Data Processing Agreement
Last updated Nov 1, 2026
This document is a template provided for convenience. It must be reviewed and completed by qualified legal counsel before it is relied upon.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Controller") and ScreenshotDude (the "Processor") when we process personal data on your behalf through the API — for example, personal data contained in pages you capture or analyze.
1. Scope and roles
You determine the purposes and means of processing; we process personal data only on your documented instructions, which consist of your API requests and dashboard configuration.
2. Nature of processing
| Item | Description |
|---|---|
| Subject matter | Rendering, capturing, extracting and analyzing web pages submitted by the Controller |
| Duration | For the term of the agreement, plus the retention periods below |
| Categories of data | Any personal data present on submitted pages (e.g. names, emails, phone numbers) and request metadata |
| Data subjects | Individuals whose data appears on submitted pages; Controller's users |
3. Processor obligations
We will:
- process personal data only on documented instructions;
- ensure personnel are bound by confidentiality;
- implement appropriate technical and organizational measures (encryption in transit, access control, logging, isolation of rendering workers);
- assist you with data subject requests and data protection impact assessments where reasonable;
- notify you without undue delay after becoming aware of a personal data breach;
- delete or return personal data at the end of the service, unless retention is required by law.
4. Subprocessors
You authorize the use of the subprocessors listed on our subprocessors page. We will give notice of new subprocessors at least 30 days in advance, during which you may object.
5. Retention
- Synchronous results are not stored after the response is delivered.
- Async job results are kept until they expire, then deleted.
- Cached responses are deleted when their TTL (maximum 30 days) expires.
- Uploads to your own S3/R2 bucket are under your control.
6. International transfers
Transfers outside the EEA rely on Standard Contractual Clauses or another valid transfer mechanism.
7. Audits
On request, we will provide information reasonably necessary to demonstrate compliance, not more than once per year, unless required by a supervisory authority.
To request a countersigned copy of this DPA, email support@screenshotdude.com.