SpinUI Data Processing Addendum

Effective date: 12 November 2026

This Data Processing Addendum ("DPA") forms part of the SpinUI Terms of Service (the "Agreement") between Digiport OÜ ("SpinUI", "Processor") and the customer that accepts it ("Customer", "Controller"). It applies when SpinUI processes Customer Personal Data on Customer's behalf. It is incorporated into the Agreement by reference and applies automatically from the moment Customer accepts the Agreement; no signature is needed. A customer that needs a signed copy can ask for one at support@spinui.com.

1. Definitions

1. Data Protection Laws: all laws on personal data that apply to the processing under the Agreement. These include, where applicable, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws such as the CCPA/CPRA.
2. Customer Personal Data: personal data in Customer test content that SpinUI processes as processor for Customer. Customer test content includes test definitions, recordings, secrets, run artifacts, crawl data, received test emails and alert settings.
3. Sub-processor: a third party that SpinUI engages to process Customer Personal Data.
4. Security Incident: a breach of security that leads to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
5. Terms such as controller, processor, data subject, personal data and processing have the meaning given in the GDPR.

2. Roles and scope

1. Customer is the controller (or a processor acting for its own controller) of Customer Personal Data. SpinUI is the processor (or sub-processor).
2. SpinUI is a separate controller for account, billing, security and service data, as described in its Privacy Policy. This DPA does not cover that data.
3. Under US state laws, SpinUI acts as Customer's "service provider" or "processor". It will not:
   • sell or share Customer Personal Data;
   • keep, use or disclose it outside the direct business relationship or for any purpose other than providing the Service;
   • combine it with other data except as those laws allow.

3. Subject matter, nature, purpose and duration

4. Customer instructions

1. SpinUI processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. This includes the suites, schedules, private runners, alert destinations, AI settings and agent tokens Customer sets up.
2. SpinUI will tell Customer if, in its opinion, an instruction breaks Data Protection Laws. SpinUI may then suspend the affected processing.
3. Customer is responsible for:
   • the lawfulness of the processing it instructs;
   • having the right to test each target;
   • having any notices and consents needed for personal data shown on its targets or put into the Service. Customer should use test data where possible.

5. SpinUI's obligations

1. SpinUI will make sure that personnel who access Customer Personal Data are bound by confidentiality and access it only as needed. Access by SpinUI operators to a customer organization goes through an audited operator mode.
2. SpinUI will implement the technical and organizational measures in Annex II.
3. SpinUI will not process Customer Personal Data for its own purposes. It will not use Customer test content to train AI models.

6. Sub-processors

1. Authorization. Customer gives general authorization for SpinUI to engage Sub-processors. The current Sub-processors are listed in Annex III and at https://spinui.com/subprocessors.
2. Contracts. SpinUI will put in place written terms with each Sub-processor that protect Customer Personal Data at least as well as this DPA. SpinUI remains responsible for each Sub-processor's performance.
3. Notice of changes. SpinUI will notify Customer of a new or replacement Sub-processor at least 30 days before it starts processing Customer Personal Data. It will do this by updating the sub-processor page and emailing the Admins of each organization. Where a change is urgent, for example to replace a failing provider or to fix a security problem, SpinUI will give as much notice as it reasonably can.
4. Objection. Customer may object on reasonable data protection grounds within 14 days of the notice, by writing to support@spinui.com. The parties will discuss the concern in good faith. If SpinUI cannot reasonably avoid using the Sub-processor for Customer, Customer may terminate the affected Service. Prepaid fees for the unused period are then refunded. The refund is issued through the payment reseller, as the Refund Policy describes.
5. Destinations Customer chooses are not Sub-processors. Data that Customer directs to its own systems or third parties is not processed by a SpinUI Sub-processor. This includes:
   • Customer's private runners;
   • Slack, Microsoft Teams, email or webhook destinations;
   • CI systems;
   • AI agents or coding assistants Customer connects through MCP or the CLI. Once delivered, that data is Customer's responsibility.

7. International transfers

1. SpinUI is established in Estonia, in the European Union. It hosts the Service in Microsoft Azure's Central US region. Customer Personal Data is therefore processed in the United States, and by Sub-processors in the locations in Annex III. Customer instructs SpinUI to process Customer Personal Data there.
2. Transfers by SpinUI to its Sub-processors. Where SpinUI sends Customer Personal Data to a Sub-processor outside the European Economic Area, the United Kingdom or Switzerland, it relies on a transfer mechanism that Data Protection Laws accept. Where the Sub-processor is certified under the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework), SpinUI relies on that certification. Otherwise it relies on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three (processor to processor), with the UK International Data Transfer Addendum and the Swiss amendments, as included in that Sub-processor's data processing terms. SpinUI itself makes no Data Privacy Framework claim.
3. Transfers from Customer to SpinUI. A transfer from a Customer in the European Economic Area to SpinUI is a transfer within the EEA and needs no transfer mechanism. Where a Customer in the United Kingdom or Switzerland sends Customer Personal Data to SpinUI, the transfer is covered by the adequacy decisions of those countries for the EEA.
4. If a transfer mechanism that SpinUI relies on is withdrawn or held invalid, SpinUI will put another valid mechanism in place, or stop the affected transfer.

