Data Processing Agreement

1. Scope and roles

This agreement covers the personal data in the log lines your apps send to Logyak: lines we receive from a log drain or log stream you set up (Vercel, Netlify, Render), lines we pull from Railway with the API token you give us, and lines your own code sends over HTTP ("customer personal data"). For it, you are the controller and we are the processor. Words such as "controller", "processor", "personal data breach" and "data subject" have the meaning given in the GDPR.

If this agreement and the Terms conflict about customer personal data, this agreement wins.

2. Details of the processing

3. Our obligations as processor

We will:

• process customer personal data only on your documented instructions, which are the Terms, this agreement and your use of the service's settings, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it), and tell you if we believe an instruction breaks data protection law;
• make sure everyone allowed to process it is bound by confidentiality;
• take the security measures in section 6;
• use sub-processors only as section 7 allows;
• help you, taking into account the nature of the processing, to answer data subjects' requests (section 8), and with security, breach notification, data protection impact assessments and consultation with a regulator;
• delete the data when the service ends (section 9);
• make available the information needed to show we comply, and allow audits (section 11);
• never sell customer personal data, use it for our own purposes, use it to train AI models or for advertising, or combine it with data from other customers or sources (including as a "service provider" under the CCPA/CPRA).

4. Your obligations as controller

You decide what your apps log and send to us. You confirm that you have a lawful basis for the processing, have given the people concerned the information the law requires (including that a log service processes your logs for you), send us only the personal data you need for running and fixing your apps, avoid sending secrets in your logs, and that your instructions comply with the law.

5. International transfers

Customer personal data is stored in Singapore and may be accessed by the sub-processors in section 7 in the countries listed there. Where a transfer from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) and, for onward transfers, Module 3, are incorporated into this agreement, with the UK International Data Transfer Addendum and the Swiss amendments where those apply. [Annex details and clause options (docking clause, Clause 9 option, Clause 17 governing law, Clause 18 courts) to be completed by the lawyer.]

6. Security measures

• Encryption in transit: HTTPS (with HSTS) for every log drain, push and API request, TLS for syslog streams; encryption at rest by our hosting provider.
• Each log source has its own ingest token, stored only as a SHA-256 hash and checked in constant time; it can be rotated at any time and the old one stops at once.
• Railway API tokens and Vercel drain secrets you give us are encrypted with AES-256-GCM and never shown again. Passwords, API keys and session tokens are stored only as hashes.
• Workspace scoping: every query for log lines and sources is limited to the workspace the user may see; roles inside workspaces; staff access limited by role, re-checked on every request and audited. Staff screens show volumes, never log lines.
• Size and rate limits on log intake: batches, line count, message (16 KB) and attributes (8 KB) are capped.
• Masking before AI: when a user asks for an AI explanation, IP addresses, email addresses, bearer tokens, JSON web tokens, card-like numbers and key=value secrets are replaced with placeholders on our server, and client IP addresses are left out, before any line reaches the AI provider. At most 60 lines are sent per request, only when a user clicks.
• Raw provider errors are never shown to users or sent by email.

7. Sub-processors

You give general authorisation for us to use sub-processors. The current ones that can process customer personal data are:

Railway, Vercel, Netlify and Render, when they send us your logs, act as your own providers under your agreement with them, not as our sub-processors.

We impose data protection terms on each sub-processor that are no less protective than this agreement and remain responsible for them. We will announce a new or replaced sub-processor on this page and by email to account owners at least 30 days before it starts; you may object on reasonable data protection grounds by emailing hello@logyak.com within that period, and if we cannot resolve it, you may end the affected service and receive a refund of prepaid fees for the remaining period.

8. Data subject requests

If someone whose data is in your logs contacts us directly, we will pass the request to you without undue delay and not answer it ourselves unless you ask us to. You can search your logs for that person in the app and delete a whole source and all of its lines at once; for anything more targeted, email us and we will help.

9. Deletion and return

Log lines are deleted when they pass your plan's retention. When you delete a source, all of its lines are deleted at once. When your account closes, we delete customer personal data within 30 days, unless the law requires us to keep it; data in backups is overwritten on the hosting provider's normal cycle. Monthly usage counts per source (numbers of lines and bytes, no log content) are kept as billing records. Before closing, plans with API access can read their lines through the search API.

10. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data, with what we know about its nature, the data and people affected, likely consequences and the measures taken, and update you as we learn more. Notifying a regulator or data subjects is your decision as controller; we will help.

11. Audits

We will answer reasonable written questions about our compliance and share relevant documentation. If that is not enough to show compliance, or a regulator requires it, you may audit us, at your cost, no more than once a year, on 30 days' notice, during business hours, by an auditor bound by confidentiality, without access to other customers' data.

12. Liability and term

Each party's liability under this agreement is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses do not allow a limit. This agreement lasts as long as we process customer personal data for you.