Data Processing Information

This page helps organisations assess Agent Logger's data flow. It is not a countersigned data processing agreement and does not change the controller and processor roles created by law. Contact us if your organisation needs a signed DPA for a separately agreed enterprise service.

• The customer decides which users, sites, tabs, and AI providers are authorised.
• The customer is responsible for notices, lawful basis, access controls, and instructions concerning data subjects in its browser content.
• Local artifacts and state remain on customer-controlled devices until removed through product, browser, runtime, or operating-system controls.
• Customers should avoid production personal data where test data or redaction will meet the development purpose.

• Supabase: authentication and PostgreSQL database; the current project is hosted in a Japan region.
• Stripe: hosted card setup, payment processing, fraud prevention, refunds, and disputes.
• Vercel: website and API hosting, content delivery, deployment, and infrastructure logs.
• Hostinger: Agent Logger mailbox hosting and SMTP delivery for payment, support, and optional lifecycle messages.

Providers may use affiliated infrastructure and approved sub-processors. Where Continual Labs acts as a processor under a signed agreement, we will provide the applicable provider list and change notice mechanism in that agreement. Transfers outside the UK must use an adequacy route or appropriate safeguards such as the UK IDTA or UK Addendum where required.

• TLS for hosted network traffic and Stripe-hosted collection of card details
• Supabase row-level security and separation of public, authenticated, and service credentials
• Signed short-lived entitlements and revocation for official paid access
• Explicit local pairing, authenticated reconnect, scoped methods, payload limits, and fail-closed handling
• Selected-tab monitoring and user-initiated capture controls
• Secret scanning, dependency review, deterministic release packaging, and restricted publish workflows
• Logs designed to use request IDs and error codes rather than browser content, credentials, screenshots, or card data

Security is a shared responsibility. Customers must secure endpoints, browser profiles, MCP clients, AI-provider credentials, and the sites and data their users can access.

For a service security issue, contact us without including live credentials or unnecessary personal data. Where a signed agreement makes Continual Labs a processor, incident notification, data-subject assistance, deletion, return, audit information, and regulator support will follow that agreement and applicable law.

• Document the sites, data classes, user roles, AI provider, and lawful purpose for your deployment.
• Configure the smallest tab and feature permissions needed.
• Review the AI provider's DPA, retention, model-training, and international-transfer settings.
• Set an internal retention process for local screenshots, artifacts, logs, and support exports.
• Test revocation, account offboarding, device removal, and incident response before production use.