This agreement is part of the terms of service. It applies when Journey Lanes, run by Developerlab (the processor), processes personal data on behalf of an organization that uses it (the controller), as Article 28 of the GDPR requires.
1. Subject, purpose and duration
The processor processes personal data only to provide Journey Lanes as described in the terms and the product pages, on the controller’s documented instructions, which are given by using and configuring the service. It lasts as long as the controller uses Journey Lanes.
2. Data and people concerned
- Kinds of data: whatever the controller’s systems return during runs, audits and load tests (which may include names, email addresses, identifiers and other data of the controller’s users), credentials of test accounts, repository contents read during scans, and data the controller enters in flows and mock data.
- People: the controller’s users, employees and test accounts whose data appears in those systems.
- The controller doesn’t point Journey Lanes at special categories of data (health, beliefs and the like) unless that is lawful and necessary for its tests.
3. Processor’s obligations
- Processes the data only on the controller’s instructions, and tells the controller if an instruction seems to break data protection law.
- Ensures that everyone with access is bound to confidentiality. Platform administrators get no access to project data.
- Takes appropriate technical and organizational measures (Article 32), including: encryption of credentials and secrets at rest (AES-GCM); encryption in transit (HTTPS); masking of replies from live environments in run history; deletion of live runs after the environment’s retention; access control per organization and project with roles; network rules that keep the database private; the measures on the security page.
- Helps the controller answer requests from people exercising their rights, and with security, breach notification and impact assessments, as far as reasonable.
- Makes available the information needed to show compliance with this agreement, and allows audits by the controller or an auditor it appoints, announced reasonably in advance and at the controller’s cost.
4. Sub-processors
The controller agrees to the sub-processors below. The processor informs owners at least 30 days before adding or replacing one; the controller may object, and may end the service if the objection isn’t resolved. Each sub-processor is bound by the same data protection obligations.
| Sub-processor | What for |
|---|---|
| Hetzner Online GmbH, Germany | Servers and database |
| Sendinblue SAS (Brevo), France | Emails such as alerts, which can contain flow and step names |
| Your Hosting B.V. (PCextreme), the Netherlands | Email the controller’s people send to support, which can contain whatever they include in it |
| Functional Software, Inc. (Sentry), United States | Error reports: the error message and where in the code it happened, which can contain names such as a project or flow (transfers under the EU-U.S. Data Privacy Framework or standard contractual clauses) |
| Anthropic PBC, United States | Drawing flows, “Help me” and “Explain this failure”, only when a user asks for it: descriptions, a summary of the scanned repositories, the step being helped or explained with its result, and the source files behind it (transfers under the EU-U.S. Data Privacy Framework or standard contractual clauses) |
Services the controller connects or points Journey Lanes at, such as its own environments, GitHub, GitLab, Bitbucket, an OpenAPI document’s address, Slack, Microsoft Teams, webhooks and test inboxes, are not sub-processors: data goes there on the controller’s instruction and under the controller’s own agreements with them.
5. Personal data breaches
The processor informs the controller without undue delay, and within 48 hours of becoming aware of a breach affecting the controller’s data, with what is known: what happened, which data and people are concerned, the likely consequences and the measures taken. It keeps the controller informed as more becomes known.
6. Transfers
Data is stored in the European Economic Area, except error reports (Sentry) and what is sent for drawing flows and “Help me” (Anthropic), which go to the United States. Those transfers rely on the EU-U.S. Data Privacy Framework where the company is certified, and on the European Commission’s standard contractual clauses otherwise.
7. End
When a project or organization is deleted, its flows, runs, audits, environments and mock data are deleted with it. The processor doesn’t delete data on its own when a subscription ends: the controller deletes it in the app, or asks at privacy@journeylanes.com, and the processor then deletes it within 30 days, except where the law requires keeping it, such as invoices. Backups that contain it expire within 30 days after that.
8. Contact
Questions and notices about this agreement go to privacy@journeylanes.com.