Last updated: 10 October 2026
This Data Processing Addendum (“DPA”) forms part of the agreement governing the use of the Superdegree services (the “Agreement”) between SUPER DEGREE, ABN 95 926 075 671 (“Superdegree”, “Provider”, “we”, “us”) and the customer entity that has entered into the Agreement (“Customer”).
This DPA applies where Superdegree processes Personal Data on behalf of Customer in connection with the Services. It is incorporated into the Agreement when Customer accepts our Terms of Service on behalf of an organisation, or when an order, proposal or other agreement with Superdegree refers to it. Customers that require a countersigned copy may request one at [email protected].
If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA will control to the extent of that conflict.
For purposes of this DPA:
Terms such as “controller”, “processor”, “processing”, “data subject”, “consumer”, “business”, “service provider” and “contractor” have the meanings given to them under the applicable law.
Where Customer determines the purposes and means of processing Customer Personal Data, Customer acts as controller and Superdegree acts as processor.
Where Customer acts as a processor on behalf of another controller, Superdegree acts as Customer’s Sub-processor.
Superdegree will process Customer Personal Data only:
The Agreement, Customer’s configuration and use of the Services, and documented requests made by Customer constitute Customer’s instructions to Superdegree.
If Superdegree reasonably believes an instruction infringes Applicable Data Protection Law, Superdegree will inform Customer.
The subject matter, nature, purpose and duration of processing, categories of Personal Data and categories of data subjects are described in Annex I.
Where a user records a browser tab with the Recorder, or Customer instructs the AI Agent to operate a browser in an application Customer nominates, the Services may capture, alongside video and audio, Page Capture Data comprising page content and structure, text, images, styles, page titles and URLs, clicks, scrolling, and text entered into forms. Uploaded media files contain only their own video and audio.
Page Capture Data is Customer Content and is processed to provide the requested functionality, including to:
The following limits apply:
Page Capture Data can include page content that does not appear in the rendered video or still frames, such as content outside the visible area of a page. Customer should take this into account when deciding which application, account and data to record or nominate.
The Recorder holds the current recording and Page Capture Data in local browser storage on the user’s device only until it is uploaded or discarded, so that saving can continue if the extension popup is closed. On upload, recordings are stored in Customer’s workspace.
Separately from Page Capture Data, Superdegree collects Product Analytics Data about how Customer’s authorised users use the Superdegree web application, including usage events, errors and session replay of interactions with that application. Session replay of the web application may include Customer Content displayed within it.
Product Analytics Data is not collected by the Recorder, which contains no analytics software, and is not collected from the applications Customer records or nominates for the AI Agent.
Product Analytics Data is processed for the purposes in Section 2.2(a) and is retained as described in Section 13.5.
Customer is responsible for:
Superdegree will ensure that persons authorised to process Customer Personal Data:
Superdegree will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The security measures currently maintained by Superdegree are described in Annex II.
Superdegree may modify its technical and organisational measures from time to time, provided that such modifications do not materially reduce the overall security of the Services.
Customer acknowledges that certain features of the Services use artificial intelligence or machine-learning technologies and may require Customer Personal Data to be processed by AI Sub-processors identified in Annex III.
Superdegree will not use Customer Personal Data to train or fine-tune general-purpose artificial intelligence or machine-learning models except with Customer’s express authorisation. Data collected through the Recorder is not used to train AI models.
Where Superdegree engages an AI Sub-processor, Customer Personal Data will be processed in accordance with the applicable contractual and data-processing terms governing that service.
Superdegree will use AI Sub-processors under business, API or other applicable service terms that, where available for the relevant service, restrict the use of Customer Personal Data for training general-purpose models without Customer authorisation.
Superdegree will not knowingly configure an AI Sub-processor to use Customer Personal Data for general-purpose model training where the applicable service provides a no-training configuration or contractual commitment.
Superdegree may process Customer Personal Data as reasonably necessary to evaluate, maintain, troubleshoot, secure and improve the reliability, safety and performance of the Services.
This may include evaluation of generated outputs, investigation of failed processing, analysis of prompts or workflows, performance testing and quality assurance, subject to this DPA.
