Data Processing Agreement

Last updated November 10, 2026

This agreement sets out how we process personal data on a customer's behalf, as Article 28 of the GDPR requires. It's part of the Terms of Service, applies to every plan, free or paid, and takes effect when the customer accepts the Terms. Nobody needs to sign it.

Parties and roles

• The customer is the person or organization that holds a mostra workspace and accepted the Terms. The customer decides how the personal data in its workspace is used (the GDPR calls this the controller), or handles it for its own client (the GDPR calls this a processor). In that case we're its sub-processor, and the customer passes on to its client whatever this agreement requires.
• We: In this agreement, "we" and "us" mean mostra. We handle the data only on the customer's behalf (the GDPR calls us the processor).

• Email: [email protected]

"Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" mean what they mean in the GDPR (Regulation (EU) 2016/679). "Customer personal data" is the personal data we process for the customer under the Terms, described in Annex 1.

Subject, duration, nature and purpose

• Subject: the customer personal data in the customer's workspace and its projects.
• Duration: as long as the Terms apply between us, and after that until we've deleted the data as described in Deletion at the end.
• Nature: storing, organizing, showing and transmitting the data; turning speech into text, and text into comments, with the help of AI; and making it available to the customer's builders, reviewers and coding agents.
• Purpose: only to provide mostra to the customer under the Terms.

Instructions

• We process customer personal data only on the customer's documented instructions, including about transfers outside the European Economic Area, unless EU or Polish law requires us to do otherwise. In that case we tell the customer about that legal requirement first, unless that law forbids it.
• The customer's instructions are the Terms, this agreement, and what the customer does in mostra: its settings, the invite links it creates, and what its builders and coding agents do. Any other instruction must be in writing, email included, and consistent with the Terms.
• We tell the customer at once if, in our opinion, an instruction infringes the GDPR or other data protection law.

What the customer is responsible for

• Having a legal basis for the processing, and informing the people whose data it is, such as its reviewers, including about Talk, which turns a reviewer's spoken feedback into comments, and the transcription mode it chooses.
• Not putting special categories of personal data, or data about criminal convictions, into mostra, and marking the parts of its pages that show such data, or anything else that shouldn't be recorded, with data-mostra-mask.
• Choosing the transcription mode that suits it. With browser speech recognition, a reviewer's own browser may send the audio to the browser's maker. That service belongs to the browser. Its maker provides it to the person using the browser, not to us, so the maker isn't our sub-processor. The welcome card a new reviewer sees says so. A customer who doesn't want this can choose on-device speech.
• Whatever it sends out of mostra, for example to its coding agent and that agent's AI provider. That's outside this agreement.

Confidentiality

Everyone we authorize to process customer personal data is bound to keep it confidential, by contract or by law.

Security

We take the technical and organizational measures in Annex 2 to protect customer personal data, as Article 32 of the GDPR requires, given the state of the art, the cost, and the nature, scope, purposes and risks of the processing. We may change them, as long as the overall level of protection doesn't drop.

Sub-processors

• The customer gives us general authorization to use sub-processors. The current ones are listed in Annex 3.
• At least 14 days before we add or replace a sub-processor, we update Annex 3 and email the workspace's builders. The customer can object within that time, on reasonable data protection grounds. If we can't resolve the objection, the customer can end the Terms before the change takes effect, and we'll refund the unused part of the period it paid for, through Link.
• If a sub-processor stops providing its service, or has to be replaced at once to keep mostra running or secure, we may replace it without waiting. We then tell the workspace's builders without undue delay, and the customer can object and end the Terms in the same way.
• We bind each sub-processor by contract to data protection obligations that give at least the protection this agreement gives, as Article 28(4) of the GDPR requires. We remain responsible to the customer for how our sub-processors meet them.

