Data Processing Agreement

Last updated: July 2026

Scope

This Data Processing Agreement (“DPA”) applies where Loopyback processes personal data on behalf of a customer’s organization (the “Controller”) in the course of providing the Service, and forms part of our Terms of Service. For that processing, Loopyback acts as a processor within the meaning of Article 28 GDPR.

Nature of the processing

Loopyback hosts, stores, and displays the workflow guides your team captures, including screenshots and step descriptions, along with workspace member details (name, email, role) needed to operate your workspace. The duration of processing is the term of your subscription, plus a short deletion window after termination.

Our commitments

• We process personal data only on your documented instructions, including with regard to transfers.
• We ensure persons authorised to process the data are bound by confidentiality.
• We implement appropriate technical and organisational measures, including encryption in transit, row-level access controls, automatic PII redaction of captured screenshots, and access-token-gated sharing.
• We assist you in responding to data subject requests and in meeting your security and breach-notification obligations.
• We notify you without undue delay after becoming aware of a personal data breach affecting your data.
• Upon termination, we delete personal data processed on your behalf, unless retention is required by law.
• We make available the information necessary to demonstrate compliance and allow for audits as required by Article 28 GDPR.

Subprocessors

You authorise the following subprocessors. Where a subprocessor processes data outside the EEA, transfers are protected by Standard Contractual Clauses or an adequacy decision. We will give notice before adding or replacing subprocessors, giving you the opportunity to object.

Signed copy

Enterprise customers who require a countersigned DPA, or have questions about this agreement, can contact legal@loopyback.com.