Data Processing Addendum

This addendum (“DPA”) is part of our Terms of Service and applies automatically whenever we process personal data for you. You do not need to sign anything. If you want a countersigned copy for your records, email hello@mado.show.

“You” are the customer (the workspace owner). “We” are MPCSI, MB, company code 306109625, Liepyno g. 2-51, LT-08108 Vilnius, Lithuania. Words such as controller, processor, personal data and personal data breach have their meaning in the GDPR (Regulation (EU) 2016/679).

1. Roles and scope

You are the controller and we are your processor for the personal data described in section 2 (“Customer Personal Data”). Where you are yourself a processor for someone else, we are your subprocessor, and you confirm that your instructions are authorised by that controller. Data we handle as controller, such as your account and billing state, is covered by our Privacy Policy, not this DPA. The same goes for the record of what the Helper did in your app (Terms, section 17), which we keep as controller.

2. What we process

• Subject matter and purpose: providing mado to you: turning recordings into demos, storing and serving them, measuring how they are viewed, collecting the details viewers type into the lead forms you add to demos, running help hubs, and the optional features you turn on.
• Nature of processing: storage, frame extraction, text recognition, redaction, encoding, hosting and delivery, analytics counting, storing lead form entries and showing, exporting and alerting you about them, and, only if you turn them on, AI text generation, translation and audio generation. With our browser extension, which you or your team install and start: capturing the screens of a web app you operate (screenshots, clicked elements and typed text, with passwords, card numbers and one-time codes masked), reading an app’s screens into text outlines, and, if you use the Helper, clicking and typing in your app on your instructions, within the limits in section 17 of the Terms, with a record of each step. Where you turn AI assist on, the Helper’s page outlines, your notes for it and the app’s own map of routes are sent to Anthropic to choose its next step.
• Data subjects: people who appear in your recordings; people who view your demos; people who fill in a lead form on your demos; people who use your help hubs; people named in tracked links you create.
• Categories of data: whatever your recordings show (for example names, email addresses, account details on screen); viewer and hub interaction events, a random per-page-load session id, a daily-rotating viewer hash, device class, operating system and browser family, country, referring or host page, tracked-link labels and help search text. From lead forms: the email address, name and company a viewer types (the fields you choose), with the time, the demo and version and the view they belong to; the interaction record keeps only which fields were filled in. We do not store viewers’ IP addresses or user agents. From the extension: page addresses (without query strings; scanned screens keep record identifiers in the path so mado can open them again, while email addresses and tokens are replaced, and every other address has its identifiers replaced), text typed into the app while capturing (never from password, card or code fields; made-up values by default when the Helper types), the visible text of the app’s screens in scan outlines, the names and roles of its controls, the text of its navigation, routes and endpoint names (the app map), and the notes you write for the Helper. The Helper’s record holds the workspace, user, time, page and the role and name of each control it used, never what was typed.
• Special categories: none intended. Do not record them; if a recording shows them, redact them before you publish.
• Duration: for as long as you use the Service, then until deletion under section 10.

3. Your instructions

We process Customer Personal Data only on your documented instructions. These terms, your settings and your actions in Studio are those instructions. If the law requires us to do something else, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you. You are responsible for having a lawful basis for the data you put into the Service and for telling the people concerned.

4. Confidentiality

Only the people who run the Service can access Customer Personal Data, only as needed, and they are bound to keep it confidential.

5. Security

We keep appropriate technical and organisational measures, including:

• encryption of all traffic in transit (TLS);
• private media storage, served only through our own servers; password-protected demos where you choose them;
• every database query scoped to a single workspace, with role-based access inside it;
• destructive redaction: redacted pixels are removed from published images, not covered over;
• viewer IP addresses and user agents are never stored, and our logs strip IP addresses, user agents and email addresses;
• stored secrets such as Slack webhook addresses are encrypted;
• nightly database backups to separate storage in the same EU region, kept for 14 days, with a documented restore procedure;
• production access limited to the people who run the Service;
• an audit log of important actions in each workspace.

We may improve these measures over time, but never lower the overall level of protection.

6. Subprocessors

You give us general authorisation to use subprocessors. The current ones are on our subprocessors page. Anthropic and ElevenLabs receive data only if a workspace owner or admin turns on AI assist or Voice & music. We bind every subprocessor to data protection terms at least as protective as this DPA and remain responsible for them.

Before a new subprocessor starts processing Customer Personal Data, we update that page and email workspace owners at least 30 days ahead. You can object on reasonable data protection grounds within that time. We will then try to find a solution; if we cannot, you may end the affected service, and we refund any prepaid fees for the time after it ends.

7. Transfers outside the EU

We store and process Customer Personal Data in the EU. It leaves the EU only through subprocessors on our list, as that list describes, and only with safeguards under Chapter V of the GDPR: the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified.

8. Helping you

We help you, taking into account what we can see, to answer requests from data subjects (for example with export and deletion), to meet your security duties, and with data protection impact assessments and consultations with authorities. If a data subject contacts us directly about your data, we pass the request to you and do not answer it ourselves unless you ask us to.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we tell you without undue delay, and in any case within 48 hours. We send it to the workspace owner by email, with what we know about what happened, the data and people affected, the likely consequences and what we are doing about it, and we add details as we learn them.

10. Return and deletion

Lead form entries are stored in the EU with the rest of your workspace. You can download them as a CSV and delete any one of them in Studio at any time; deletion removes the entry itself, which is the only place its contents are kept. Entries of a demo you delete are erased 30 days after the deletion (the demo keeps serving for those 30 days).

You can export your demos and their assets at any time. When you close your account or a workspace, or when these terms end, we delete the Customer Personal Data we hold for it within one month, unless the law requires us to keep it. Backup copies expire within a further 14 days. Once deleted, published demos no longer serve.

11. Audits

We make available the information you need to show that we meet Article 28 of the GDPR, starting with written answers to your questions and our documentation. If that is not enough, or an authority requires it, you may audit us, or have an independent auditor bound by confidentiality do so, once a year and on 30 days’ notice, at your cost and during business hours, in a way that does not expose other customers’ data.

12. Liability and precedence

Liability under this DPA is governed by the Terms of Service, including their limits, as far as the law allows. If this DPA and the Terms conflict on the protection of personal data, this DPA wins. This DPA is governed by the same law as the Terms.