Innflyt Data Processing Agreement

Last updated: 11 October 2026 · Version: 2026-10-11

This is the Data Processing Agreement under Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") between Backroad AS, which provides Innflyt, and each Innflyt customer. It forms part of the Innflyt Terms of Use: a customer accepts it when it accepts those Terms by clicking through at sign-up or when completing an Order, so no separate signature is required. A countersigned copy can be requested from legal@innflyt.com.

The Processor Information page describes the same processing in plain language. How Backroad handles personal data as a controller is described in the Privacy Policy.

Parties

(1) Backroad AS, a limited company incorporated in Norway, organisation number 934 341 929, Måseskjæret 18, 5035 Bergen, Norway (the "Processor"); and

(2) the Customer that has accepted the Innflyt Terms of Use (the "Controller"),

each a "party". Capitalised terms not defined here have the meaning given in the GDPR or in the Terms of Use ("Service", "Customer Data", "Authorised Users", "Account Owners", "Plan", "Order").

1. Subject matter, roles and instructions

1.1 The Controller is the controller and the Processor is the processor of the Personal Data in the Customer Data. The Processor does not determine the purposes of the Processing and is not a joint controller.

1.2 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of data subjects are set out in Annex 1.

1.3 The Processor Processes the Personal Data only on the Controller's documented instructions, including with regard to transfers to third countries, unless European Economic Area (EEA) or Norwegian law to which the Processor is subject requires otherwise; in that case the Processor informs the Controller of that legal requirement before Processing, unless that law prohibits it on important grounds of public interest. The Controller's documented instructions are this DPA, the Terms of Use, the settings the Controller chooses in the Service (questions, fields, destinations, retention) and any further written instructions agreed by the parties. The Processor informs the Controller immediately if, in its opinion, an instruction infringes data-protection law.

1.4 The Processor does not use the Personal Data to train artificial-intelligence or machine-learning models, for its own advertising, profiling or analytics, for sale or for marketing by third parties, or to build data products.

2. Confidentiality

2.1 The Processor ensures that the persons it authorises to Process the Personal Data are bound by a duty of confidentiality and Process it only on the Controller's instructions.

3. Security

3.1 Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing and the risks to data subjects, the Processor implements the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

3.2 The Processor may update the measures in Annex 2 provided the overall level of security is not reduced.

4. Sub-processors

4.1 The Controller gives the Processor general written authorisation to engage sub-processors. The sub-processors engaged on the date of this DPA are listed in Annex 3, which is also published on the Processor Information page.

4.2 The Processor informs the Controller of any intended addition or replacement of a sub-processor at least thirty (30) days before the change takes effect, by email to the Account Owners and by updating the Processor Information page, so that the Controller can object. If the Controller objects on reasonable data-protection grounds and the parties cannot resolve the objection, the Controller may terminate the affected part of the Service before the change takes effect; where the Controller has paid for a Paid Plan, the Processor refunds the part of the fees that covers the period after termination.

4.3 The Processor imposes on each sub-processor, by written contract, the same data-protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures so that the Processing meets the requirements of the GDPR, as Article 28(4) GDPR requires. The Processor remains fully liable to the Controller for each sub-processor's performance of its obligations.

5. Processing locations and transfers

5.1 Where the Personal Data is stored and processed. The database and file storage are in the European Union (Stockholm, Sweden; Supabase region eu-north-1). The server-side functions that receive and deliver feedback run in the European Union (Frankfurt, Germany; Supabase region eu-central-1) for every call. The dashboard, which shows feedback to the Controller, and the websites run on servers in Norway (Stavanger, at UpCloud). Off-provider backups are stored in Cloudflare R2 in the European Union jurisdiction.

5.2 Processing outside the EEA. Some processing can take place outside the EEA: Supabase is contracted through Supabase Pte. Ltd (Singapore), and its staff support and monitor the platform from several countries around the clock; support and operations staff of other sub-processors may access systems from other countries; Cloudflare's global network carries email and web traffic; the weekly backup job runs on GitHub-hosted runners whose location the Processor does not choose; and Sentry, a United States company, stores error data in its European Union region but may access and process it from the United States and other countries. Annex 3 shows each case and its transfer mechanism.

5.3 Transfer mechanisms. Every transfer of Personal Data to a country outside the EEA without an adequacy decision is covered by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, "SCCs") in the sub-processor's data processing agreement, or by an adequacy decision under Article 45 GDPR, including the EU–US Data Privacy Framework for certified recipients. The Processor assesses each transfer and adds supplementary measures where needed.

