Data Processing Addendum

This addendum applies when ScreenTrace Technologies processes personal data on behalf of a customer organization using Scribble Flow. It supplements the Privacy notice and Terms. It is an operational summary, not a signed GDPR Article 28 or standard-contractual-clause document. Named enterprise deals may execute a signed DPA with additional terms (residency, subprocessors, audit).

Roles

The customer organization is the Data Fiduciary (controller) for employee account data and desk content. ScreenTrace Technologies is the Data Processor. Each employee still owns a private desk. Company admins do not receive inbox access through this product.

What we process

• Account identity (name, email, SSO subject)
• Desk content the employee captures
• Published thoughts the employee chooses to share
• Admin audit events (login, invite, export, policy) - not scribble bodies
• Billing and seat counts

Instructions

We process data to provide Scribble Flow, including capture, enrichment the customer enables, SSO/SCIM, and backups. We do not train our own models on customer desks. When AI is on, relevant workspace text may be sent to the configured model provider listed on the subprocessors page. Those providers have their own terms.

Security

TLS in transit, access limited to operating the service, backups with retention as configured on the host, and an admin audit log. Self-host via Compose is available when a customer wants data on their own infrastructure. See Security. That page is not a certification.

Assistance

Export JSON from Settings (the employee's desk) or a published-only handover packet from Company admin. Account deletion removes that person's desk. Privacy requests that cannot be completed in-product go through the privacy request form. Questions: sales@scribbleflow.app or support@scribbleflow.app.

Support: support@scribbleflow.app. Sales: sales@scribbleflow.app.