8. Security Incidents

1. SpinUI will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data.
2. The notice will describe, as far as known:
   • the nature of the incident;
   • the categories and approximate number of data subjects and records concerned;
   • the likely consequences;
   • the measures taken or proposed. SpinUI will send updates as it learns more.
3. SpinUI will take reasonable steps to contain and fix the incident. It will give Customer reasonable help to meet its own notification duties.
4. Notice is sent by email to the organization's Admins. If Customer has given SpinUI a security contact address by writing to support@spinui.com, notice is sent to that address as well.
5. A notification is not an admission of fault.

9. Assistance

1. Data subject requests. Taking into account the nature of the processing, SpinUI will help Customer respond to data subject requests. Customer can delete tests, runs and recordings in the Service itself. For other requests, SpinUI will help on request. If SpinUI receives a request directly about Customer Personal Data, it will pass it to Customer and will not respond itself, unless the law requires it.
2. DPIAs and consultations. SpinUI will give reasonable information to help Customer with data protection impact assessments and prior consultations with authorities, as far as they concern the Service.
3. The assistance in this section is free of charge when it is reasonable in scope. For requests that are repeated, or that need substantial work beyond what the Service provides, SpinUI may charge its reasonable costs, where law allows, and will tell Customer the cost before it starts.

10. Audits

1. SpinUI will make available the information reasonably needed to show compliance with this DPA. This includes this DPA, Annex II, and answers to reasonable security questionnaires.
2. SpinUI does not hold a SOC 2 or ISO 27001 certification.
3. If that information is not enough to show compliance, or an authority requires it, Customer may request an audit on these terms:
   • no more than once every 12 months, with at least 30 days' written notice. These two limits do not apply where an authority requires the audit or after a Security Incident;
   • during business hours and without unreasonably disrupting SpinUI's operations;
   • by Customer or an independent auditor bound by confidentiality, at Customer's cost. Audits do not extend to Sub-processors' facilities; SpinUI will provide their available reports instead.

11. Deletion and return at the end of service

1. During the term, Customer can delete suites, tests, runs and recordings in the Service. Retention limits also delete data automatically:
   • run artifacts after 7, 14 or 30 days by Plan;
   • run and crawl history after about 90 days;
   • raw test emails after 72 hours;
   • deleted files after a further 7 days of storage soft delete.
2. On termination, Customer may export data it needs before closure, using the Service, the API or the CLI. Deletion of an organization is requested by an Admin by email to support@spinui.com. Before it deletes, SpinUI provides an export of the organization's test content and run history as a file, unless Customer says it does not need one. A 7-day waiting period, in which Customer can withdraw the request, comes before the deletion. Secret values, access tokens and run artifacts are not part of the export.
3. Within 30 days after the Agreement ends or after Customer's deletion request, SpinUI will delete Customer Personal Data, unless law requires it to keep some. Backup copies are overwritten on their normal cycle and stay protected until then. SpinUI keeps the following after deletion: usage and billing totals identified only by an internal organization number, for as long as accounting law requires; a record that the deletion took place, which holds the organization name but no Customer content, for 24 months, so that SpinUI can confirm the deletion in writing; and the free-trial record described in the Privacy Policy.
4. On request, SpinUI will confirm deletion in writing.

12. Liability and order of precedence

1. Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the transfer clauses do not allow this.
2. If this DPA conflicts with the Agreement, this DPA prevails on data protection. If it conflicts with the transfer clauses, the transfer clauses prevail.

Annex I: Description of processing

A. Parties

• Controller: Customer, as identified in its SpinUI account. Contact: the organization's Admins.
• Processor: Digiport OÜ, registry code 14584252, Sepapaja 6, 15551 Tallinn, Estonia (established in the EU). Contact: support@spinui.com. Transfers outside the EEA are made by SpinUI to its Sub-processors, as Section 7 describes.

B. Categories of data subjects

• Customer's users and members of its organizations and client workspaces.
• People whose personal data appears on Customer's tested websites and applications, for example:
  • test accounts;
  • customers or staff shown on pages;
  • senders of emails to test inboxes.
• People whose contact details Customer enters as alert recipients.

C. Categories of personal data

• Names, email addresses and usernames used in tests and test accounts.
• Credentials and other secrets stored for tests (encrypted).
• Content of tested pages captured in:
  • screenshots and videos;
  • traces;
  • console and network logs;
  • recorder text snippets;
  • crawl results. This may include any personal data the page shows.
• Values typed into non-sensitive fields during recording.
• Content of emails received by test inboxes:
  • headers;
  • body;
  • links;
  • attachments;
  • one-time codes, which are masked in outputs.
• IP address, greeting name and TLS state of the mail server that sent a test email.