Helping with data subjects' requests

• The customer can handle many requests in mostra itself: its builders can delete comments, and revoke reviewers and invite links, themselves. For anything it can't do itself, such as erasing a reviewer's name or email address, we help when asked, as far as the nature of the processing allows.
• Help under this section and the next is free unless it takes us substantial work. In that case we tell the customer first, and may charge our reasonable costs.
• If a data subject contacts us directly about customer personal data, we pass the request on to the customer without undue delay, and we don't answer it ourselves, except to say that we've passed it on.

Helping with the customer's other obligations

Taking into account the nature of the processing and the information we have, we help the customer meet its obligations under Articles 32 to 36 of the GDPR: security, notifying personal data breaches, data protection impact assessments, and prior consultation with a supervisory authority.

Personal data breaches

• We notify the customer of a personal data breach that affects customer personal data without undue delay after we become aware of it. We write to the email addresses of the workspace's builders.
• The notice describes, as far as we know at the time: what happened, the categories and approximate number of people and records affected, the likely consequences, and what we've done or plan to do about it. What we don't know yet, we send as soon as we know it.
• We take reasonable steps to contain the breach and limit its effects.
• Notifying a breach isn't an admission of fault.

Deletion at the end

• While its account is active, the customer can read its comments through the API. If the customer asks before the Terms end, we send it its project data, in a machine-readable format, before we delete it, as the Terms describe under Leaving, and taking your data with you.
• When the Terms end, we delete customer personal data within 30 days, or, where the customer asked for a copy, within 30 days after we've sent it and the 30 more days the Terms give have passed, unless EU or Polish law requires us to keep it. Copies in our database backups are deleted when those backups expire, at most 28 days after the data itself is deleted.

Information and audits

• We give the customer the information it needs to show that the obligations in Article 28 of the GDPR are met, and we allow for and contribute to audits, including inspections, by the customer or an auditor it mandates.
• We first answer written questions and share documents. If that isn't enough, or a supervisory authority requires it, the customer can audit: with at least 30 days' notice, during business hours, at most once a year unless after a personal data breach or at an authority's request, at its own cost, including our reasonable costs of taking part, and under a confidentiality agreement. The auditor can't be a competitor of mostra.

Transfers outside the European Economic Area

• We transfer customer personal data outside the European Economic Area only to the sub-processors in Annex 3, or on the customer's instructions, and only with a safeguard under Chapter V of the GDPR: an adequacy decision, such as the EU-US Data Privacy Framework for a certified recipient, or the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, agreed with the recipient.
• If the customer is outside the European Economic Area, and returning customer personal data to it is a transfer that needs a safeguard, the standard contractual clauses, Module Four (processor to controller), are part of this agreement, with us as the data exporter and the customer as the data importer. For clauses 17 and 18, the law of Poland and the courts of Poland apply.

Liability, precedence and law

• Each party's liability under this agreement follows the Terms, including their limits, except where the GDPR doesn't allow liability to be limited. Nothing here limits the rights of data subjects under Article 82 of the GDPR.
• If this agreement and the Terms disagree about data protection, this agreement wins.
• Polish law governs this agreement, and the courts named in the Terms decide disputes about it.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption in transit: connections to mostra use HTTPS.
• Access control: access is limited to the workspace or project it was given for. A reviewer's access covers one project and expires. Passwords, API keys and login links are stored as hashes.
• Separation: comments marked as team only aren't sent to reviewers.
• Data minimization: we don't store audio or transcripts. The script is built not to capture form field values or text inside data-mostra-mask, and to do nothing for visitors without an invite.
• Usage limits: caps on use, to prevent abuse.
• People: access to production systems is limited to those who need it, and they are bound to confidentiality (see Confidentiality).

Annex 3: Sub-processors

Transfers to the providers in the United States rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses.

Not sub-processors: Stripe and Link process payment data as independent controllers. A browser maker's speech service, on projects that use browser speech recognition, works for the reviewer. Tools the customer connects, such as its coding agent, work for the customer.