Data Processing Addendum

Klavity Snap & Klavity Cloud · Last updated 21 August 2026

This Data Processing Addendum (the "DPA") forms part of the agreement between you (the "Customer") and Quantana, the maker of Klavity ("Quantana", "we", "us"), governing your use of Klavity Snap and Klavity Cloud at klavity.in (together, the "Service", and the underlying agreement, the "Agreement"). It applies where, in using the Service, Quantana processes Personal Data on the Customer's behalf and applicable data protection law (including the EU GDPR and the UK GDPR) requires such terms.

In the plainest terms: when the Customer uses Klavity to capture and analyse pages, the Customer is the Controller of any Personal Data contained in those captures and the resulting tickets, and Quantana is the Processor acting on the Customer's documented instructions. Where Quantana in turn engages another provider, that provider acts as a Sub-processor.

1. Definitions

Capitalised terms not defined here have the meaning given in the Agreement or in applicable Data Protection Law. In this DPA:

• "Data Protection Law" means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and the Australian Privacy Act 1988 (Cth).
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Sub-processor" have the meanings given in the GDPR.
• "Customer Personal Data" means Personal Data that Quantana processes on the Customer's behalf in the course of providing the Service.
• "Standard Contractual Clauses" or "SCCs" means (a) for EU transfers, the clauses annexed to European Commission Implementing Decision (EU) 2021/914; and (b) for UK transfers, the UK International Data Transfer Addendum to those clauses issued by the UK Information Commissioner.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country that is not the subject of an adequacy decision under applicable Data Protection Law.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

2. Roles of the parties

With respect to Customer Personal Data, the Customer is the Controller and Quantana is the Processor. Where the Customer is itself a Processor acting for a third-party controller, Quantana is a Sub-processor; in that case the Customer warrants that it has the third party's authority for this DPA to apply. Each party will comply with its own obligations under Data Protection Law.

3. Scope, subject-matter, nature and purpose of processing

Quantana processes Customer Personal Data only to provide, maintain, secure and support the Service. The subject-matter, nature and purpose of the processing, the categories of Data Subjects, and the types of Personal Data are described in Annex I. The Service is a business-to-business bug- and feedback-reporting tool; it is not designed for, and the Customer must not submit through it, special categories of Personal Data (see Section 8).

4. Duration

This DPA takes effect on the effective date of the Agreement and continues for as long as Quantana processes Customer Personal Data under the Agreement. The provisions that by their nature should survive termination — including Sections 9 (return/deletion), 10 (liability) and 11 (transfers) — survive.

5. Customer instructions

Quantana will process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless required to do otherwise by law (in which case Quantana will, where legally permitted, inform the Customer first). The Agreement, this DPA, and the Customer's configuration and use of the Service constitute the Customer's complete and documented instructions. Quantana will inform the Customer if, in its opinion, an instruction infringes Data Protection Law.

6. Processor obligations

• Confidentiality. Quantana ensures that persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality.
• Security. Quantana implements and maintains the technical and organizational measures set out in Annex II (Section 7).
• Sub-processing. Quantana engages Sub-processors only in accordance with Section 8 and Annex III.
• Data-subject requests. Taking into account the nature of the processing, Quantana will assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to Data-Subject requests. Much of this is self-service: Customers can export and delete account data directly (see Section 12). Quantana may charge for assistance beyond what is reasonably available through the Service's own tools.
• DPIAs and prior consultation. Quantana will provide reasonable assistance to the Customer with data-protection impact assessments and prior consultations under GDPR Articles 35–36, taking into account the nature of the processing and information available to Quantana.
• No AI model training. Quantana will not use Customer Personal Data to train its own or any third party's machine-learning or AI models, and requires the same of its Sub-processors, without the Customer's express written authorization. LLM inference on captured content is performed solely to generate the Customer's tickets, not to train models.

7. Security measures

Quantana implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex II. In summary: all traffic is encrypted in transit (HTTPS); integration secrets are encrypted at rest with AES-GCM and are redacted from any response returned to the browser; screenshots are stored with private access and served only via short-lived signed links to authorized workspace members.

