Article 28 terms for the data your users send us.

This Data Processing Agreement (“DPA”) is between the customer named in the signature block (“Customer”) and BRAIN 2.0 LTD, company number 15493887, which operates Gotcha (“Gotcha”, “we”).

It applies when Gotcha processes personal data on Customer’s behalf through the Gotcha SDK, API and dashboard (the “Service”), and supplements the Terms of Service. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR. Terms such as “controller”, “processor”, “personal data” and “personal data breach” have the meanings given in Data Protection Law.

Customer is the controller and Gotcha is the processor of the personal data described in Annex I. Gotcha processes it only on Customer’s documented instructions, which are this DPA, the Terms, and Customer’s own configuration and use of the Service (for example the SDK props it sets, the webhooks it adds and the API calls it makes), unless the law requires otherwise. If we are legally required to process the data in another way, we will tell Customer first unless the law forbids it. We will tell Customer if we believe an instruction breaks Data Protection Law.

Customer is responsible for having a lawful basis for the data it collects through the Service and for giving its users the information Data Protection Law requires.

This DPA does not cover data for which Gotcha is itself the controller, such as the account details of Customer’s team and billing records. Our Privacy Policy covers those.

Only people who need access to run or support the Service may access Customer personal data, and each is bound by a duty of confidentiality.

We maintain the technical and organisational measures in Annex II, which are designed to meet Article 32. We may change them over time, but not in a way that lowers the overall level of protection.

Customer gives general authorisation for Gotcha to use the sub-processors listed on our sub-processor page (Annex III). We put a written agreement in place with each one that imposes data protection obligations equivalent in substance to this DPA, and we remain responsible to Customer for their performance.

Before a new sub-processor starts receiving Customer personal data, we update that page and email the contact who signed this DPA. Customer may object on reasonable data protection grounds within 30 days. If we cannot resolve the objection, Customer may terminate the affected part of the Service.

The Service gives Customer tools to answer requests from its users itself. With the project’s management key, Customer can:

• export a user’s responses: GET /api/v1/users/:id/export
• erase a user: DELETE /api/v1/users/:id deletes their responses and screenshots in that project and removes their id, email, name and metadata from any bug ticket linked to them. If they unsubscribed from notify-back emails, their address stays on that project’s unsubscribe list so the opt-out keeps working.

If a user contacts Gotcha directly, we pass the request to Customer and do not answer it ourselves. Where the tools are not enough, we will give reasonable help.

We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. The notice will describe what we know of the breach, the data and users likely affected, its likely consequences and what we are doing about it, and we will add detail as we learn it.

Taking into account the nature of the processing and the information available to us, we will give Customer reasonable help with its obligations under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation).

Gotcha does not delete Customer personal data on a schedule. It is kept until Customer deletes it or asks us to. Customer can:

• export or erase individual users through the API (section 06);
• delete a project from the dashboard (owners only), which deletes its responses, bug tickets, webhooks, keys and screenshots;
• ask us by email to delete its whole organisation and account; there is no self-serve account deletion yet.

When the Service ends, Customer can export its data before closing its account (CSV or JSON export on Pro, or per user through the API on any plan). On Customer’s written request we will delete the remaining Customer personal data, unless the law requires us to keep it. Copies in our database provider’s backups expire on that provider’s backup cycle.

We will make available the information reasonably needed to show that we meet this DPA, normally by answering Customer’s written questions. If that is not enough, Customer or an independent auditor bound by confidentiality may carry out an audit on at least 30 days’ notice, at Customer’s cost, no more than once a year unless a supervisory authority requires it.

Customer personal data is stored in the EU (Ireland) and our functions run there. Some sub-processors are US companies or run global infrastructure (Annex III). Where personal data is transferred outside the UK or EEA, we rely on a transfer mechanism recognised by Data Protection Law, such as the sub-processor’s standard contractual clauses with the UK addendum, or an adequacy decision.

This DPA lasts as long as Gotcha processes Customer personal data. Each party’s liability under it is subject to the limitations in the Terms. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. This DPA is governed by the law of England and Wales.

Subject matter

Collecting, storing and showing in-app feedback and bug reports that Customer’s users submit through the Service.

Duration

For the term of the Service, then until deletion under section 09.

Nature

Receiving, storing, displaying, exporting and deleting; sending notify-back emails when Customer marks a response shipped; delivering to webhooks Customer configures.

Data subjects

Users of Customer’s application who submit feedback or bug reports.

Personal data

Feedback content (text, ratings, votes, poll and NPS answers, bug reports); the user id, name, email and metadata Customer chooses to pass, or a random anonymous id; submission context (page URL or route, user agent, screen and window size, language, timezone, and recent JavaScript errors unless Customer turns them off); screenshots the user attaches. The full list is in section 02 of the Privacy Policy.

Special category

None intended. Customer should not configure the Service to collect special category data; users may still type it into free-text fields or show it in screenshots.

Frequency

Continuous, whenever a user submits.

In transit and at rest

• TLS on every connection to the Service, with HSTS.
• Database and file storage hosted by Supabase in the EU (Ireland), encrypted at rest by the provider.
• Screenshots kept in a private storage bucket, viewable only through short-lived signed links issued to signed-in members of the owning organisation.

Access

• Organisation roles (Owner, Admin, Member, Viewer); only owners can delete a project.
• The browser API key can only submit feedback. Reading, exporting and erasing data need a management key, which is meant for servers only.
• API keys stored as hashes; a small number of older keys are still being migrated.
• Optional allowlist of origins per API key.
• Rate limits on submission, API and dashboard routes.

Outbound data

• Webhook payloads signed with HMAC-SHA256; webhook URLs to private networks are refused.
• Notify-back emails carry a signed one-click unsubscribe link, honoured per project.

The current list, with purpose, data and location for each, is at gotcha.cx/legal/subprocessors. At version 1 of this DPA it is Supabase, Netlify, Upstash, Resend and Stripe.

Customer

Legal name, registered address, signatory name and title, date.

Processor

BRAIN 2.0 LTD (company number 15493887). Signatory name and title, date.