1. Definitions

1.1 Applicable Data Protection Law: all laws and regulations applicable to the processing of Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, and the California Consumer Privacy Act as amended (“CCPA”).

1.2 Personal Data: any information relating to an identified or identifiable natural person that Site Qwality processes on Your behalf in connection with the Services.

1.3 Processing, Controller, Processor, Data Subject, and Supervisory Authority have the meanings given to them in Applicable Data Protection Law.

1.4 Subprocessor: any third party engaged by Site Qwality to process Personal Data on Your behalf.

2. Roles and Scope

2.1 As between the parties, You are the Controller (or, where You act on behalf of Your Clients as an MSP, a Processor) and Site Qwality is a Processor of Personal Data submitted to the Services.

2.2 Site Qwality will process Personal Data only on Your documented instructions, including with regard to transfers, unless required to do otherwise by law; in such a case, Site Qwality will inform You of that legal requirement before processing unless the law prohibits it. The Agreement, this DPA, and Your configuration and use of the Services constitute Your documented instructions.

2.3 Site Qwality also acts as a Controller in its own right for account administration, billing, its marketing websites, and its own security and audit records. That processing is described in the Privacy Policy and is outside the scope of this DPA.

3. Details of Processing

3.1 Subject matter and duration: the provision of the Services for the Term of the Agreement, until deletion of Personal Data in accordance with Section 9.

3.2 Nature and purpose: hosting, monitoring, alerting, observability ingestion and display (uptime checks, logs, metrics, traces, real user monitoring, session replay), status pages, notification delivery, billing, and support.

3.3 Categories of Data Subjects: Your Users (employees, contractors, consultants); end users of Your monitored websites and applications to the extent You configure the Services (for example real user monitoring or session replay) to collect data about them; recipients of notifications You configure, including recipients who hold no account with Site Qwality; and any natural person identifiable from content You submit to the Services.

3.4 Categories of Personal Data: account and contact details (name, email address, phone number); authentication identifiers; notification destinations; IP addresses, device and browser metadata, page URLs and resource URLs, error messages and stack traces, and session interaction data collected by the SDK where You enable it; the request headers, response header map, response extract and resolved remote address recorded by each monitoring check, which includes any authentication header You configure on that check; and any Personal Data contained in logs, metrics, traces, or other content You submit to the Services. The Services are not designed for and must not be used to submit special categories of data as defined in Article 9 GDPR.

3.4.1 URL minimisation, and where it does not reach. URLs collected by the SDK are stripped before storage, in the browser before transmission and again in the ingest service on receipt: everything from the first # onwards is removed, everything from the first ? onwards is removed, and any user:password@ credentials are removed from the authority. The scheme, host, port and path are preserved exactly, so a URL carrying Personal Data in its path is stored as it is. The same rules are applied to URLs found inside error messages and stack traces, leaving the surrounding message text and the line and column numbers intact. Four categories are outside that stripping: URLs embedded in the recorded document of a session replay, which are captured as the page carries them; the context object You attach to an error or an action, which is Yours and is stored verbatim; up to 30 characters of the text or CSS selector of an element an end user clicked; and a URL written without a scheme inside free text, which is deliberately not detected. Nothing in the stripping is a substitute for Your own obligation not to put Personal Data into a URL.

3.5 Session replay defaults, stated explicitly: where You enable session replay, the Services record the rendered document of the pages Your end users view. Page text is not masked by default. Input masking is a per-application privacy setting, and until a recent fix it was stored switched off on every application at the moment it was created, whether created in the dashboard or through the API. It stayed off unless someone opened that application’s privacy settings and turned it on. Site Qwality has not altered the stored settings of existing applications, so any application You have not explicitly changed is still recording form input values unmasked, and You should check the setting on every application You operate. You are the Controller for this processing and it is Your responsibility to set the masking configuration You require and to establish a lawful basis for it.

3.6 Element-level control, stated per class because the three classes behave differently. Control is exercised through three rrweb CSS classes. Add them to the element’s class attribute, for example <div class="rr-mask">. They are class names, not HTML attributes: <div rr-mask> has no effect.

  • rr-mask replaces the text inside the element, and inside everything nested within it, with asterisks. It cascades to descendants. It masks text only: it does not mask input values, and it does not mask attributes such as placeholder, alt, title or aria-label, which are recorded as written.
  • rr-block stops the element being recorded at all. The recording keeps a blank placeholder of the same size and does not descend into it, so everything nested inside is covered too.
  • rr-ignore stops input events being recorded on the element that carries the class. It does not cascade. The class is read from the element that received the event and nothing walks up the tree, so <div class="rr-ignore"><input name="ssn"></div> gives that input no protection at all; the class must be on the <input> itself. Even placed correctly it suppresses only later typing: a value already present in the field when the recording starts is captured in the initial snapshot unless input masking is on.

