Data Processing Addendum
This DPA forms part of the Terms between the customer (“Controller”) and Threadwell (“Processor”) for any personal data the Processor handles on the Controller’s behalf.
1. Scope & roles
The Processor processes personal data only to provide the service and only on the Controller’s documented instructions (these terms and the console’s configuration).
2. Nature of the data
Identifiers and usage metadata (always processed): account emails, organisation names, machine hostnames, OS usernames, project names, model and tool names, token counts and computed cost. Threadwell is workforce tooling: real names, email addresses and project/file paths are processed as identity and attribution data — they are not anonymised.
Session content (only when the Controller enables it): content capture is governed by the workspace’s collection policy and is off by default. When the Controller switches it on, the Processor stores redacted AI-session content: transcript text, session titles, tool-use summaries, artifact summaries and file paths touched, and derived distillations of those sessions. Transcript text from browser AI chats requires a second, separate opt-in; without it, browser turns are stored without their text (structure and counts only — the text is discarded server-side regardless of what a client sends).
Credentials are never processed. Secrets are collapsed to typed placeholders (e.g. [secret:aws-key]) on the endpoint, before upload, by multiple independent redaction layers; as a backstop, the ingest service rejects any submission that still contains a credential-shaped string.
3. Sub-processors
Supabase (database & auth, India region), Vercel (hosting), Razorpay (payments), Google (Gemini API — embedding and extraction over already-redacted session content, only where content capture is enabled), Railway (optional compute worker for the same pipeline). The Processor remains responsible for sub-processors and will give notice of material changes.
4. Security measures
- Row-Level Security isolates every workspace’s data; roles scope access (a viewer sees only their own usage). Raw session content is additionally person-scoped: an individual sees their own transcripts, and cross-person raw access requires an explicit, audited grant.
- Content capture is enforced server-side: submissions are refused unless the workspace’s content-capture policy is enabled, and browser transcript text is stored only under its separate opt-in.
- Agent ingest is key-authenticated, rate-limited and size-capped; the service-role key exists only in the server runtime.
- Credentials never leave a machine: multi-layer redaction collapses secrets to typed placeholders before upload, and the ingest service independently rejects credential-shaped content.
- Encryption in transit (TLS) and at rest (provider-managed).
5. Data subject rights
The Processor enables the Controller to fulfil access, export and erasure requests: admins can export the workspace’s usage and administrative records and delete a person or the whole workspace from the console, with immediate effect. Deleting a person removes their usage events and their captured content — sessions and, by cascade, the turns, artifacts and distilled summaries under them — together with their identity links, labels and department assignment, and writes an audit-log entry recording the erasure. Individuals can also delete any of their own captured sessions, likewise audited.
6. Data residency & transfers
Data is stored in India (ap-south-1). Cross-region arrangements can be agreed in writing for specific contracts.
7. Breach notification
The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s data.
8. Return & deletion
On termination, the Controller may export its data; on workspace deletion the data is purged from the production database (audit-log entries are retained, detached from the workspace, as a record of administrative actions — they contain no session content).
9. Contact
Data protection: privacy@tokentracker.app.