Data Processing Agreement

Version 1.1. Last updated: 11 September 2026.

Published in English, Russian and Uzbek. The English text prevails if the versions differ.

This Agreement forms part of the Terms of Service and of the Public Offer. It applies automatically when you use the Service. You do not need to sign it separately. If you need a signed copy for your records, write to support@tracepo.io.

1. Which data this covers

This Agreement covers personal data that you put into the Service and that we process on your behalf: personal data inside the telemetry you send, inside dashboards, alert rules and other content you create, and the email addresses you add as alert recipients.

It does not cover the personal data we process for our own purposes - your account details, how you use the product, and your billing records. There we are the controller in our own right, and the Privacy Policy governs that.

2. Roles

You are the controller (under the Law of the Republic of Uzbekistan No. ZRU-547, the owner of the personal data base) or a processor acting for another controller.

We are the processor (under ZRU-547, the operator).

You decide why and how the data is processed. We process it only to provide the Service to you.

3. Our undertakings

We will:

1. Process only on your instructions. Your instructions are this Agreement, the Terms of Service, the configuration you set in the product, and anything else you tell us in writing. If a law requires us to process data otherwise, we will tell you first, unless that law forbids us to.
2. Tell you if an instruction looks unlawful, in our reasonable opinion.
3. Keep it confidential. Everyone we allow near your data is bound by a written confidentiality obligation that survives the end of their engagement.
4. Secure it with the measures in section 7.
5. Not use your data for our own purposes. We do not analyse it, mine it, profile it, sell it, or use it to train models.
6. Help you meet your own obligations, as described in sections 5 and 6.
7. Delete or return the data as described in section 9.
8. Give you the information you need to show that we comply, and allow the audits described in section 10.

4. What is processed

Subject matter: provision of the Tracepo observability platform.

Duration: for as long as you have an account, plus the retention periods described in the Terms of Service and the Billing and Refund Policy.

Nature and purpose: receiving, storing, indexing, querying, displaying, alerting on and deleting telemetry and related content, at your direction.

Categories of data subjects: whoever appears in the telemetry you choose to send, and the people whose email addresses you register as alert recipients. You decide this; we do not.

Types of personal data: whatever your systems place into telemetry. Today the Service accepts host metrics from our agent, which contain no personal data. As support for traces and logs is released, this may extend to technical identifiers, network addresses, user identifiers, request paths and free-text log content.

Sensitive data: none. The Terms of Service forbid you to send it, and you undertake not to.

5. Data subject requests

The product gives you the tools to find, export and delete data yourself, and that is normally the fastest route.

If a data subject comes to us directly about data we hold on your behalf, we will not answer them on the merits. We will tell you promptly and leave the decision to you.

If you need more help than the product's own tools give you, we will provide reasonable assistance, taking into account the nature of the processing and what we can actually see.

6. Incidents

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data we process for you, we will notify you without undue delay and in any case within 72 hours of becoming aware.

The notice will describe what happened, the categories and approximate number of records affected as far as we can tell, the likely consequences, what we have done and what we recommend you do. If we do not have all of it at once, we will send what we have and follow up.

We will help you meet your own notification duties, and we will not delay telling you while we investigate.

7. Security measures

We maintain the measures below. We may change them, but not in a way that materially reduces protection.

Access control. Role-based access inside the product (owner, admin, editor, viewer). Tenant isolation enforced at the database level by row policies, not by application-level filtering. The operator back-office is reachable only over VPN and reads the product database with a read-only role. Access to customer data is limited to a small group of administrators bound by confidentiality undertakings, who access it only at your request or during incident diagnosis.

Authentication. Passwords stored only as bcrypt hashes. Ingestion credentials are a key pair; the secret is stored only as a SHA-256 hash and displayed once, at creation.

Encryption. TLS for traffic between you and the Service. Internal component traffic runs inside a private network. Encryption at rest.

Resilience. Regular encrypted backups.

Software assurance. Static analysis, dependency scanning, secret detection and container scanning on builds. Signed distribution packages and signed repository indexes for the agent.

Deletion. Automated retention limits per plan, enforced by the storage layer, so data expires without anybody remembering to delete it.

8. Subprocessors

You give us general authorisation to use subprocessors. The current list, what each one receives and where it processes it, is published at Subprocessors.

Before a new subprocessor starts processing your data, we will update that page and notify you by email at least 30 days in advance.

You may object within 15 days of the notice, on reasonable grounds relating to data protection. If you do, we will try to offer you a way to avoid the change. If we cannot, and you still object, you may terminate the affected subscription, and we will refund the unused part of your paid period. That is your remedy for an objection.

Every subprocessor is bound by written terms that are at least as protective as this Agreement, and we remain responsible to you for what they do.

9. Return and deletion

You can delete data yourself at any time, through the product.

When your subscription ends, the timetable in the Billing and Refund Policy applies: you keep read access and can export throughout the period before deletion, and the deletion date is emailed to you in advance.

When you ask us to delete, we remove the data from live systems within 1 to 14 working days. Copies inside backups are not deleted at that moment; they disappear when the backup rotates. Until then those copies are not used for any purpose and remain covered by this Agreement.

We keep only what the law requires us to keep, and only for as long as it requires.

10. Audits and information

We will give you the information reasonably needed to show that we comply with this Agreement, on request.

You may audit us, yourself or through an independent auditor you appoint, once in any 12 months, on 30 days written notice, during business hours, in a way that does not disrupt the Service. You may audit more often if a competent authority requires it or after a confirmed incident affecting your data.

You bear the cost of the audit. Your auditor must sign a confidentiality undertaking and must not be our competitor. An audit may not extend to other customers' data or to information that would compromise the security of other customers.

11. International transfers

Your telemetry and account data are stored in the Republic of Uzbekistan.

A limited amount of personal data is processed abroad by the subprocessors identified at Subprocessors: email addresses passing through our outbound email provider, and email addresses reaching the international payment provider and the Google sign-in provider. No telemetry is transferred outside Uzbekistan.

Where a transfer requires a legal basis under applicable law, we rely on the mechanisms permitted by Article 27-1 of the Law of the Republic of Uzbekistan No. ZRU-547, as amended: the recipient's contractual commitment to protect the data to a standard no lower than that Law requires, together with the data subject's consent where the law requires it. Where the customer is subject to the GDPR, we will enter into the European Commission's Standard Contractual Clauses on request.

12. Your undertakings

You warrant that:

• you have a lawful basis for the personal data you put into the Service and for us to process it on your behalf;
• you have given the notices and obtained the consents that the law requires of you;
• you will not send Sensitive Data, as defined in the Terms of Service;
• you will use reasonable efforts to keep other personal data out of the telemetry you send;
• you will not deliberately send credentials or other secrets;
• your instructions to us are lawful.

You configure what the Service receives. We cannot filter what we are not told about, and we do not inspect your telemetry to look for it.

13. Liability, term and precedence

Liability under this Agreement is subject to the limitations in the Terms of Service.

This Agreement lasts as long as we process personal data on your behalf.

If this Agreement conflicts with the Terms of Service or the Public Offer on a matter of personal data, this Agreement prevails.

14. Contact

"BEATAI LABS" LLC, TIN 312569409 Toshkent shahri, Mirobod tumani, Yuksalish MFY, Kuylik-3 mavzesi, 37-uy, 26-xonadon, Republic of Uzbekistan Email: support@tracepo.io