3.7 What input masking covers. When it is on, the value is replaced with one asterisk per character before it leaves the browser, for these input types and no others: color, date, datetime-local, email, month, number, password, range, search, tel, text, time, url and week, plus <textarea> and <select>. An <input type="hidden">, or any other type outside that list, keeps its value; a radio button or checkbox has its value string recorded unmasked alongside its checked state; and no element attribute is ever masked. When input masking is off, type="password" is the only type masked. rr-unmask, data-sq-mask and data-sq-unmask do not exist in the recorder Site Qwality runs; earlier Site Qwality material described them and applying them changes nothing.

4. Confidentiality

Site Qwality ensures that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Every person and contractor with access to production systems has signed a written confidentiality undertaking.

5. Security

5.1 Site Qwality implements and maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the costs of implementation and the nature, scope, context, and purposes of processing.

5.2 The measures in place as at the date of this DPA are:

  • Encryption in transit for all connections between You and the Services. Every public API domain enforces a minimum of TLS 1.2 and the web properties redirect HTTP to HTTPS. This statement is scoped to customer-facing connections and is not a statement about every internal service-to-service hop.
  • Encryption at rest for object storage and for the analytics data volume. All Site Qwality object-storage buckets use AES-256 server-side encryption with provider-managed keys and have public access blocked on all four settings; message queues are encrypted at rest; the storage volume holding logs, metrics, traces, real user monitoring and the replay index is encrypted. This is not a statement that every data store is encrypted at rest.
  • Credential handling. Passwords are hashed with Argon2 and primary authentication is delegated to a specialist identity provider. API keys are persisted only as a one-way SHA-256 digest; the plaintext secret is never stored. Payment card data is captured entirely within the payment processor and never reaches Site Qwality systems.
  • Multi-factor authentication, available to Your Users through time-based codes and passkeys, and mandatory for Site Qwality staff. The staff organization in Site Qwality’s identity provider requires a second factor on every staff sign-in. That requirement is held as a policy in the identity provider rather than in Site Qwality application code, so it is enforced at sign-in.
  • Role-based access control across four dashboard roles plus an auditor role, enforced from the session token rather than from a local database column.
  • Application-layer audit logging. Mutating authenticated requests are recorded with actor, action, method, path, result, request IP address and user agent, and are readable by You, including requests that were identified and then denied. That write is best-effort by design so that a logging failure can never fail the underlying request, which means a database outage can leave a gap in the log, and two endpoints that use a mutating method only to carry a read query are exempt. Every Site Qwality staff administrative request is recorded in a separate internal log, including a reason recorded for any access to a customer account; that log is not readable by You. These are application-layer records; they are not a claim about infrastructure-level access logging.
  • Tenant scoping applied at the API layer before any storage read, and parameterised queries with bind values on the transactional database.
  • Bot mitigation on the unauthenticated signup endpoint and request-rate throttling on eight of nine API gateway stages. The ninth is an abandoned test gateway that serves no part of the Services and holds no data; it carries no throttle and is scheduled for deletion.
  • Deletion protection on the production database with automated backups retained for 7 days.

5.3 This list is exhaustive. Where a measure is not stated above, You should not assume it is in place. Site Qwality holds no security certification of its own: there is no SOC 2 report, no ISO 27001 certificate and no published penetration test for Site Qwality. Certifications referenced anywhere in relation to the Services are those of Site Qwality’s infrastructure subprocessors. Further detail is published on the Security page.

6. Subprocessors

6.1 You provide general authorization for Site Qwality to engage Subprocessors. Site Qwality remains fully liable to You for the acts and omissions of its Subprocessors as if they were Site Qwality’s own.

6.2 The authoritative, dated and versioned list of Subprocessors is published at siteqwality.com/subprocessors/. That page carries a changelog so that a change can be identified and compared against the previous version. It supersedes any list embedded in an earlier version of this DPA or in any partner addendum.

6.3 The Subprocessors engaged for the Services are listed on the Subprocessors page (vendor, location and function). That page is authoritative if it and this clause differ.

6.4 Alert destinations You configure yourself (for example PagerDuty, Discord, Microsoft Teams, or a webhook URL You supply), other than integrations where Site Qwality holds the vendor relationship (Telegram bot delivery and Site Qwality’s Slack app), are recipients You choose and contract with directly, not Subprocessors of Site Qwality.

6.5 Site Qwality will provide notice of any intended addition or replacement of Subprocessors by updating the Subprocessors page at least 14 days before the change takes effect. The changelog on that page records the effective date of every change. If You object on reasonable data protection grounds and the parties cannot resolve the objection, You may terminate the affected Services in accordance with the Agreement.

