Data processing addendum

Last updated: 7 October 2026.

This addendum is part of the terms of service between you and Discover Webtech Pvt Ltd ("MeshArc", "we"). It applies whenever we process personal data on your behalf while providing the service — above all, the personal data inside the pages you crawl. You accept it by accepting the terms; nothing more needs signing. On the Growth plan and above we will also countersign a copy: write to [email protected].

Where this addendum and the terms disagree about personal data, this addendum wins. Words such as personal data, processing, controller, processor, data subject and personal data breach mean what the data protection law that applies gives them: the EU GDPR, the UK GDPR, the Swiss FADP, India's Digital Personal Data Protection Act 2023 (where data fiduciary reads as controller and data processor as processor), or any other.

Roles#

• You are the controller of the personal data you have MeshArc process: you choose the sites, the scope, the schedule, what is extracted and where it goes. If you act for a client of your own, you are its processor and we are your subprocessor, and you pass its instructions on to us.
• We are your processor. We process that data only to provide the service, and only on your documented instructions: the terms, this addendum, and what you configure in the app or ask of the API, the SDKs or the MCP server.
• If we believe an instruction breaks the law, we tell you and may decline to follow it. If the law makes us process the data in a way you did not instruct, we tell you first unless the law forbids it.
• For your account, your workspace's settings and your billing, we are a controller in our own right; the privacy policy covers that data.

What we process#

Our commitments#

• Confidentiality. Only people who operate the service can reach your data, each bound to keep it confidential. They look at a specific page only to investigate an incident you report, an abuse report, or a legal demand, and only as far as the task needs.
• Security. We keep the technical and organisational measures in the Annex and on the security page. We may improve them; we will not reduce the overall protection they give.
• Helping you answer people. If a data subject writes to us about data you control, we pass the request to you and do not answer it ourselves. The app and the API let you find, export and delete pages; where you need more help to answer a request, or with a data protection impact assessment or a consultation with a regulator, we give it at no extra cost within reason.
• No other use. We do not sell your data, do not use it to train models, do not combine it across workspaces, and do not use it for our own purposes.

Subprocessors#

• You authorise us to use the subprocessors on the subprocessors page. Each is bound by a written contract with data protection obligations no weaker than this addendum's, and we remain responsible to you for what they do.
• We post a new subprocessor there at least 30 days before it starts processing personal data. If you object on reasonable data protection grounds within that time, we will try to find a way to serve you without it; if we cannot, you may end the affected part of the service and we refund what you prepaid for the time left.

Personal data breaches#

• If we become aware of a breach affecting personal data we process for you, we tell your workspace owners without undue delay and in any case within 48 hours, by email.
• The notice says what happened, the data and the number of people likely affected, the likely consequences, what we have done and will do, and who to talk to. What we do not know yet follows as we learn it.
• We report incidents that the law requires us to report ourselves — to CERT-In within six hours, for example. Notifying regulators and data subjects about data you control is your decision, and we help you with it.

Transfers out of the EEA, the UK and Switzerland#

MeshArc is operated from India, and the data is stored on its own servers in India. Where personal data covered by the GDPR, the UK GDPR or the Swiss FADP is transferred to a country without an adequacy decision, the transfer is made under:

• the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two where you are a controller and Module Three where you are a processor, with clause 7 included, option 2 of clause 9(a) with the 30 days above, the optional wording in clause 11 left out, and clauses 17 and 18 choosing the law and courts of Ireland;
• for the UK, the International Data Transfer Addendum issued by the Information Commissioner, with its tables completed from this addendum;
• for Switzerland, the same clauses with the FDPIC as the competent authority and references to the GDPR read as references to the FADP.

The annexes the clauses need are completed by this addendum: the parties and roles from Roles, the description of the transfer from What we process, the measures from the Annex, and the subprocessors from the subprocessors page. If the clauses and this addendum conflict, the clauses win.

Audits#

• On request, once a year, we answer a reasonable security questionnaire and share the reports we have, such as a penetration test summary or a certification report.
• If that is not enough to show we meet this addendum — after a personal data breach, or when a regulator requires it — you may audit us, yourself or through an independent auditor bound to confidentiality, with 30 days' notice, during working hours, without access to other customers' data, at your cost.

Your commitments#

• You have a lawful basis for the personal data you have MeshArc collect, you give people the notices the law requires, and your instructions are lawful.
• You follow the acceptable use section of the terms, including respecting robots.txt and the terms of the sites you crawl unless you have the right not to.
• You keep your account credentials and API keys secret, and set project retention no longer than you need.

When the agreement ends#

Your data stays exportable through the app and the API until the workspace closes. We delete it within 30 days of closing, and copies in backups as those backups expire, unless the law requires us to keep it; whatever we keep stays protected by this addendum.

Liability#

Each party's liability under this addendum is subject to the limits in the terms, except where the law does not allow it to be limited.

Annex: security measures#

• In transit: all traffic to the app and the API uses TLS.
• Secrets at rest: destination credentials and two-factor secrets are encrypted in the database (Fernet: AES-128 with an HMAC-SHA256 check) and never returned by the API. Passwords are hashed with salted PBKDF2-SHA256; API keys, session and invitation tokens with SHA-256.
• Tenancy: every record carries its workspace, every query is scoped by it, and another workspace's id answers 404.
• Access: roles gate every action in a workspace; API keys carry scopes, an optional project list, an expiry and a rate limit, and are stored hashed. Production access is limited to the people who operate the service.
• Accounts: passwords are stored as salted PBKDF2-SHA256 hashes; email verification; sessions in HttpOnly, Secure cookies with a 30-day life and a 14-day idle limit; two-factor authentication available to every account.
• Monitoring: sign-in and security events are kept for 180 days, request logs for 180 days, and errors are reported without personal data.
• Retention: pages are deleted when the project's retention passes; deleting a project deletes its runs and pages.
• Resilience: regular backups.
• Incidents: a written response plan with the notice times above.
• Vulnerabilities: a reporting address, [email protected], answered within two working days; dependencies pinned and updated on a schedule.

Contact#

[email protected] · Discover Webtech Pvt Ltd, India.