This addendum is part of the terms of service between the workspace owner ("customer") and PT. Solusi Hidup Mudah ("we"). It applies when we process personal data on the customer's behalf that is protected by the EU or UK GDPR, the Swiss data protection law, Indonesia's Personal Data Protection Law, or similar laws. No signature is needed; if you need a signed copy, email [email protected].
1. Roles
For the content of recordings the customer is the controller and we are the processor. For account and billing data we are the controller, as described in the privacy policy.
2. Details of the processing
| Subject matter | Storing and showing bug reports recorded with ReproClip. |
|---|---|
| Duration | While the customer uses ReproClip, plus the deletion periods in the privacy policy. |
| Nature and purpose | Hosting, storing, displaying, sharing at the customer's direction, and deleting. |
| Data subjects | The customer's members, and any person whose data appears in the recorded pages or screens. |
| Personal data | Whatever the recorded pages show or send: screen images, the recording person's voice when they turn the microphone on, page URLs, console messages, network requests and responses after redaction, other resource loads as metadata only, WebSocket connections without their messages, clicked element text, browser and device details. |
| Special categories | None intended. The customer should not record them, or should hide them with redaction rules and masking attributes. |
3. Our obligations
- We process the data only on the customer's documented instructions, which are these terms and the customer's use of the app, unless the law requires otherwise; we will tell the customer if we think an instruction breaks data protection law.
- Everyone who can access the data is bound by confidentiality.
- We apply the security measures in section 5.
- We help the customer answer data subject requests and meet its obligations on security, breach notification, impact assessments and consultations, taking into account the information available to us.
- We notify the customer of a personal data breach affecting its data without undue delay, and within 72 hours of becoming aware of it, with the information we have.
- When the customer deletes recordings, a workspace or its account, we delete the data within the periods in the privacy policy, unless the law requires us to keep it.
- We make available the information needed to show compliance with this addendum, and allow audits by the customer or its auditor once a year on 30 days' notice, at the customer's cost, where written information is not enough.
4. Sub-processors
The customer authorises the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Application servers and database | Germany |
| Cloudflare, Inc. | File storage (R2), DNS and network protection | European Union (files); global network |
| Amazon Web Services, Inc. | Email delivery (Amazon SES) | United States |
| Functional Software, Inc. (Sentry) | Error reports from our servers | European Union |
We impose data protection terms on each sub-processor that are at least as protective as this addendum, and remain responsible for them. We will update this page and email workspace owners at least 14 days before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds; if we cannot resolve the objection, the customer may cancel and receive a prorated refund of prepaid fees.
5. Security measures
- Passwords, tokens, cookies, authorization headers and card numbers are redacted in the browser before upload; input values are never recorded; customers can add their own redaction rules.
- All traffic uses HTTPS. Stored files are private, encrypted at rest, and reachable only through signed links that expire after 15 minutes.
- Workspace-only recordings require signing in as a member. Extension tokens are limited to the endpoints the extension needs and can be revoked.
- Sign-in uses Google or GitHub; we store no passwords. Access to production systems is limited to the people who operate ReproClip.
- On Free workspaces, and after a paid plan ends, videos and screenshots are deleted automatically after 60 days. Paid plans keep recordings until the customer deletes them.
6. International transfers
We are in Indonesia; our servers and stored files are in the European Union, and our email sub-processor is in the United States. For personal data transferred from the European Economic Area to us or to that sub-processor, the parties enter into the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated by reference with these choices: clause 7 does not apply; clause 9 option 2 with the notice period in section 4; clause 11 optional wording does not apply; clauses 17 and 18 are governed by and resolved in Ireland. Annex I is section 2 of this addendum, Annex II is section 5, and Annex III is section 4. For the United Kingdom, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.
7. Liability and precedence
The limits of liability in the terms of service apply to this addendum. If this addendum conflicts with the terms, this addendum prevails; if it conflicts with the Standard Contractual Clauses, the clauses prevail.