Data Processing Addendum.

This Data Processing Addendum ("DPA") supplements the Terms of Service and applies when you use CaptureBear in the course of business and the optional Analysis feature processes personal data contained in your screenshots on your behalf. It is designed to satisfy Article 28 of the GDPR and equivalent requirements elsewhere. By using the Analysis feature in that context, you and we agree to this DPA.

1. Roles

You are the controller of personal data appearing in screenshots you submit; we are your processor. For clarity: screenshots you keep on your Mac, and files you upload to your own storage bucket, are never processed by us and are outside this DPA — those flows do not touch our systems.

2. Details of processing

• Subject matter: screenshot images you explicitly submit to the Analysis feature.
• Nature and purpose: automated identification of user-interface components and verbatim transcription of visible text, to return structured results to you.
• Duration: transient. Images are processed in memory and are not stored by us; processing lasts only as long as the request.
• Categories of data: whatever is visible in the screenshots you choose to submit, which may include names, contact details, or other personal data.
• Data subjects: individuals whose information appears in your screenshots.

3. Instructions

We process submitted images only to provide the Analysis feature and as documented in this DPA — your use of the feature is your documented instruction. We will inform you if we believe an instruction violates applicable data protection law.

4. Confidentiality and security

Submissions are encrypted in transit. Our analysis service is stateless: it holds images in memory only for the life of the request, writes nothing to disk, and keeps no copies of images or results. Access to production infrastructure is limited to people who need it, bound by confidentiality.

5. Subprocessors

You authorize the subprocessors listed at capturebear.com/legal/subprocessors. We will update that page at least 14 days before adding a subprocessor that processes your data; if you reasonably object on data protection grounds, your remedy is to stop using the Analysis feature (the rest of CaptureBear is unaffected). We remain responsible for our subprocessors' performance.

6. Assisting you

Because we retain nothing, data subject requests can almost always be fulfilled on your side. We will nonetheless provide reasonable assistance with requests, security consultations, and data protection impact assessments, taking into account the nature of the processing and the information available to us.

7. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting data processed under this DPA, and will provide the information reasonably needed for your own notification obligations.

8. Deletion and return

There is nothing to delete or return at the end of the engagement: we do not retain submitted images or results. The local analysis cache lives on your own machines and is under your control.

9. International transfers

Processing takes place on infrastructure operated by providers primarily located in the United States. Where personal data is transferred from the EEA, the UK, or Switzerland, we rely on the EU Standard Contractual Clauses (processor modules, as applicable) or an adequacy framework covering the recipient.

10. Audit

On written request, no more than once per year, we will provide the information reasonably necessary to demonstrate compliance with this DPA — including descriptions of our architecture and subprocessor terms. Given the transient, no-retention design, documentation-based review is the proportionate audit mechanism; where law requires more, we will cooperate in good faith.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms on data protection matters, this DPA prevails. This DPA lasts as long as we process personal data on your behalf.

Contact

CaptureBear · support@capturebear.com