Fixback
Docs Sign in Start free

Legal

Data Processing Agreement

Last updated

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Wemuda ApS (“Fixback”, the processor) and the Customer (the controller). It applies whenever Fixback processes personal data on the Customer's behalf through the service, and meets the requirements of Article 28 of the General Data Protection Regulation (GDPR). It takes effect when the Customer accepts the Terms; no signature is needed.

1. Definitions

Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings the GDPR gives them. In this DPA:

  • Customer Personal Data is the personal data in Customer Data, as the Terms define it, that Fixback processes on the Customer's behalf;
  • Subprocessor is a third party Fixback engages to process Customer Personal Data;
  • Data Protection Law is the GDPR and the national law that supplements it, including the Danish Data Protection Act (databeskyttelsesloven).

2. Subject matter, duration, nature and purpose

  • Subject matter: providing the Fixback service to the Customer under the Terms.
  • Duration: for as long as the Terms apply, and afterwards until the Customer Personal Data is deleted under Deletion and return.
  • Nature: collection through the SDKs and the API, storage, analysis by AI models, transcription, display in the dashboard, delivery in alerts, transfer to coding agents and connected repositories as the Customer directs, and deletion.
  • Purpose: to turn the feedback and errors captured on the Customer's websites and apps into Issues and Briefs, let the Customer's Members triage them, and carry out the hosted Runs and handoffs they start.

3. Types of personal data and data subjects

Types of personal data

  • end-user identifiers the Customer's app or server supplies, such as a user ID, name or email address;
  • session replays and screenshots of the Customer's pages and screens (on the web, with input values masked by default);
  • console logs, error reports and stack traces, and network request metadata; request and response bodies only where the Customer turns their capture on;
  • feedback comments, annotations and marks a Reporter adds;
  • narration audio from a Walkthrough, and its transcript;
  • device, browser, operating system, page and environment data;
  • Reporter accounts: name, email address, and the Projects they report on.

Categories of data subjects

  • the Customer's end users, on whose sessions the SDKs run;
  • Reporters: people who send feedback on the Customer's sites or apps, such as its testers and team;
  • any other person whose data appears in what the Customer captures.

Special categories

The service is not intended for special categories of personal data. The Customer will not deliberately submit them, and configures the SDKs' masking and scrubbing to keep them out (see the SDK's privacy controls).

4. Processing on the Customer's instructions

Fixback processes Customer Personal Data only on the Customer's documented instructions, unless EU or member state law requires otherwise, in which case Fixback tells the Customer first unless that law forbids it. The Customer's instructions are the Terms, this DPA, and the Customer's configuration and use of the service, including its Members' actions in the dashboard and the API. Fixback tells the Customer if, in its opinion, an instruction infringes Data Protection Law.

The Customer is responsible for the lawfulness of the processing it instructs, including the notice it gives and any consent it obtains from its end users.

5. Confidentiality

Fixback ensures that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, and gives access only to those who need it to provide, secure or support the service.

6. Security

Fixback implements the technical and organisational measures in Annex 2 to protect Customer Personal Data, as Article 32 of the GDPR requires. Fixback may update them as technology and risks change, as long as the overall level of protection does not decrease.

7. Subprocessors

The Customer gives Fixback general authorisation to engage Subprocessors. The current Subprocessors are listed, with what they do and where, on the Subprocessors page.

Fixback announces a new or replacement Subprocessor at least 30 days before it processes Customer Personal Data, by updating that page and emailing the Owners of each workspace. The Customer may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, the Customer may stop using the affected part of the service, or end the Terms, and receive a refund of fees it prepaid for the period after the change.

Fixback imposes on each Subprocessor, in a written contract, data-protection obligations that are no less protective than this DPA, and remains liable to the Customer for its Subprocessors' performance of them.

8. International transfers

Fixback stores Customer Personal Data on servers it operates itself, at its offices in Copenhagen, Denmark, in the European Union. Fixback transfers Customer Personal Data outside the European Economic Area only with the safeguards Chapter V of the GDPR requires: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for a certified recipient, or the Commission's Standard Contractual Clauses, with additional measures where they are needed.

