Data Processing Addendum

Last updated: 29 October 2026

Damper is provided by Studio 404 d.o.o., Gradišče 15C, 1360 Vrhnika, Slovenia, EU, company registration no. 6835228000, VAT ID SI42531357 ("Damper", "we", "us"), contact: [email protected].

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you (the "Customer", controller) and Studio 404 d.o.o. (processor). It applies to personal data in Customer Data that Damper processes when providing the Service, and sets out the terms required by Article 28 of Regulation (EU) 2016/679 (GDPR). It applies automatically when you accept the Terms; no signature is needed.

1. Details of processing

2. Processor obligations

• Damper processes personal data only on the Customer's documented instructions: these Terms and this DPA, and the Customer's use and configuration of the Service. If Union or Member State law requires other processing, we will tell the Customer first unless the law prohibits it.
• We tell the Customer promptly if, in our opinion, an instruction infringes data-protection law.
• Everyone authorised to process Customer Data is bound by confidentiality.
• We implement the technical and organisational measures in section 3.
• Taking into account the nature of the processing, we assist the Customer with data-subject requests (Articles 12 to 23), with security, breach notification, data-protection impact assessments and prior consultation (Articles 32 to 36). Most requests can be handled directly in the Service (for example deleting feedback); if a data subject contacts us directly about Customer Data, we forward the request to the Customer.

3. Technical and organisational measures

• Encryption in transit: the API, dashboard, widget and website are served only over HTTPS (TLS). The application connects to its database over TLS, and the API tells browsers to use only HTTPS (HSTS, one year).
• Encryption at rest: the database and file storage are encrypted at rest by our hosting provider (Railway). Integration credentials (Slack and X tokens), custom headers of status checks, project identity-verification secrets, webhook signing secrets and two-factor secrets are additionally encrypted in the database with AES-256-GCM.
• Credentials: passwords and API keys are stored only as bcrypt hashes, and API keys are shown once. OAuth tokens and two-factor recovery codes are stored as hashes. Outgoing webhooks are signed (HMAC-SHA256) so the Customer can verify they come from us.
• Sign-in security: two-factor authentication (authenticator app) is available to every user, and a team can require it for all members. Sessions use an HttpOnly, Secure cookie that expires after 7 days; turning two-factor authentication on or off, or replacing it, signs out the user's other sessions. Requests that change data with a session cookie are accepted only from our own dashboard.
• Separation: every request is authorised against one account and the projects the user may access, and every database query is limited to them.
• Abuse protection: rate limits on sign-in and sign-up, on the API, the AI features, error ingestion and public forms, and on emails sent from public forms.
• Privacy by design: public boards and pages remove email addresses, phone numbers, payment and tax identifiers and similar data from user-submitted text before showing it. Feedback that appears to contain such data, or comes from an internal source such as Slack, starts as private. Seven days after a feedback item is done or closed, its personal data (text, contact details, technical context and screenshots) is removed automatically; backend error reports are excluded from this.
• Error monitoring: error reports sent to our error-monitoring provider contain no request bodies, headers, cookies or query values, and identify a user only by user ID.
• Availability and recovery: the database is backed up every day to storage in the EU. Each backup is test-restored when it is made, then encrypted (age, X25519) with a key that is kept offline, outside our systems; backups are deleted after 30 days. If a backup does not arrive, an alert reaches the people who operate the Service.
• Access control: access to production systems and data is limited to the people who operate the Service.
• Reviews: we review the code and configuration of the Service for security issues, most recently in October 2026, and fix what we find.

We review these measures as the Service changes and may update them, as long as the overall level of protection does not decrease. Damper does not currently hold a third-party security certification (such as ISO 27001 or SOC 2).

4. AI features

The Service uses AI models from OpenAI and Anthropic. New feedback is summarised automatically: the model receives the feedback's title, text and type, the visitor's plan or tier, the page address, browser details and the captured technical context, together with the project's description. Backend error reports are triaged automatically: the model receives the error's title, service, environment and log excerpt. When a user asks for it, the models also receive a page's content (page summaries and meeting action items) or a task's title and description (roadmap suggestions). The results are stored in the Service. The AI providers process this data as our sub-processors; under their API terms they do not use it to train their models and keep it only for a limited period for abuse monitoring.

5. Sub-processors

The Customer gives general authorisation for the sub-processors listed on the sub-processors page. We bind each by a written contract to data-protection obligations no less protective than this DPA, and remain responsible to the Customer for their performance. We will give at least 30 days' notice before a new or replacement sub-processor starts processing Customer Data, by updating that page and emailing the owner of every account. The Customer may object on reasonable data-protection grounds within that period. We will then try to find a solution; if we cannot, the Customer may terminate the affected part of the Service, and we will refund any prepaid fees for the period after termination.

Integrations the Customer connects (such as Slack or X), webhooks it configures and the addresses it monitors with status checks receive data on the Customer's instructions; they are the Customer's own providers, not our sub-processors.

6. International transfers

Customer Data is stored in the EU (section 1). Where we or a sub-processor transfer personal data outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), which are incorporated into this DPA by reference where needed, together with supplementary measures where required. The mechanism for each sub-processor is listed on the sub-processors page.

7. Return and deletion

• The Customer can delete individual items in the Service at any time, and retrieve its data through the API and the data export in Settings during the term.
• When the account owner deletes the account, it is scheduled for deletion and can be restored by signing in again within 30 days. After those 30 days, Customer Data is deleted, including stored files, unless Union or Member State law requires us to keep it. Copies in backups are deleted as the backups roll off, within a further 30 days.
• When the agreement ends for another reason, we delete Customer Data in the same way, within 60 days.
• On request we confirm the deletion in writing.

8. Personal-data breaches

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Customer Data. The notice goes to the email address of the account owner and describes, as far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We provide further information as it becomes available and help the Customer meet its own notification duties.

9. Audits

On reasonable request, we make available the information necessary to demonstrate compliance with Article 28 GDPR: written answers to security questionnaires, a description of our measures and the relevant sub-processor documentation. Requests can be made once a year, and in addition after a personal-data breach or when a supervisory authority requires it. Where this information is not sufficient, the Customer (or an independent auditor bound by confidentiality and not a competitor of ours) may carry out an audit with at least 30 days' notice, during business hours, without disrupting the Service or accessing other customers' data, and at the Customer's cost. Audits of sub-processors take place through their own audit reports and certifications.

10. Customer obligations

The Customer is responsible for the lawfulness of its processing, including having a legal basis (and consent where required) for collecting data through the widget and its other channels, informing its users and visitors (for example in its own privacy notice), and the content it submits or publishes.

11. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms of Service, except where the law does not allow it. If this DPA conflicts with the Terms on data protection, this DPA prevails; the Standard Contractual Clauses, where they apply, prevail over both.

12. Contact

Data-protection requests and security incidents: [email protected]. If you need a signed copy of this DPA, write to [email protected].