Where Customer uses AI Agent or browser-automation functionality, Superdegree may process information generated or encountered during execution, including browser-session information, page content, screenshots, Page Capture Data, URLs, Customer instructions, approved execution plans and execution metadata.
Such information will be processed only to provide, operate, evaluate, secure, troubleshoot and improve the reliability, safety and performance of the Services in accordance with this DPA and Customer’s instructions.
Customer provides general authorisation for Superdegree to engage Sub-processors to process Customer Personal Data.
Superdegree’s current Sub-processors and other relevant service providers are identified in Annex III.
Where a third party acts as a Sub-processor of Customer Personal Data, Superdegree will enter into appropriate contractual arrangements with that Sub-processor and, where required by Applicable Data Protection Law, impose data-protection obligations that provide an appropriate level of protection for Customer Personal Data.
Superdegree remains responsible for its Sub-processors to the extent required by Applicable Data Protection Law.
Superdegree may add or replace Sub-processors during the term of the Agreement.
Where required by Applicable Data Protection Law, Superdegree will provide reasonable advance notice of intended additions or replacements, including by updating Annex III on this page, by electronic notice or through another Sub-processor notification mechanism made available by Superdegree.
Customer may object to a new Sub-processor on reasonable data-protection grounds within the period specified in the applicable notice.
The parties will work in good faith to address a reasonable objection. If no commercially reasonable solution can be reached, either party may terminate the affected portion of the Services.
To the extent the CCPA applies to Customer Personal Data and Superdegree acts as a service provider or contractor:
Superdegree will process Customer Personal Data only for the limited and specified purposes described in the Agreement, this DPA and Customer’s documented instructions, including providing, operating, securing, supporting, maintaining and improving the Services.
Superdegree will not:
Superdegree will comply with applicable obligations imposed on service providers and contractors under the CCPA and will provide the same level of privacy protection required by applicable provisions of the CCPA.
Superdegree will notify Customer if it determines that it can no longer meet its applicable obligations under the CCPA.
Where required by the CCPA, Customer may take reasonable and appropriate steps to help ensure that Superdegree processes Customer Personal Data consistently with Customer’s obligations and may take reasonable and appropriate steps to stop and remediate unauthorised use.
Taking into account the nature of the processing, Superdegree will provide reasonable assistance to Customer in responding to requests from individuals exercising rights under Applicable Data Protection Law.
If Superdegree receives a request directly concerning Customer Personal Data, Superdegree will, where reasonably identifiable as relating to Customer, redirect the individual to Customer or notify Customer as appropriate.
Superdegree will not independently respond to such a request except on Customer’s documented instructions or where required by law.
Taking into account the nature of the processing and information available to Superdegree, Superdegree will provide reasonable assistance to Customer with applicable obligations relating to:
to the extent required by Applicable Data Protection Law and relevant to Superdegree’s processing of Customer Personal Data.
Superdegree will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
To the extent reasonably available, the notification will include information concerning:
Where all information is not available at the same time, Superdegree may provide information in phases without undue further delay.
Notification of a Personal Data Breach does not constitute an admission of fault or liability.
Superdegree will make available to Customer information reasonably necessary to demonstrate compliance with applicable processor obligations under Applicable Data Protection Law.
Customer will first use documentation and information reasonably made available by Superdegree to assess compliance.
Superdegree may satisfy information or audit requests by providing relevant security documentation, audit reports, certifications or equivalent compliance information where reasonably sufficient.
Where such information is insufficient and an audit is required under Applicable Data Protection Law, Customer may conduct an audit or inspection subject to reasonable confidentiality, security and operational requirements.
Unless required by a regulator, following a Personal Data Breach, or where Customer has reasonable grounds to suspect material non-compliance:
Superdegree will retain Customer Personal Data only for as long as reasonably necessary to provide the Services, comply with Customer’s instructions, satisfy the retention practices described in this Section 13, or comply with applicable legal obligations.
Where this Section expressly specifies a maximum retention period, that period is intended as a maximum rather than a guaranteed availability period.
