Data Processing Addendum

Last updated: 2 November 2026

This is a template. To use it, write to support@arrowly.dev with your company's details. It adds to the Terms and Conditions.

1. Parties and roles

The customer is the controller of personal data that reaches Arrowly through its app. Brayan Smith Pineda Duarte, running Arrowly, is the processor of that data.

2. What is processed

The subject matter is showing guides to the customer's users, for as long as the customer uses Arrowly. The people concerned are the customer's users and anyone named on the pages they use. The data is:

• Snapshots, the guide's text reading of a page, never carry input values, password content or query strings, or anything under [data-guide-ignore].
• The API logs metadata only, such as tenant, guide id, step kind, tokens, cost and latency, with request status and error codes. It never logs snapshots or goals.
• The model provider, Anthropic, receives page structure and labels and the user's goal, together with the company's product name and description, its help docs, the steps of the guide so far and the browser's language.
• Page structure means the page address without its query string, the title, visible headings, the open dialog's label, status messages, and each control's role, state, visible name, placeholder, options and context.
• Context is the text that tells a control apart from similar ones: its section heading, field group, dialog, or the first cell of its table row.
• The steps of the guide so far include each sign and question shown, the user's choices and free-text answers, which controls they used, and the page addresses, without query strings.
• A user's goal and free-text answers are sent as they were typed, so they hold whatever the user chooses to write.
• Labels, headings, status messages and context can contain personal data shown on the page, such as a customer's name on a button or in a table row. Marking those areas with data-guide-ignore keeps them out.

3. Instructions

We process this data only to run Arrowly as the customer's instructions and these terms describe, unless the law requires otherwise, in which case we tell the customer first where we are allowed to.

4. Confidentiality and security

Anyone we allow to process the data is bound to keep it confidential. We use appropriate technical and organisational measures for the risk, including encrypted connections, the allowed-website check, rate limits, and the data limits listed above. The customer controls what is excluded with data-guide-ignore.

5. Sub-processors

The customer authorises these sub-processors:

• Paddle sells your order as merchant of record and handles payment and tax.
• Cloudflare hosts this site, the API, the dashboard and stored data.
• Anthropic provides the AI model that decides each step.
• Resend sends sign-in emails.

We will tell the customer before adding or replacing one, so the customer can object. We bind each one to data protection terms like these and stay responsible for its work.

6. Helping the customer

We will help the customer answer requests from the people concerned, and with security, breach duties and data protection assessments, as far as our role allows. We will tell the customer without undue delay after becoming aware of a personal data breach.

7. Deletion

When the customer stops using Arrowly, we delete or return personal data as the customer chooses, within the periods in the Privacy Policy, unless the law requires us to keep it.

8. Audits

We will give the customer the information needed to show we meet these terms, and allow reasonable audits on reasonable notice.

9. Transfers

Personal data can be processed in countries other than the customer's. Where the law requires a transfer safeguard, the parties will put a valid one in place.