Data Processing Agreement

This agreement is between you (the “Customer”), acting as controller, and Cre8-it B.V. (registered office: Baron van Nagellstraat 136, 3771 LL Barneveld, the Netherlands; KvK 42147119; VAT NL869923651B01), operator of Tapinto, acting as processor.

The split matters, because the two directions are governed differently:

• Traffic through your tunnel — you are the controller, we are your processor. This agreement governs it.
• Your own account (your sign-in identity, API keys, billing records, the tunnels you created) — we are the controller, because we decide what to collect in order to run and bill the Service. The Privacy Policy governs that, not this agreement.

Subject matter and nature. We receive HTTP requests addressed to a hostname you control on tapinto.it, frame them onto the WebSocket your CLI holds open, and return your local server’s response to the caller. Along the way we count the traffic for billing, parse MCP JSON-RPC envelopes so your inspector can show them to you, and keep a short rolling window of that traffic so the inspector still has something to display when you open it.

Purpose. To provide the Service to you. We do not process tunnel traffic for any purpose of our own. In particular we do not use it to train machine-learning models, we do not sell or share it, and it does not feed our analytics.

Duration. For as long as you hold a Tapinto account, plus the retention windows in Section 4.

We do not choose what flows through your tunnel — you do. So neither of us can enumerate the categories exhaustively in advance. In practice:

Categories of data subjects

• the end users, testers, and colleagues who call the tunnel URL;
• anyone whose personal data appears inside a request or response body your local server sends or receives;
• anyone represented in the arguments or results of an MCP tool call made through the tunnel.

Categories of personal data

• network identifiers of callers — IP address, user-agent, and whatever else their client sends as headers;
• request and response content, including any identifiers, credentials, or free text your application carries;
• anything in the request URL, including query-string parameters.

Special categories. Tapinto is a development and testing tool. It is not designed for, and you should not route through it, health data, biometric data, or the other special categories in Article 9 GDPR in a live production setting. If your use case requires that, contact us before you start.

This is the section most people are looking for, so it describes the system rather than an intention. Everything below is what the running code does today.

The 24-hour inspector window is a rolling one: it is measured from the tunnel’s last request, not its first, so a tunnel that stays busy keeps a moving 500-event window rather than accumulating history.

• Documented instructions. We process tunnel traffic only to provide the Service as described in Section 2, and on your instructions. Your instructions are the Terms of Service, this agreement, and the configuration you choose in the CLI and dashboard. If we believe an instruction breaks EU or member-state data-protection law, we will tell you and may pause that processing.
• Legal compulsion. If a law requires us to process your data otherwise, we will tell you before we do — unless that same law forbids us from telling you.
• Confidentiality. Everyone with access to production is bound by a confidentiality obligation that survives the end of their engagement.
• Security. We maintain the measures in Section 8.
• Sub-processors. Section 7.
• Assistance. Section 9.
• Deletion and return. Section 10.
• Audit. Section 11.

The inspector is scoped to the tunnel’s owner. Every inspector request — both the live stream and the backlog — is checked against the authenticated user before any data is returned, and the lookup is partitioned by user ID, so one account cannot read another account’s traffic even if it knows the tunnel ID. Our admin tooling exposes tunnel lifecycle records for abuse investigation; it has no view of tunnel contents.

That leaves infrastructure access. An engineer with production credentials for the Azure environment could reach the Redis instance holding the 24-hour inspector window. That access is limited to people who operate the Service, gated by managed identity and role-based access control, and used for operating and debugging the Service. We would rather state that plainly than imply an encryption-based guarantee we do not currently offer.

You give us a general authorisation to engage the sub-processors below. We will publish any addition or replacement here and notify account holders by email at least 30 days before it takes effect. If you object on reasonable data-protection grounds within those 30 days, tell us and we will work with you on an alternative; if there is none, you may terminate the affected part of the Service without penalty and we will refund any prepaid, unused fees.

Sub-processors that can access tunnel content

Sub-processors that handle your account, not your tunnel traffic

Each is engaged under that provider’s standard DPA, accepted when we engaged them, rather than an individually negotiated contract. We remain fully liable to you for their performance.

• Encryption in transit. TLS 1.2 or higher on every public hop — caller to Cloudflare, Cloudflare to our edge, your CLI to our edge.
• Encryption at rest. Azure platform-managed keys on all stored data. The 24-hour inspector window never reaches disk: the Redis instance runs without persistence and is unreachable from the internet.
• Access control. Tunnel data is partitioned by account and every read is authorised against the authenticated user. Production access uses managed identities and role-based access control; secrets live in Azure Key Vault.
• Data minimisation in telemetry. Request bodies, headers and query strings are excluded from logs and error reports by design, not by redaction after the fact.
• Credential handling. API keys are stored as one-way hashes; the plaintext is shown once and is not recoverable afterwards.
• Resilience. Cosmos DB runs with continuous backup and point-in-time restore. Availability targets are in the Terms; we do not offer a contractual uptime SLA.

We do not currently hold ISO 27001 or SOC 2 certification, and we would rather say so than let the list above imply otherwise.

• Data subject requests. If one of your data subjects contacts us directly, we will not respond on your behalf. We will refer them to you and tell you within 5 working days. If you need our help to answer a request, email us and we will assist at no charge for reasonable volumes.
• Breach notification. If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours of becoming aware — in time for you to meet your own 72-hour deadline. The notice will describe what we know, what we are doing, and what we recommend you do.
• Impact assessments. We will give you the information you reasonably need for a DPIA or a prior consultation with a supervisory authority. Sections 4, 7 and 8 are written to cover most of it.

• Inspector data expires on its own within 24 hours of a tunnel’s last request, whether or not you delete the tunnel.
• On termination of your account, we delete the personal data we process on your behalf within 30 days of your request, except records we must keep by law — principally invoices and the usage totals behind them, which Dutch tax law requires us to retain for seven years. Those totals are counts and timestamps, not content.
• Return. Ask before termination and we will export what we hold in a structured, machine-readable format.
• To request deletion, email [email protected] from your account address.

On reasonable written notice and no more than once a year, we will answer your written questions about our compliance with this agreement and provide the documentation we have. Where that is not enough to demonstrate compliance, you or an independent auditor bound by confidentiality may inspect our processing, during business hours, in a way that does not disrupt the Service. You bear the cost unless the audit reveals a material breach of this agreement. A supervisory authority exercising its own powers may audit at any time and we will cooperate.

Everything we store is stored in the EU, in Azure’s West Europe region.

Traffic in transit is different, and worth being precise about. Cloudflare serves each caller from the point of presence nearest them, so a request from outside the EU is terminated outside the EU before it reaches our infrastructure. Where that involves a transfer of personal data out of the EEA, it is governed by the EU Standard Contractual Clauses in Cloudflare’s Data Processing Addendum. The same applies to GitHub for the OAuth handshake.

The limitations of liability in the Terms of Service apply to this agreement, except where the GDPR does not permit them to. If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement wins.

We may update this agreement to reflect changes in the Service or in the law. If a change is material we will notify account holders by email at least 30 days before it takes effect. Sub-processor changes follow Section 7.

This agreement is governed by the laws of the Netherlands, with the jurisdiction provisions of the Terms of Service.

Data-protection questions, DPA countersignature requests, audit requests and breach notifications: [email protected]. We have not appointed a Data Protection Officer; Article 37 GDPR does not require one at our scale, and this address reaches the people who run the Service.