Deletion may be performed through automated processes operating on recurring schedules, and data may therefore persist for a short additional period between expiry of a retention period and the next scheduled deletion process.
Where Customer deletes a recording, video, document, article or associated Customer Content through the Services, including associated Page Capture Data, that content may remain recoverable for up to 30 days.
Following that period, Superdegree will permanently delete the content from active systems, including associated media files under Superdegree’s control, unless retention is required by law or Customer has requested earlier permanent deletion where technically and legally practicable.
Where an individual media file cannot be deleted at that time because of a transient storage or system fault, Superdegree will automatically retry deletion and take reasonable steps to complete permanent deletion.
Data held by the Recorder in local browser storage is cleared once the recording is uploaded or discarded. An interrupted recording may remain on the user’s device until it is cleared or the Recorder is uninstalled. Discarding a recording requests deletion of any unused uploaded recording and its Page Capture Data.
Customer may request deletion of its account or workspace by contacting Superdegree.
Following such a request, Customer Personal Data may remain recoverable for up to 30 days.
After that period, Superdegree will delete Customer Personal Data from active systems without undue delay, subject to applicable legal obligations and backup-retention processes described below.
Deletion may be performed by authorised personnel using administrative processes.
Superdegree may perform earlier permanent deletion where requested and technically and legally practicable.
Diagnostic evidence, execution traces and related technical information generated by failed or investigated AI Agent executions are ordinarily retained for no more than 90 days.
Such information may be retained for longer where reasonably necessary to investigate a security incident, respond to a support request, establish or defend legal claims, or comply with applicable law.
Customer conversations, prompts, instructions and Page Capture Data associated with AI Agent functionality are treated as Customer Content and are subject to the applicable Customer Content retention rules rather than this diagnostic-retention period.
Browser-session recordings held by the cloud-browser Sub-processor as part of its observability infrastructure may be retained by that Sub-processor for up to 30 days.
Superdegree may retain Product Analytics Data, operational logs, security records and administrative records for legitimate purposes including service operation, product improvement, troubleshooting, security, fraud prevention, incident investigation and dispute resolution. Page Capture Data is Customer Content and is not subject to this Section 13.5.
Product Analytics Data may be retained for as long as reasonably necessary for analytics, service improvement, Customer support, troubleshooting and related operational purposes.
Analytics records may be associated with account or user identifiers, including names and email addresses, where reasonably necessary for those purposes.
Superdegree will periodically assess whether identifiable Product Analytics Data remains necessary and may delete, anonymise or aggregate such information when identifiable information is no longer reasonably required.
Aggregated or deidentified information that no longer constitutes Personal Data may be retained for longer periods.
Security logs, administrative actions and related audit records may be retained for as long as reasonably necessary for security, incident investigation, fraud prevention, dispute resolution and legal or compliance purposes.
Superdegree will periodically assess whether continued identifiable retention remains reasonably necessary.
Superdegree maintains automated database backups for disaster recovery and business-continuity purposes.
Database backups are retained according to the configured rolling backup-retention period, currently up to 7 days.
Customer Personal Data deleted from active databases may remain in backups until the applicable backup expires through the ordinary backup lifecycle.
Backups are not used for ordinary production processing.
If a backup is restored, Superdegree will take reasonable steps to reapply relevant deletion actions where appropriate.
Object-based Customer media, including recordings and Page Capture Data, is not included in database backups and is subject to the applicable media-storage and deletion processes.
Superdegree may retain limited records where reasonably necessary to comply with legal, tax, accounting, fraud-prevention, contractual or dispute-resolution obligations.
Following termination or expiry of the Agreement, Superdegree will, at Customer’s choice and where required by Applicable Data Protection Law, delete or return Customer Personal Data and delete remaining copies unless applicable law requires or permits continued retention.
Where functionality for Customer export is available, Customer should export required Customer Content before deletion, subject to the functionality of the Services and reasonable technical limitations.
Deletion remains subject to the processes and retention periods described in this Section 13.
Customer acknowledges that Customer Personal Data may be processed in Australia, the United States and other countries in which Superdegree or its Sub-processors operate.