6. Assistance to the Controller

6.1 Data subject rights. Taking into account the nature of the Processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data-subject rights under Chapter III GDPR. The dashboard lets the Controller export feedback and delete it. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not respond to it substantively unless the Controller authorises a direct response in writing.

6.2 Security, impact assessments and consultation. The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of the Processing and the information available to the Processor.

6.3 Personal data breach. The Processor notifies the Controller of a personal data breach affecting the Controller's Personal Data without undue delay after becoming aware of it, and within forty-eight (48) hours where possible, by email to the Account Owners. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information not available at first is provided in phases without undue further delay. The Processor records every breach. The Controller is responsible for notifying the supervisory authority and data subjects under Articles 33 and 34 GDPR; the Processor supports it with the information available.

7. Retention, return and deletion

7.1 Retention set by the Controller. By default the Service deletes feedback 365 days after it is received and screenshots 90 days after they are received, by an automated daily job. The Controller can choose another period between 30 and 3,650 days for each, can let screenshots follow the feedback ("Same as feedback"), or can choose "Keep until I delete it" ("keep"), which means no automatic deletion: the data is then kept until the Controller deletes it or this DPA ends. Deletion is permanent and removes the records and the stored files. The Processor keeps a deletion log recording the project, scope, counts and time of each deletion; it contains no end-user Personal Data.

7.2 Deletion by the Controller. The Controller can delete individual feedback, a project or its whole organisation in the dashboard at any time. Deleting a project or the organisation deletes its feedback and screenshots at once.

7.3 Return and deletion at the end. The Controller can export its feedback from the dashboard at any time before termination. On termination of the Service, or earlier on the Controller's written request, the Processor deletes all Personal Data Processed for the Controller within thirty (30) days, unless EEA or Norwegian law requires storage, and confirms the deletion in writing on request. If the Controller wants the data returned rather than deleted and cannot use the export, the Processor provides it in a common machine-readable format within the same period.

7.4 Backups. Copies of deleted data remain in backups until those backups expire: Supabase's daily backups are kept for 7 days, and the weekly off-provider backups in Cloudflare R2 are kept for 90 days and then deleted. Backups are used only to restore the Service after a failure. If a backup were restored, the daily retention job would again delete data whose retention period had run out, but data that the Controller had deleted itself after the backup was taken would reappear. The Processor would then tell the Controller which projects and which period are affected, so that the Controller can delete that data again.

8. Audit

8.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, by the Controller or an auditor it mandates. Audits require at least thirty (30) days' written notice (less after a substantiated security incident), take place no more than once in any twelve-month period unless there is cause, and are subject to confidentiality. The Processor may first answer an audit request with written documentation of its measures. Each party bears its own costs.

9. Controller obligations

9.1 The Controller is responsible for having a lawful basis for the Processing, for giving its end users the information required by Articles 13 and 14 GDPR, for the lawfulness of its instructions and settings, and for not configuring the Service to request special categories of personal data or other data excluded by clause 12 of the Terms of Use. The Controller should tell its end users, near the feedback entry point, not to include sensitive personal data that the feedback does not need.

10. Term, liability, precedence and governing law

10.1 This DPA takes effect when the Controller accepts the Terms of Use and remains in force for as long as the Processor Processes Personal Data on the Controller's behalf.

10.2 Liability under this DPA is subject to, and counts towards, the limitations of liability in clause 19 of the Innflyt Terms of Use, or in another written agreement for the Service signed by the parties. Nothing limits liability that cannot lawfully be limited, or the rights of data subjects under Article 82 GDPR.

10.3 If this DPA conflicts with the Terms of Use or another agreement between the parties on the Processing of Personal Data, this DPA prevails. This DPA is published in Norwegian and English; if the two versions differ, the Norwegian version prevails.

10.4 This DPA is governed by Norwegian law, including the Personal Data Act (personopplysningsloven, LOV-2018-06-15-38), which makes the GDPR Norwegian law under the EEA Agreement. Bergen District Court (Bergen tingrett) is the venue, without prejudice to data subjects' rights to bring proceedings elsewhere. The Processor's supervisory authority is the Norwegian Data Protection Authority (Datatilsynet).

10.5 This DPA may be changed only as set out in clause 23 of the Terms of Use, which requires at least 30 days' notice of material changes. Changes to the list of sub-processors follow clause 4.2.

