Skip to content
SceneRecap

Data processing addendum

Effective 20 August 2026.

This data processing addendum (“DPA”) forms part of the Terms of service between Neurotech AI Solutions GmbH (“SceneRecap”) and the customer (“Customer”) and applies where the Customer, as a controller under the EU GDPR or UK GDPR, uses SceneRecap to process personal data (“Customer Personal Data”). It applies automatically to Team and Enterprise workspaces; Pro customers may request a countersigned copy at contact@scenerecap.com.

1. Roles and scope

The Customer is the controller of Customer Personal Data; SceneRecap is the processor and processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers, unless required to do otherwise by EU or member state law (in which case SceneRecap informs the Customer of that legal requirement before processing, unless the law prohibits this). The Customer’s instructions are, in the first instance, its configuration and use of the product’s features and settings. SceneRecap will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

2. Details of processing

  • Subject matter: screen recordings, interaction event logs, audio, transcripts and AI-derived outputs uploaded to or generated in the Customer’s workspaces.
  • Nature and purpose: hosting, transcoding, redaction, AI analysis, storage, playback, search, export and sharing, as configured by the Customer; and, where the Customer requests it, reproduction runs — the headless re-execution of a recorded flow against an origin verified by the Customer, capturing per-step screenshots and console/network observations, and — where the Customer requests and approves it — recorded video of such re-executed flows, stored as recordings.
  • Duration: the term of the Customer’s account, plus the deletion periods set out in the privacy policy.
  • Categories of data subjects: the Customer’s users, and any individuals visible, audible or otherwise identifiable in recordings.
  • Categories of personal data: any personal data shown on screen or spoken during a recording; navigation metadata (paths, page titles, interaction events); names and email addresses of the Customer’s users; and, for reproduction runs requested by the Customer, screenshots of pages rendered by SceneRecap’s browser against the Customer’s designated origin, which may show personal data that application displays. The product’s capture design excludes typed plain text and the contents of password and payment fields by default.
  • Special categories: the service is not designed for special-category data; whether such data appears in recordings is under the Customer’s control.

3. Confidentiality

SceneRecap ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations, and limits access to what operating the service requires.

4. Security

SceneRecap implements and maintains appropriate technical and organisational measures pursuant to Art. 32 GDPR, taking into account the state of the art and the risks of the processing. The current measures are described on the security page. SceneRecap may update them from time to time, provided the level of protection is not materially reduced.

5. Subprocessors

The Customer authorises SceneRecap to engage the subprocessors listed at /legal/subprocessors. SceneRecap will give at least 30 days’ notice before adding or replacing a subprocessor (by updating that page and notifying workspace admins). The Customer may object on reasonable data protection grounds within that period; if no resolution is found, the Customer may terminate the affected subscription with a pro-rated refund of prepaid fees. SceneRecap imposes data protection obligations on its subprocessors equivalent to those in this DPA and remains liable for their performance.

6. International transfers

Primary hosting is in Google Cloud’s EU regions: europe-west1 (Belgium) for compute and databases and europe-west3 (Frankfurt, Germany) for media storage. Where a subprocessor processes personal data outside the EU/EEA or the UK, the transfer is safeguarded by an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or by the EU Standard Contractual Clauses, supplemented by the UK Addendum or the Swiss addendum where applicable.

7. Assistance

Taking into account the nature of the processing, SceneRecap assists the Customer with appropriate technical and organisational measures in fulfilling its obligations to respond to data subject requests (Arts. 12–23 GDPR) — primarily through the product’s search, export and deletion features — and, insofar as information is available to SceneRecap, with the Customer’s obligations under Arts. 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

8. Personal data breaches

SceneRecap notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides the information reasonably required for the Customer to meet its own notification obligations, as it becomes available.

9. Deletion and return

During the term, the Customer can delete recordings and export data through the product. Upon termination of the account, SceneRecap deletes all Customer Personal Data in accordance with the retention periods in the privacy policy, unless EU or member state law requires further storage.

10. Audit

SceneRecap makes available the information necessary to demonstrate compliance with Art. 28 GDPR, in the first instance through its security documentation and subprocessor list. Where this is insufficient, SceneRecap will, at most once per year and on reasonable notice, allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer, at the Customer’s expense and subject to reasonable confidentiality and scheduling requirements.

11. Liability and precedence

The liability provisions of the Terms apply to this DPA. In the event of a conflict between this DPA and the Terms with respect to the processing of Customer Personal Data, this DPA prevails.