8. Sub-processors

The Customer provides a general authorization for Quantana to engage the Sub-processors listed in Annex III. Quantana imposes on each Sub-processor data-protection obligations no less protective than those in this DPA, and remains responsible for its Sub-processors' performance.

Change notice. Before adding or replacing a Sub-processor, Quantana will give the Customer notice (by email to the Customer's account contact and/or by updating Annex III and the Privacy Policy). The Customer may object on reasonable data-protection grounds within 15 days of notice. If the parties cannot resolve the objection, the Customer may, as its sole remedy, terminate the affected part of the Service.

Customer-directed destinations. Where the Customer connects its own issue tracker (Jira, Linear, GitHub, Plane, or a webhook), that destination is engaged at the Customer's direction and under the Customer's own agreement with that provider; the Customer is responsible for its lawful use.

9. Return and deletion

On termination of the Agreement, and in any case within 30 days of the Customer's written request after processing ceases, Quantana will, at the Customer's choice, delete or return Customer Personal Data, and delete existing copies, except to the extent retention is required by law. Routine retention windows are set out in Annex I. The Customer can delete its account and associated data at any time from Dashboard → Settings → Your data & privacy.

10. Audit and sub-processor liability

Quantana makes available to the Customer information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior written notice and no more than once per year (or after a Personal Data Breach), allows for and contributes to audits, including inspections, conducted by the Customer or a mutually agreed auditor bound by confidentiality. Quantana may satisfy audit requests by providing an up-to-date third-party attestation (e.g. SOC 2 Type II or ISO 27001) where available. The Customer reimburses Quantana's reasonable costs for audit assistance beyond the provision of standard documentation.

Quantana remains liable to the Customer for the acts and omissions of its Sub-processors to the same extent Quantana would be liable if performing the services of each Sub-processor directly, subject to the limitations of liability in the Agreement.

11. Personal Data Breach notification

Quantana will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to it to help the Customer meet its own notification obligations under Data Protection Law. Notification will be sent to the Customer's account contact.

12. Data-subject rights and self-service tools

The Service provides tools that let Customers and their users directly exercise common rights: export a machine-readable JSON copy of account data (GDPR Art. 15 and 20) and permanently delete the account (GDPR Art. 17), both from Dashboard → Settings → Your data & privacy. Quantana will provide reasonable additional assistance on request, as set out in Section 6.

13. International transfers & SCCs

Customer Personal Data may be processed in the United States (OpenRouter, Google, PostHog) and India (application database hosted in the Mumbai region, aws-ap-south-1), as well as in Quantana's home jurisdiction of Australia. Where the Service involves a Restricted Transfer of Customer Personal Data from the EEA, the United Kingdom or Switzerland, the parties agree that:

• The EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) are incorporated by reference and deemed executed, with Module Two (Controller-to-Processor) or Module Three (Processor-to-Processor) applying as appropriate; the Customer is the data exporter and Quantana the data importer; the docking clause is not used; Clause 9 Option 2 (general authorization) applies with the 15-day notice period in Section 8; and the clauses are governed by, and disputes resolved in, the courts identified in the SCCs' optional clauses (defaulting to Irish law and courts where the SCCs require an EU choice).
• For UK transfers, the UK International Data Transfer Addendum to the EU SCCs applies and is deemed completed using the details in this DPA and its Annexes.
• For Swiss transfers, the EU SCCs apply with references to the GDPR read as references to the FADP, the FDPIC as supervisory authority, and Swiss Data Subjects retaining their rights.
• Annex I of the SCCs is populated by Annex I of this DPA; Annex II of the SCCs by Annex II; and the list of Sub-processors by Annex III.

Quantana may adopt an alternative lawful transfer mechanism where it does not materially decrease the protection of Customer Personal Data. In the event of any conflict between this DPA and the SCCs in respect of a Restricted Transfer, the SCCs prevail.

14. General

In the event of a conflict between this DPA and the Agreement on the subject of data protection, this DPA prevails. Each party's liability under this DPA is subject to the exclusions and limitations of liability set out in the Agreement. This DPA is governed by the law that governs the Agreement (the laws of Australia), except that Restricted Transfers are governed as set out in Section 13.