Annex 1: Details of the Processing

• Subject matter and nature: receiving feedback that end users submit through the Innflyt widget on the Controller's sites and applications; storing it; showing it in the Controller's dashboard; sending it to the destinations the Controller configures (email, Slack, Microsoft Teams or webhooks); exporting and deleting it on the Controller's instructions; keeping backups.
• Purpose: to provide the Service to the Controller.
• Duration: for the term of the Service, and after it until deletion under clause 7.
• Categories of data subjects: end users of the Controller's sites and applications who submit feedback; where the Controller's own staff appear in feedback or settings, those persons.
• Categories of Personal Data:
  • the content the end user submits: free-text answers, answers to the Controller's own questions, the selected category or feature area, urgency, and whether they want a reply;
  • optional email address and optional user identifier, typed by the end user or supplied by the Controller's application for a signed-in end user;
  • page context: the address (URL) of the page, kept as domain and path only (anything after "?" or "#" is removed before storage), browser, operating system, device type, screen size, the browser's user-agent string, language, environment and the version of the Controller's application;
  • optional screenshots the end user chooses to attach (up to five images of up to 5 MB each);
  • the time of submission and a technical key that prevents duplicates;
  • a keyed hash of the end user's IP address, used only for rate limiting and deleted after 24 hours; the IP address itself is not stored with the feedback.
• Special categories: not requested. Because answers are free text and screenshots are chosen by the end user, an end user may include special-category data (Article 9 GDPR) or data about criminal convictions (Article 10) without being asked. The Processor Processes any such data only to store it and deliver it to the Controller.
• Retention: as set by the Controller under clause 7.1 (default 365 days for feedback and 90 days for screenshots; 30 to 3,650 days; or "keep"), backups as in clause 7.4.

Annex 2: Technical and organisational measures

These are the measures in place on 9 October 2026.

• Encryption in transit: the widget, dashboard, websites and data endpoints are served only over HTTPS (TLS); plain HTTP requests are redirected to HTTPS.
• Encryption at rest: the database and file storage are encrypted at rest by Supabase, the server disks at UpCloud are encrypted, and Cloudflare R2 encrypts the backups at rest.
• Database access control: Row-Level Security is enabled on every table in the application schema. The anonymous role used by the widget has no access to the tables that hold feedback, and feedback is written only by server-side code. Signed-in members of an organisation reach only their own organisation's projects through Row-Level Security, checked on every request, and deleting feedback requires a recent sign-in with a second factor.
• Dashboard sign-in: no passwords; Authorised Users sign in with a passkey or a one-time code sent by email, and can add two-step verification with an authenticator app. Sign-in pages are protected against bots (Cloudflare Turnstile) and rate-limited. A new device signing in triggers an email notice. Sensitive actions, such as deleting an account or organisation or starting a payment, require a recent sign-in. Organisations have owner, administrator and member roles.
• Pseudonymisation: IP addresses are not stored with feedback; rate limiting uses a keyed hash, deleted after 24 hours.
• Screenshots: stored in a private storage bucket with unguessable object names and no public access; uploads use short-lived signed upload links, limited to PNG, JPEG and WebP images of up to 5 MB; links sent to destinations are signed and expire (by default after 7 days).
• Integrity of delivery: every webhook carries an HMAC-SHA-256 signature (X-Innflyt-Signature) so the Controller can verify it; each submission carries a key that prevents duplicate records; deliveries go through a durable queue so that a slow destination does not affect the end user.
• Retention and deletion: an automated daily job deletes data whose retention has run out, a weekly job removes screenshots never attached to a submission, and each deletion is logged without end-user data.
• Backups: daily backups by Supabase kept for 7 days, and a weekly off-provider backup in Cloudflare R2 (European Union jurisdiction) kept for 90 days under a retention lock.
• Error monitoring: Sentry, in its European Union region, for server-side code only (no Sentry code runs in the browser), with sending of personal data switched off, IP-address scrubbing switched on and no session replay.
• Secrets: service credentials are kept in the continuous-integration secret store and on the servers, never in source code or in the browser.
• Software maintenance: automated dependency-update pull requests are enabled for the dashboard, website and widget code, and builds and type checks run before deployment.
• Organisation: access to production systems is limited to the persons at Backroad who need it to run the Service, bound by confidentiality.
• Review: these measures are reviewed at least once a year and when risks, technology or law change.

Annex 3: Sub-processors

Supabase's own sub-processors are listed at supabase.com/legal/customer-resources/subprocessor-list.

Not sub-processors. The destinations the Controller configures (its email addresses, Slack, Microsoft Teams or webhook endpoints) receive feedback as the Controller's own recipients. Backroad uses Linear Orbit, Inc. for its own product work; the Service does not send Customer Data to it, and clause 12 of the Terms of Use forbids configuring a destination that would. Payment providers handle only billing data, for which Backroad is the controller (see the Privacy Policy).