Where Applicable Data Protection Law requires a lawful transfer mechanism, the parties will use an applicable mechanism as described below.
Where Customer Personal Data subject to the GDPR is transferred to a country that has not been recognised by the European Commission as providing an adequate level of protection, the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 (“EU SCCs”) are incorporated into this DPA by reference to the extent required.
The appropriate module will apply according to the parties’ roles, including:
The docking clause will apply.
The Sub-processor provisions of this DPA will apply to the extent permitted by the EU SCCs.
Annexes I, II and III of this DPA provide the relevant description of processing, technical and organisational measures and Sub-processor information for purposes of the EU SCCs.
The parties will reasonably cooperate to complete or interpret any additional selections or information required for the EU SCCs.
If there is a conflict between the EU SCCs and this DPA, the EU SCCs will prevail to the extent of that conflict.
Where Customer Personal Data subject to the UK GDPR is transferred outside the United Kingdom in circumstances requiring a transfer mechanism, the parties will apply an appropriate lawful transfer mechanism, including the then-current UK International Data Transfer Addendum to the EU SCCs where applicable.
Where reasonably required by Applicable Data Protection Law, the parties will cooperate regarding transfer-impact assessments and reasonable supplementary safeguards relating to international transfers of Customer Personal Data.
Liability arising from this DPA is subject to the exclusions and limitations of liability contained in the Agreement, except to the extent such limitation is prohibited by Applicable Data Protection Law.
This DPA remains in effect for as long as Superdegree processes Customer Personal Data on behalf of Customer.
This DPA is governed by the governing-law provisions of the Agreement, except where Applicable Data Protection Law or an applicable transfer mechanism requires otherwise.
The parties will reasonably cooperate to amend this DPA where necessary to comply with changes in Applicable Data Protection Law.
Superdegree may update this page to reflect changes to the Services, its Sub-processors or applicable law, and will update the “Last updated” date when it does. An update will not materially reduce the protection given to Customer Personal Data under this DPA during the term of an Agreement except where required by law or agreed by Customer. A countersigned DPA continues to apply as signed, subject to Section 7.3.
Superdegree processes Customer Personal Data in connection with providing, operating, supporting, securing and improving the Services, including:
Processing may include collection, recording, capture, organisation, structuring, storage, retrieval, consultation, use, analysis, transmission, transformation, generation, rendering, replay, hosting, display, sharing, evaluation, debugging, support and deletion.
Processing continues for the duration of the Agreement and thereafter as necessary in accordance with Section 13, applicable legal obligations and Customer’s documented instructions.
Customer Personal Data may relate to:
Account and identity information. Names, email addresses, user identifiers, organisation identifiers, authentication information and related account information.
Customer Content. Videos, screen recordings, audio, images, documents, text, scripts, prompts, instructions, generated content and other information uploaded, recorded, generated, submitted or processed through the Services.
Page Capture Data. Page content and structure, text, images, styles, page titles, URLs, clicks, scrolling, text entered into forms and related timing information captured from pages a user records or the AI Agent visits, which may include Personal Data displayed in the recorded or nominated application.
Audio and voice information. Audio contained in Customer Content, including microphone audio enabled in the Recorder, speech recordings, voice recordings and samples, transcripts, generated speech, voice identifiers and information used to provide speech-to-text, voice generation, or custom or cloned voice functionality. Depending on the applicable law and processing performed, certain information derived from voice recordings or samples may constitute biometric or other sensitive information.
AI and Agent information. Prompts, instructions, approved execution plans, browser-session information, URLs, page content, screenshots, execution traces, generated outputs, diagnostic information and related metadata.
Usage and technical information. Product-usage events, IP addresses, browser and device information, application logs, diagnostic information, error and exception information, session interaction and replay information about use of the Superdegree web application, and other technical or interaction information. Analytics records may be associated with account or user identifiers, including names and email addresses, where reasonably necessary.
Sharing and integration information. Information associated with Customer-selected publishing, integrations, connected accounts or external services, including authentication or authorisation information where applicable.
Billing and administrative information. Subscription, billing, account-administration and transaction-related information. Superdegree does not intentionally receive or store full payment-card details where those details are collected directly by an independent payment provider.
