway engages to process Customer Personal Data. “SCCs” means the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914.

3. Details of the processing

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

4. Customer's obligations

Customer is responsible for the lawfulness of the Customer Personal Data it sends to the Service, for having a lawful basis, for giving data subjects the required information, and for configuring the SDKs and exporters (sampling, masking, attribute allow-lists, privacy mode for AI traces) so that only the personal data it needs is sent. Customer will not send special categories of personal data, payment card data or data about children unless it is masked, and will tell Traceway if it is legally required to apply stricter rules.

5. Traceway's obligations

Traceway will:

• process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, and the settings Customer chooses in the Service. Traceway will tell Customer if it believes an instruction infringes Data Protection Law, and if a law requires Traceway to process the data otherwise, it will tell Customer before doing so unless that law forbids it
• make sure everyone who can access Customer Personal Data is bound by confidentiality and has access only to the extent needed to provide, secure and support the Service
• implement and maintain the technical and organizational measures in Annex 2, and not reduce their overall level of protection during the term
• engage Sub-processors only under section 6
• help Customer respond to data subject requests (section 8), and to carry out data protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to Traceway
• notify personal data breaches under section 9
• delete or return Customer Personal Data under section 10
• provide the information needed to demonstrate compliance and allow audits under section 11

6. Sub-processors

Customer gives Traceway general authorization to use the Sub-processors listed in Annex 3. Traceway imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains fully liable to Customer for their performance. Traceway will give Customer at least 30 days' notice by email to organization administrators before adding or replacing a Sub-processor that processes Customer Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith within 30 days, Customer may terminate the affected subscription and Traceway refunds any prepaid fees for the remaining term.

7. International transfers

Traceway stores and processes Customer Personal Data in the United States (Annex 3). Where Data Protection Law restricts a transfer of Customer Personal Data from the EEA, the United Kingdom or Switzerland to Traceway or a Sub-processor, the parties rely on, in this order: an adequacy decision that covers the recipient (including the EU-US Data Privacy Framework where the recipient is certified), and otherwise the SCCs, which are incorporated into this DPA by reference as follows:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor
• Clause 7 (docking) is included; Clause 9 option 2 (general authorization) applies with the notice period in section 6; Clause 11 optional language does not apply; Clause 13 is completed by the supervisory authority of Customer's EU establishment, or otherwise of its EU representative; Clause 17 option 1 and Clause 18 apply with the law and courts of Ireland
• Annex I and Annex II of the SCCs are completed by Annex 1, Annex 2 and Annex 3 of this DPA
• for transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs issued by the Information Commissioner applies, with the tables completed by the same Annexes; for transfers from Switzerland, the SCCs are adapted as required by the Swiss Federal Data Protection and Information Commissioner

Traceway will tell Customer if it can no longer comply with the transfer mechanism relied on, and Customer may then suspend the transfer and terminate the affected subscription.

8. Data subject requests

The Service gives Customer the tools to search, view and delete telemetry, sessions, replays and projects, which is how most data subject requests can be honored directly. If Traceway receives a request from a data subject concerning Customer Personal Data, it will not answer it on the merits but will forward it to Customer without undue delay, where Traceway can identify Customer. Where Customer cannot fulfil a request with the tools provided, Traceway will help on request, at no charge for reasonable effort.

9. Personal data breaches

Traceway will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes by email to organization administrators and describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Traceway will update the notice as more becomes known and will cooperate with Customer's own notification obligations.

10. Deletion and return

Customer can delete projects and individual data from the Service at any time, and export Customer Data through the dashboard, API and CLI. Within 30 days after the end of the subscription or the closure of the account, Traceway deletes all Customer Personal Data, except for copies in backups, which are overwritten on their rotation schedule within a further 35 days, and data Traceway must keep under a legal obligation, which it continues to protect under this DPA. On written request Traceway confirms deletion.

11. Audits

On request, no more than once a year unless a breach or a supervisory authority requires otherwise, Traceway will make available the information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and, once available, its SOC 2 Type II and ISO 27001 reports under NDA. Where that information is not sufficient, Customer or an independent auditor it mandates may audit Traceway's relevant controls, on at least 30 days' notice, during business hours, without disrupting the Service, at Customer's cost, and subject to confidentiality. The parties agree the scope in advance.

12. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms of Use, except where Data Protection Law does not allow a limitation. This DPA applies for as long as Traceway processes Customer Personal Data. If this DPA conflicts with the Terms, this DPA wins for the processing of Customer Personal Data; if it conflicts with the SCCs, the SCCs win.

Annex 1: Processing details

Annex 2: Technical and organizational measures

• Encryption. TLS 1.2 or higher for every connection to the Service and between the Service and its Sub-processors. Encryption at rest with AWS-managed keys for databases, object storage and backups.
• Credentials. Passwords stored as salted hashes. API tokens, personal access tokens, refresh tokens and SMS verification codes stored only as SHA-256 hashes. Short-lived access tokens with rotating refresh tokens and family revocation on reuse. Write access for AI agents requires an explicit organization opt-in and is logged.
• Tenant isolation. Every row of telemetry is keyed by project, every query is scoped by the caller's organization membership, and role checks (owner, admin, user, read-only) are enforced server side. Synthetic monitors on Cloud cannot reach private networks.
• Access control. Production access is limited to the founders, requires SSH keys and multi-factor authentication, and is used only to operate the Service and for support at Customer's request. No one browses Customer Data for curiosity.
• Availability. Infrastructure on AWS with automated restarts, database backups rotated within 35 days, rate limits and admission control on ingest so overload sheds load instead of losing the process.
• Software security. Open-source code with public review, dependency vulnerability scanning in CI, signed releases, and a published security policy for reporting vulnerabilities.
• Data minimization tools. SDK-side masking of inputs and text in session replays, privacy masks in mobile replays, attribute allow-lists for metrics, privacy mode for AI traces, and configurable retention and deletion.
• Organization. Confidentiality obligations for everyone with access, incident response with the notification commitments in section 9, and SOC 2 Type II and ISO 27001 certification in progress.

Annex 3: Sub-processors

The following Sub-processors process Customer Personal Data. The list is also published in the Privacy Policy, where you can see every provider we use, including those that never touch Customer Data.

Notification destinations that Customer configures (Slack, Telegram, Pushover, GitHub, webhooks) are not Sub-processors: Customer chooses them and they receive data under Customer's own agreements with them.