vantmetry
Sign In
Last Updated:

Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service and applies whenever Vantmetry processes personal data on your behalf. It is written to meet Article 28 of the GDPR. Accepting the Terms of Service accepts this DPA, so no signature is needed to rely on it. If your organisation requires a countersigned copy naming the contracting parties, email us and we will provide one.

1. Roles of the Parties

Vantmetry handles two distinct kinds of data, in two distinct roles:

Vantmetry does not determine the purposes of processing Customer Data, does not use it for its own purposes, does not sell it, does not use it to train machine learning models, and does not use it for advertising or profiling.

2. Subject Matter and Duration

The subject matter of the processing is the provision of the Service: receiving, storing and making queryable the error and log events your tracker sends. Processing lasts for as long as your subscription or trial is active, plus the deletion periods described in section 8.

3. Nature and Purpose of Processing

We process Customer Data only to provide the Service to you. In practice that means receiving events over the ingestion endpoints, deduplicating and aggregating them, grouping them into issues by fingerprint, resolving minified stack traces against source maps fetched from your own servers, storing them in per-project databases, rotating older data out when a storage cap is reached, serving them back to you through the dashboard, CLI, SQL API and MCP server, evaluating your uptime checks and error spike alerts, and forwarding events to a log destination if you configure one.

4. Types of Personal Data

Each stored event can contain the following fields:

No IP address is stored with events. IP addresses are used transiently at the ingestion edge to block repeated authentication failures and to rate limit abuse. They are not written to log storage.

Personal data can nonetheless appear inside error messages, stack traces, page URLs and the raw payload, because those fields carry whatever your application puts into them. Before transmission the tracker applies best-effort masking in the browser to email addresses, credit card numbers, US Social Security numbers, JSON Web Tokens, Authorization header values, and values held under sensitive object keys such as passwords and API keys. This masking is best-effort and cannot be complete. You remain responsible for what your application writes into its errors.

You must not deliberately send special category data within the meaning of Article 9 of the GDPR, nor data relating to children, through the Service.

5. Categories of Data Subjects

Visitors and end users of the websites and applications on which you install the tracker, and your own personnel who use those applications.

6. Your Instructions

We process Customer Data only on your documented instructions. Your use of the Service, including the settings you choose in the dashboard, constitutes those instructions. If we believe an instruction infringes applicable data protection law, we will tell you and may decline to carry it out.

You are responsible for having a lawful basis for the processing, and for giving data subjects whatever information the GDPR requires you to give them about it.

7. Confidentiality and Personnel

Access to Customer Data is limited to personnel who need it to operate, secure or support the Service, and those people are bound by confidentiality obligations that survive the end of their engagement.

8. Deletion and Return

Deleting a project permanently deletes that project’s log data. Trial project data is deleted 60 days after the trial ends. When your subscription ends, your data is deleted through those same mechanisms. Your data is never locked in: everything is exportable at any time through the read-only SQL API and the CLI, so export before termination if you need a copy.

9. Subprocessors

You give a general authorisation for Vantmetry to engage subprocessors. Each one is bound by data protection obligations equivalent to those in this DPA, and Vantmetry remains liable to you for their performance.

The current list is in Annex II. Only one subprocessor processes Customer Data.

Before a new or replacement subprocessor begins processing Customer Data, we publish the change to Annex II on this page and update the date at the top, so you can see what the list says at any time and when it last changed.

Every such change produces a new dated version of this DPA, and every previous version stays publicly available in the legal archive, so you can read exactly what the subprocessor list said on any date and what you accepted at the time.

If you object to a change on reasonable data protection grounds, tell us. If we cannot accommodate the objection, you may stop using the Service and cancel your subscription, and any refund is handled under our Refund Policy.

10. International Transfers

Customer Data is stored exclusively on infrastructure located in Germany and is not transferred outside the European Economic Area.

Account Data can involve a transfer to the United States, because our transactional email provider is US-based. That transfer is limited to your email address for the purpose of delivering login links, and is covered by the Standard Contractual Clauses or the EU-US Data Privacy Framework as applicable to that provider.

11. Data Subject Requests

You can serve most requests yourself: your project data is queryable through the SQL API and the CLI, and deleting a project deletes its data. Where you need more, we will assist you in responding to requests from data subjects exercising their rights under Articles 15 to 22 of the GDPR, taking into account the nature of the processing.

If a data subject contacts us directly about Customer Data, we will not respond on your behalf. We will refer them to you, unless we are legally required to act otherwise.

12. Personal Data Breach

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay, with the information then available to us, and provide reasonable assistance with your own obligations under Articles 33 and 34 of the GDPR. Notification is not an acknowledgement of fault.

13. Data Protection Impact Assessments

On request we will provide reasonable assistance with your data protection impact assessments and any prior consultation with a supervisory authority, to the extent the assistance relates to our processing and is not available to you from this DPA, the Privacy Notice or the documentation.

14. Audits and Information

This DPA, the Privacy Notice and Annex I make available the information needed to demonstrate compliance with Article 28. If that is not sufficient for you, you may request an audit no more than once in any 12 month period, on at least 30 days’ written notice, at your own cost, subject to confidentiality, during business hours, and in a way that does not disrupt the Service or give access to any other customer’s data.

15. Order of Precedence

On matters of data protection, this DPA prevails over the Terms of Service and the Privacy Notice. Everything else stays as stated there, including the governing law and jurisdiction.

16. Term

This DPA takes effect when you accept the Terms of Service and remains in force for as long as we process Customer Data on your behalf.

Annex I: Technical and Organisational Measures

Measures in place under Article 32:

Annex II: Subprocessors

Processes Customer Data:

Processes Account Data only, never Customer Data:

Contact

For questions about this DPA, a countersigned copy, or anything else about how we process data, email us.

Related Reading