Everything your legal team will ask for

1. The documents

All of them are public, in three languages, and none of them requires a login. Forward this page and your legal team can start reading in the next minute.

Document	What it settles	Size
Data Processing Agreement	Art. 28 GDPR: instructions, confidentiality, sub-processors, deletion, audit rights	26k
Records of Processing	Art. 30 GDPR: every processing activity, its purpose, legal basis and retention	161k
Impact Assessment (DPIA)	Art. 35 GDPR: risks, mitigations, and the gaps we have not closed yet	98k
Technical & Organizational Measures	Art. 32 GDPR: encryption, access control, backups, monitoring	22k
Sub-processors	Who else touches the data, where they sit, and the state of each agreement	9k
Privacy Policy	What we process about you as a customer, not about your visitors	30k
Terms of Service	The contract itself, including the change-notice clause below	107k
Contract changelog	What changed in the Terms, the DPA and the sub-processor list, and why	6k
Right of withdrawal	Consumers only: right of withdrawal, deadline and the effect of an early start	10k
Text block for your own policy	Paragraphs you can paste into your privacy policy, ready to use	18k

2. How the DPA is concluded

There is no PDF to print, sign, scan and email back. The DPA is concluded when you accept the terms - and that acceptance is recorded properly:

• The exact version. We store SHA-256 hashes of the texts you accepted - the Terms, the DPA and the sub-processor list - not just a date. Two years later it is still provable which wording was in force.
• When and from where. Timestamp, IP address, language.
• Which route. Registration, a re-acceptance after a change, or an invitation into a workspace.

3. What happens when the terms change

Clause 27 of the Terms commits us to notifying you at least 30 days before a change takes effect. That is not a promise on a page - it is wired into the product:

• Changes are detected by comparing the document hash, never by a date field. A second edit cannot inherit the notice period of the first.
• The 30 days start from your notification, not from the date printed in the document. For existing customers those are different dates.
• You receive the notice by e-mail at the address on file, and a notice appears on the signed-in pages (except the replay player and the element assistant) until you acknowledge it; the acknowledgement is recorded like the original acceptance.
• If you object to a change to the Terms of Service, the contract continues on the previous terms until the end of the current billing period and then ends; on a free plan it ends when the change takes effect (clause 27; for consumers clause 32.6 applies). Your objection - by e-mail or through the support form with the reason "Contract Objection" - is handled by a person.

4. Where the data actually is

Servers in the EU. The sub-processor list names every recipient, what they receive and where they are located - and it states the status of each agreement, including where something is still open.

That last part is deliberate. A sub-processor list that only contains good news is a list nobody has checked.

Your visitors, your responsibility

For your visitors you are the controller and we are the processor. The data subject request page gives a visitor information on the number, period and websites of their recorded sessions and lets them have those sessions erased, and the text block above gives you the paragraph to put in your own policy.

5. Why this is on a sales page

Because in Europe it is usually not the tool that blocks a purchase. It is the three months between "we would like to use this" and "legal has approved it".

Every document above already exists, in your language, at a stable address. If your legal team finds something missing, tell us - the gaps in the impact assessment are listed in the document itself, and that list is maintained.