This DPA applies where Rebase (Rebase Technologies Ltd, a company registered in England and Wales (Company No. 17380046), “Processor”) processes personal data on behalf of the Customer (“Controller”) in providing the service, and where such processing is subject to data-protection laws including the EU/UK GDPR. Capitalized terms not defined here have the meaning in our Terms of Service.
1. Roles & scope
The Customer is the controller and Rebase is the processor of personal data contained in Customer Data (the reports, packets, replays and other details captured through the widget). Rebase processes that data only to provide the service and per the Customer’s documented instructions (including these Terms and configuration choices). As controller, the Customer is responsible for establishing a lawful basis for capturing end-user data, obtaining any required consent, and providing notice to its end-users before the widget runs; see the Privacy & Compliance Guide for how to configure masking and gate the widget behind consent.
2. Nature & purpose of processing
Receiving reports and packets; recording replays where the Customer turns them on; AI triage; sending reports to connected issue trackers and Slack; notifications; and providing support, security, and billing.
3. Categories of data subjects & personal data
- Data subjects: the Customer’s teammates, and the end-users of the Customer’s website who send reports or packets or appear in them.
- Personal data: names, email addresses and any user ID the Customer’s website supplies; report and packet content; answers to follow-up questions; and captured details (screenshots, replays, console/network metadata, device/browser information and the steps before a report), subject to the masking and scrubbing described in the Privacy Policy.
- Special-category data: not intended to be processed. The Customer must configure masking to avoid submitting it.
4. Processor obligations
- Process personal data only on documented instructions from the Controller;
- Ensure personnel authorized to process data are bound by confidentiality;
- Implement appropriate technical and organizational measures (Annex II);
- Assist the Controller with data-subject requests and with security, breach-notification, and impact-assessment obligations, taking into account the nature of processing;
- Delete or return personal data at the end of the service as described below.
5. Subprocessors
The Customer authorizes Rebase to engage the subprocessors listed on our Subprocessors page. Rebase imposes data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for their performance. Rebase will give at least 14 days’ notice of intended additions or replacements before they take effect, by updating the Subprocessors page and emailing everyone on the subprocessor-change notification list (the Customer joins it by asking support@rebase.dev), and the Customer may object on reasonable data-protection grounds. If an objection cannot be resolved, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period.
6. International transfers
Rebase’s own infrastructure is hosted in the United Kingdom, and email is delivered from the EEA (Ireland); certain subprocessors listed on the Subprocessors page process data in the United States. Where processing involves transferring personal data outside the EEA/UK to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated by reference.
7. Security measures (Annex II)
- Encryption of personal data in transit (TLS) and at rest;
- Screenshots and replays stored in private object storage, shown only to signed-in members of the Customer’s workspace (screenshots also to a coding agent using an access token a member creates, and in the issues Rebase creates in trackers the Customer connects);
- Client-side hard-blocking of password, payment, OTP, hidden, and telephone field values, which are never captured and cannot be re-enabled by configuration; masking of all other typed values by default and of any element the Customer marks; in replays, typed values are always masked and page text and images are hidden unless the Customer chooses to show them; plus URL/secret scrubbing before capture, and a second server-side scrubbing pass on ingest;
- Short-lived, rotated authentication tokens; least-privilege access to production;
- Logging, monitoring, and regular review of access.
8. Data-subject requests
Taking into account the nature of processing, Rebase will assist the Controller by appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests. If a data subject contacts Rebase directly, we will refer them to the relevant Customer.
9. Personal data breaches
Rebase will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Customer Data, and will provide information reasonably available to assist the Controller’s own obligations.
10. Deletion & return
On termination, Rebase will delete or return Customer Data within a reasonable period, except where retention is required by law. While the service runs, screenshots, replays and captured diagnostic details are deleted after the Customer’s plan evidence history (30, 90 or 180 days; replays after at most 30 days). Backups are purged on their normal rotation: database backups within 60 days, and deleted files within 7 days.
11. Audits
Rebase will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for audits subject to reasonable confidentiality, scope, and frequency limits.
12. Liability
Each party’s liability arising out of or in connection with this DPA is subject to the exclusions and the aggregate cap in §10 of the Terms of Service, and liability under this DPA and the Terms counts toward a single combined cap — except where data-protection laws do not permit liability to data subjects or supervisory authorities to be limited in this way.
13. Contact
To request a countersigned copy of this DPA or to raise a data-protection matter, email support@rebase.dev.