Data Processing Addendum

This addendum applies where the organization operating this Specto instance ("Processor") processes personal data on behalf of a customer ("Controller") through recorded sessions and feedback, and forms part of the Terms of Service.

Scope of processing

Subject matter: session replay, product analytics and feedback for websites and apps the Controller instruments. Nature: collection, storage, display, analysis and deletion. Data subjects: visitors of the Controller's websites and apps and the Controller's own users. Categories: interaction and technical data as described in the Privacy Policy, plus any identifiers and traits the Controller chooses to send. Form inputs are masked in the visitor's browser and never received. Duration: the plan retention window plus the backup cycle:

• Free: 30 days
• Pro: 90 days
• Business: 365 days
• Enterprise: 730 days

Processor obligations

The Processor processes personal data only on the Controller's documented instructions (the product configuration is such an instruction), ensures personnel are bound by confidentiality, implements the measures below, assists with data-subject requests and impact assessments, notifies the Controller without undue delay (and within 72 hours) after becoming aware of a personal-data breach, and deletes or returns data at the end of the service.

Subprocessors

None. All processing happens on infrastructure operated by the organization operating this Specto instance. Controllers are notified before any subprocessor is added.

Security measures

In-browser masking and attribute scrubbing before upload; server-side tenant isolation on every query; scrypt password hashing and httpOnly session cookies; two-factor authentication, passkeys and single sign-on through the Controller's identity provider (OIDC or SAML) with optional enforcement, IP allowlists and session limits; TLS in transit and private networking between services; integration and identity-provider secrets encrypted at rest; rate limiting, payload caps and strict validation on ingestion; least-privilege runtime (non-root, read-only containers, network policies); signed and replay-protected billing webhooks; an exportable audit log of administrative actions; automated retention deletion; offsite backups encrypted at rest, with tested restores.

International transfers

Where personal data is transferred outside the EEA/UK to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (and the UK Addendum), which are incorporated by reference.

Deletion and return

The Controller can delete projects (with all their recordings) in-product at any time, and its organization by deleting the owning account; deletions take effect immediately in the primary database and in object storage, and age out of backups on their 30-day cycle. On termination, data is deleted unless law requires retention.

Audits and contact

The Processor makes available the information necessary to demonstrate compliance and allows for reasonable audits on 30 days' notice. Contact: the Operator (contact details are available from your account administrator).

Governing law

This addendum is governed by the law that governs the Terms of Service.