15. Contact

Data-protection questions and requests under this DPA: hello@quantana.com.au · Quantana, quantana.com.au.

---

Annex I — Details of processing

Item	Detail
Controller (data exporter)	The Customer (the entity that accepts the Agreement).
Processor (data importer)	Quantana, maker of Klavity · hello@quantana.com.au · Australia.
Subject-matter	Provision of the Klavity Snap / Klavity Cloud bug- and feedback-reporting service.
Nature & purpose	Capturing pages the Customer consents to, generating AI ("Sim") feedback via an LLM provider, storing the results, and filing tickets to the Customer's connected issue tracker.
Duration	For the term of the Agreement plus the retention windows below; then deleted per Section 9.
Categories of Data Subjects	The Customer's authorised users (workspace members) and any individuals whose personal data incidentally appears in a captured page, screenshot, console/network diagnostic, or ticket the Customer submits.
Categories of Personal Data	Account email; workspace/membership identifiers; page URL paths, titles and structural signatures; screenshots of the visible page area; diagnostic context (browser/screen info, recent console and network errors); ticket content authored by the Customer; and any personal data the Customer chooses to include in captured pages or reports.
Special-category data	None. The Service is not intended for special categories of data (GDPR Art. 9) or children's data, and the Customer agrees not to submit such data through it.
Frequency of transfer	Continuous, for the duration of the Service.

Retention windows (policy; configurable per project)

Data	Retention
Screenshots (Sim reviews)	30 days
Screenshots (Snap manual reports)	24 months
Feedback / reports & transcripts	24 months
AI call logs & audit records	13 months
Account data	Life of account + 30 days after closure

Retention is configurable per project; a Customer may set shorter windows for its workspace. The windows above are the defaults / maximums stated as policy.

Annex II — Technical & organizational measures

1. Encryption in transit. All traffic to and from the Service is encrypted over HTTPS/TLS.
2. Encryption at rest. Integration secrets (tracker API tokens, webhook URLs) are encrypted at rest using AES-GCM and are never returned to the browser (redacted from responses).
3. Screenshot confidentiality. Screenshots are stored in private object storage and served only through short-lived, signed URLs to authenticated, authorized workspace members.
4. Access control. Access to Customer Personal Data is limited to authorized workspace members and to Quantana personnel on a least-privilege, need-to-know basis; authentication uses a one-time email code (passwordless).
5. Confidentiality of personnel. Personnel with access are bound by confidentiality obligations.
6. Segregation. Customer data is logically segregated by workspace/project.
7. Logging & monitoring. AI/LLM calls are logged to a cost/usage ledger; access and security-relevant events are recorded for audit.
8. Consent-gating. Capture is consent-gated: Sims review a page only after explicit user consent, and only on URLs the workspace has allow-listed or the user has explicitly chosen.
9. Data minimisation. Only the visible area of a page is captured (not the full page or other tabs); URL query strings and fragments are dropped.
10. Incident management. Security incidents are investigated and, where they constitute a Personal Data Breach, notified to affected Customers without undue delay (Section 11).
11. Deletion & expiry. Automated retention/expiry enforces the windows in Annex I; Customers can self-serve export and deletion.
12. Sub-processor diligence. Sub-processors are engaged under contracts imposing equivalent data-protection obligations (Annex III).

Annex III — Sub-processors

Sub-processor	Purpose	Location(s)
OpenRouter (currently routing to Google Gemini)	LLM inference to generate Sim feedback from captured page content.	United States
S3-compatible object storage	Private storage of screenshots.	Provider-dependent
Turso / libSQL	Application database (accounts, tickets, settings).	India (Mumbai, aws-ap-south-1)
SendGrid	Transactional email and one-time login codes (OTP).	United States
Customer's configured issue tracker (Jira / Linear / GitHub / Plane / webhook)	Receives the tickets the Customer files. Engaged at the Customer's direction.	Customer-determined

Marketing-site analytics tools (Google Analytics, Microsoft Clarity, PostHog) operate only on the public marketing site and do not process Customer Personal Data submitted through the Service; see the Cookie Notice.

Draft for legal review. This document is a working draft prepared for review by a qualified legal adviser. It is not legal advice and is not a substitute for it.