Data Processing Addendum

1. Roles

For Customer Data that identifies an end developer or employee, you are the controller (or business) and AethelLayer is the processor (or service provider), except for account, billing, and security logs we process as an independent controller as described in the Privacy Policy.

2. Instructions

We will process personal data only on documented instructions from you, including via the Service configuration, API calls, and these Terms, unless law requires otherwise. If an instruction would break the law, we will tell you when legally allowed.

3. Nature and purpose

• Purpose: capture errors, run the inbox, draft tickets, provide analytics, support, and security.
• Duration: for the subscription term and a short wind-down, then deletion or return as below.
• Types of data: identifiers, emails you store, runtime/OS metadata, error payloads, messages, optional session links.
• Data subjects: your developers, teammates, and anyone whose data you send into a probe.

4. Security

We implement appropriate technical and organizational measures. Details live on our Security page. No measure is perfect. You remain responsible for classifying what you send and for not putting secrets into probes you do not intend us to store.

5. Subprocessors

You authorize us to use subprocessors for hosting, auth, email, and AI inference when enabled. We will impose data-protection terms no less protective than this DPA. A current list is available on request. We will give notice of material replacements when practicable.

6. International transfers

Where required, we rely on Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms. By using the Service you instruct us to make those transfers as needed to provide it.

7. Assistance, audits, deletion

We will assist with data-subject requests, DPIAs, and breach notices to the extent the information is available to us and the request is reasonable. We may charge our then-current professional-services rate for assistance beyond a reasonable questionnaire. Audits are limited to written questionnaires and SOC or equivalent reports when we have them, once per 12 months, on 30 days’ notice, entirely at your expense. On-site audits are refused unless a regulator requires them in writing. After termination we will delete or return Customer Data within 90 days, except backups, security logs, and data we must keep by law.

8. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms. Nothing here expands our liability beyond those caps except where law forbids a cap.