7. Assistance

7.1 Taking into account the nature of the processing, Site Qwality will assist You by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Your obligation to respond to requests from Data Subjects exercising their rights. If Site Qwality receives such a request directly, it will redirect the Data Subject to You where lawful to do so.

7.2 Site Qwality will assist You in ensuring compliance with Your obligations regarding security, breach notification, data protection impact assessments, and prior consultation with Supervisory Authorities, taking into account the nature of processing and the information available to Site Qwality.

7.3 What that assistance is today. The Services expose self-service export for HTTP check results, the monitor uptime summary and telemetry logs, and they expose deletion of a monitor, a real user monitoring application, a session filter and a source-map release. They do not expose deletion of an individual end-user session, replay, event or user identity, and they do not expose deletion of ingested log data by predicate. Assistance with those requests is a manual operation performed by Site Qwality staff against its databases and object storage on Your written request to privacy@siteqwality.com. Site Qwality will confirm to You what was deleted and when, so that You can evidence it to the Data Subject.

8. Personal Data Breach

Site Qwality will notify You without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting Personal Data processed under this DPA, and will provide information reasonably available to it to support Your notification obligations.

9. Deletion and Return

9.1 What happens on termination today. On termination or expiry of the Agreement, or when You ask us to close Your account, Site Qwality marks the account deleted. That immediately ends access to the dashboard and the API. It does not by itself erase every stored copy of Personal Data. Records remain in Site Qwality databases and object storage until they either fall out of an enforced retention window (see the Data Retention page, which states category by category where a window is enforced and where none is in place today) or are deleted on request under Section 9.2.

9.2 Deletion on request. If You want Personal Data deleted rather than retained, ask us in writing at privacy@siteqwality.com. Deletion is executed as a manual operation across the transactional database, the analytics store, object storage and the relevant Subprocessors. Site Qwality will confirm the scope of what was deleted and the date it completed.

9.3 Return. Return of Your Data is available through the export functions the Services expose: HTTP check results, the monitor uptime summary, and telemetry logs. Any other category must be requested from Site Qwality and is produced manually.

9.4 Backups. Automated database backups are retained for 7 days from the point each backup is taken. Personal Data erased from live systems can therefore persist in a backup for up to 7 days after erasure, after which that backup expires on its own schedule. Site Qwality does not restore a backup in order to re-apply an erasure.

9.5 Retention required by law. Site Qwality and its payment processor retain billing, invoice and tax records for the period required by law, notwithstanding a deletion request.

10. Audits

Site Qwality will make available to You information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by You or an auditor mandated by You, no more than once per year, on at least 30 days notice, during normal business hours, and subject to reasonable confidentiality obligations. The parties agree that audits are first satisfied by written responses and by available third-party documentation. Site Qwality holds no audit report or certification of its own; the third-party documentation available to You is that of its infrastructure Subprocessors.

11. International Transfers

11.1 All of Site Qwality’s own infrastructure is in the United States, in the AWS us-east-1 region. This covers the transactional database, the analytics store, all object storage, all serverless compute and the execution of every monitoring check.

11.2 There is no EU or UK data-residency option, for storage or for processing. If Site Qwality brings another region into service it will update the Privacy Policy and this DPA before doing so. Clause 11.1 is deliberately scoped to Site Qwality’s own infrastructure and is not a representation that no Personal Data is processed outside the United States: clause 11.4 acknowledges onward transfers, and the Subprocessors page states each Subprocessor’s location.

11.2.1 Content delivery. Site Qwality operates six content delivery distributions and all six use a price class that includes European edge locations, so a request originating in Europe is terminated in Europe. Two serve public files only, two serve status pages (one of them on a customer’s own domain) and two front Site Qwality’s internal staff portal, one of which proxies staff requests to the API and therefore carries customer account data. None of the six has access logging enabled.

11.3 Where Personal Data protected by the GDPR or UK GDPR is transferred to Site Qwality in the United States, the parties agree that the European Commission Standard Contractual Clauses (Module Two or Module Three, as applicable) will apply and are available on request for execution, with Site Qwality as data importer and You as data exporter, together with the technical and organizational measures in Section 5. The UK Addendum applies to transfers subject to the UK GDPR where required. Site Qwality does not claim certification under the EU-US Data Privacy Framework.

11.4 Onward transfers to Subprocessors are listed, with their processing locations, on the Subprocessors page.

11.5 Representative in the EU and the UK. Site Qwality has not appointed a representative in the European Union under Article 27 GDPR, and has not appointed a representative in the United Kingdom. It does not intend to appoint either. Anything You or a Data Subject would send to a representative should be sent to privacy@siteqwality.com, or to Site Qwality’s registered postal address, both of which are published in the Privacy Policy.

12. Liability and Order of Precedence

The liability of each party under this DPA is subject to the limitations of liability set out in the Agreement. In case of conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA prevails.