D. Sensitive data None intended. Customer must not use the Service to process special category data or data about criminal convictions, except where it cannot reasonably avoid that such data appears on a tested page. If a tested page shows such data, it may appear in artifacts. Artifacts are protected by the Annex II measures and deleted under the retention limits.

E. Frequency of transfer Continuous, while Customer uses the Service.

F. Nature and purpose See Section 3.

G. Retention

• Run artifacts: 7, 14 or 30 days by Plan.
• Run and crawl history: about 90 days. The latest result per test may be kept longer, without its artifacts.
• Raw test emails: 72 hours. A summary line is kept with the run.
• Test definitions, recordings, secrets and baselines: until Customer deletes them, or until the Section 11 deletion.
• After deletion SpinUI keeps only usage and billing totals under an internal organization number (as long as accounting law requires), a record of the deletion without Customer content (24 months) and the free-trial record.

H. Sub-processor transfers See Annex III.

Annex II: Technical and organizational measures

These measures reflect the Service as built. SpinUI may improve them over time but will not materially reduce the overall level of protection.

1. Hosting and network
   • Microsoft Azure, Central US. The web app runs in Azure Container Apps.
   • All public traffic passes through Cloudflare (TLS, web application firewall, DDoS protection). The app's origin accepts only traffic from Cloudflare that carries a secret origin header; direct access is refused.
2. Encryption
   • HTTPS for all traffic from users and runners.
   • Azure encryption at rest for the database and file storage.
   • Customer secrets and webhook URLs are encrypted with ASP.NET Core Data Protection under per-organization purposes. The key ring is encrypted by an RSA key in Azure Key Vault (purge protection on in production).
   • Private runner credentials are stored with Windows DPAPI on the runner host.
   • The mail receiver offers STARTTLS (TLS 1.2 or later).
3. Identity and access
   • Passwords are salted and hashed (ASP.NET Core Identity).
   • Optional TOTP two-step sign-in for users.
   • Organization roles, including a read-only Viewer role.
   • Recent re-authentication is required for sensitive actions.
   • API, CLI, Recorder and agent tokens are stored hashed, shown once, scoped, expiring and revocable.
   • Agent OAuth uses PKCE, one-time codes, short-lived access tokens and refresh-token rotation with reuse detection.
   • Azure resources are reached through managed identities. There are no database passwords.
   • Least-privilege roles: the cloud runner identity can only pull its image; runners have no database, storage or Key Vault access.
4. Tenant isolation
   • Every customer-owned record carries an organization ID and is filtered by it.
   • An automated cross-tenant test suite attempts reads and writes across organizations and must fail.
   • Files are stored under per-organization prefixes and served only through the app.
5. Runner isolation
   • Cloud tests run in short-lived containers separate from the web app.
   • An egress guard blocks private, loopback and cloud-metadata addresses.
   • Jobs carry only the secrets their tests reference. Those secrets are decrypted for that job, held in memory and not written to the runner's disk or logs.
   • Private runners connect outbound only, are bound to one organization and can be revoked.
6. Email testing
   • The receiver accepts mail only for live per-run addresses, checked when each recipient is given.
   • It has no outbound mail path (no relay) and keeps no copy.
   • It hands messages to the app over a signed, replay-protected HTTPS call.
   • Email HTML is sanitized before display.
   • Attachments are never executed or displayed inline.
   • Size and rate caps apply.
7. Logging and monitoring
   • Audit logs record security-relevant and administrative actions.
   • Secrets, tokens and codes are masked in logs and telemetry.
   • Application Insights telemetry excludes request bodies, sensitive headers and SQL parameters.
   • Alerts go to the operator on availability and error conditions.
8. Abuse controls
   • Rate limits on sign-in, APIs, trigger URLs, runner and mail endpoints.
   • Email verification before use.
   • Plan and platform limits on executions, concurrency and storage.
9. Resilience
   • Azure SQL automated backups, geo-redundant in production.
   • 7-day soft delete on file storage.
   • A documented backup and restore runbook.
10. Secure development
    • Code review on every change.
    • Automated test suites, including security and tenancy tests.
    • Dependency updates.
    • An internal security review before launch.
11. Personnel
    • Operator access to customer organizations is limited to Super Admins.
    • Operator access goes through an audited operator mode.
    • Two-step sign-in is mandatory for Super Admins.

Annex III: Sub-processors

The payment reseller (Stripe Managed Payments; Stripe acts as reseller and merchant of record through its affiliate Link, LLC) processes billing and payment data as an independent controller, under its own privacy policy. It is not a Sub-processor and does not process Customer test content.

Notice and objection: see Section 6.