9. Assistance

  • Data subjects' requests. Taking into account the nature of the processing, Fixback helps the Customer answer requests from data subjects exercising their rights. If a data subject contacts Fixback directly about Customer Personal Data, Fixback passes the request to the Customer and does not answer it itself, unless the Customer asks it to.
  • Impact assessments and consultations. Fixback gives the Customer the information it reasonably needs for a data protection impact assessment, or a prior consultation with a supervisory authority, about the service.

10. Personal data breaches

Fixback notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as Fixback then knows, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Fixback adds what it learns later, takes reasonable steps to contain the breach, and helps the Customer meet its own obligations to notify.

11. Deletion and return

When an Owner deletes a workspace, an Owner can restore it for 30 days. After that, Fixback permanently deletes the workspace and its Customer Personal Data, including the screenshots, replays and narration stored with it. When Fixback deletes a workspace on termination, it is permanently deleted after 24 hours. The same applies when the Terms end. Before then, the Customer can retrieve its data through the dashboard and the API.

While the service runs, some data is deleted sooner: occurrence records, which link each repeat of an error to its Issue, are deleted 30 days after they happen by default, and the speech-to-text provider's copy of a transcript is deleted once Fixback has stored its own.

Fixback keeps Customer Personal Data after deletion only where EU or member state law requires it.

12. Information and audits

Fixback makes available to the Customer the information reasonably needed to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. If that is not enough, or a supervisory authority requires it, Fixback allows an audit by the Customer or an independent auditor it mandates who is bound by confidentiality: on at least 30 days' written notice, during business hours, no more than once a year unless a breach or an authority requires otherwise, without access to other customers' data, and at the Customer's cost.

13. Liability, precedence and law

Each party's liability under this DPA is subject to the limitations in the Terms, to the extent Data Protection Law allows. If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA prevails. This DPA is governed by the laws of Denmark, and disputes about it are settled by the courts of Copenhagen, Denmark, as the Terms provide.

14. Annex 1: The parties

  • Processor: Wemuda ApS, a Danish private limited company (anpartsselskab), CVR 38275437, Kronprinsessegade 54, 5., 1306 København K, Denmark. Contact: support@fixback.dev.
  • Controller: the Customer that accepted the Terms, as identified in its account and billing details. Contact: the Owners of its workspace.

15. Annex 2: Technical and organisational measures

Encryption

  • All traffic to and from the service is encrypted in transit with TLS, and the sign-in session cookie is sent only over HTTPS.
  • Credentials Fixback must read back, such as agent-connection credentials and its own model-provider keys, are envelope-encrypted with AES-256-GCM, under data keys wrapped by a master key held outside the database.
  • Secret keys and Members' API keys are stored only as hashes, and shown once.

Privacy by default in the SDKs

  • The web SDK masks input values before a screenshot is taken or a replay is recorded.
  • Every SDK scrubs reports before they leave the device or server: URLs lose their query strings, and email addresses, bearer tokens and long digit runs are removed from console and error text.
  • Network capture records request metadata only. Request and response bodies are captured only where the Customer turns that on, are size-limited, and are redacted on the device and again by the service.
  • A beforeSend hook lets the Customer redact more, or drop a report.

Hosted Runs

  • Each hosted Run works in its own isolated sandbox virtual machine.
  • A Run's access to GitHub uses installation tokens narrowed to what each step needs, minted for that Run and revoked when they are used: the clone token when the Run ends, and the write token once the pull request is opened.
  • A scrubber filters secrets out of a Run's output before it leaves the sandbox or is stored.

Access control and logging

  • Members reach only the workspaces they belong to, and Owners alone manage Members, billing and deletion.
  • Fixback's own staff reach customer workspaces only through an admin console limited to an allowlist of operators' verified email addresses, from a single admin origin. Every operator action requires a reason and is recorded in an audit log.
  • Webhooks from Stripe and GitHub are acted on only after their signature is verified.

Retention

  • Deleted workspaces are purged when their restore window closes, together with the files stored for them.