The Services do not require Customer to submit special-category or sensitive Personal Data unless necessary for functionality selected by Customer.
Customer may nevertheless cause such information to be processed through Customer Content, recordings, Page Capture Data, browser automation, voice functionality or other use of the Services.
Customer is responsible for ensuring an appropriate lawful basis or other authority for such processing.
Voice recordings or information derived from voice recordings may constitute biometric or sensitive information under certain Applicable Data Protection Laws depending on the processing performed.
Superdegree maintains technical and organisational measures appropriate to the nature of the Services and the risks associated with processing Customer Personal Data.
Superdegree maintains procedures designed to identify, investigate, contain and remediate security incidents affecting the Services or Customer Personal Data.
Where a Personal Data Breach affects Customer Personal Data, Superdegree will follow the notification process described in Section 11.
The following third parties may process Customer Personal Data in connection with the Services.
Not every provider processes Customer Personal Data for every Customer. Processing depends on the functionality used, Customer configuration and applicable operational requirements.
Where a provider acts as a Sub-processor, Section 7 applies accordingly. Certain providers may act as independent controllers or in another capacity for particular processing activities under their own applicable terms.
Purpose: Application hosting, delivery and supporting infrastructure.
Data potentially processed: Customer requests, application data, technical metadata and other Customer Personal Data transmitted through hosted application functionality.
Purpose: Managed database, authentication, database backups and supporting application infrastructure.
Data potentially processed: Account information, Customer Content, application records, authentication information and related Customer Personal Data.
Purpose: Private object storage, media delivery and supporting network infrastructure, including Cloudflare R2.
Data potentially processed: Customer video, audio, images, recordings, Page Capture Data, generated media, related object metadata and technical information.
Purpose: Cloud infrastructure used for video rendering and temporary media processing.
Data potentially processed: Customer video, audio, images, Page Capture Data and associated media may be temporarily processed or stored within Superdegree-controlled AWS infrastructure as necessary to provide video-rendering and media-processing functionality.
Temporary media used for these processing workflows is subject to automated lifecycle-deletion controls.
Purpose: Workflow orchestration and background-job processing.
Data potentially processed: User or organisation identifiers, prompts, instructions, generated-content metadata, media references, workflow state and related processing information.
Purpose: Artificial intelligence and machine-learning processing used for applicable AI-assisted features.
Data potentially processed: Customer Content, including screenshots, frames and page content from recordings and AI Agent executions, prompts, instructions, generated outputs and other information necessary to provide applicable AI functionality.
Purpose: Customer-selected authentication using a Google account.
Data potentially processed: Account identifiers, email addresses, authentication information and related OAuth information.
Purpose: Customer-selected publishing of video content to a connected YouTube account or channel.
Data potentially processed: OAuth credentials or tokens, channel information, Customer-selected rendered videos, video metadata and information required to perform publishing operations.
This processing occurs only where Customer elects to connect and use the applicable YouTube integration.
Purpose: Business productivity, communication, video conferencing, documentation, file storage and collaboration.
Data potentially processed: Customer Personal Data included in business communications, documents, files, meeting recordings or transcripts, support materials, implementation records, or other records created, received or maintained in connection with providing and supporting the Services.
Purpose: Artificial intelligence and machine-learning processing used for applicable AI-assisted features.
Data potentially processed: Customer Content, prompts, instructions, generated outputs and related information required to provide applicable AI functionality.
Purpose: AI-assisted image, video, audio, avatar and media generation or processing.
Data potentially processed: Customer-provided or generated images, video, audio, prompts, instructions and related media information where applicable to the functionality used.
Purpose: Speech-to-text transcription, voice generation and custom or cloned voice processing.
Data potentially processed: Customer audio, voice recordings or samples, generated speech, transcripts and related voice information where applicable to the functionality used.
Voice information may be processed as described in Superdegree’s applicable privacy disclosures and the provider’s applicable terms.
Purpose: Cloud-browser infrastructure supporting AI Agent and browser-automation functionality, including browser sessions, persistent browser contexts and associated debugging or observability functionality.
Data potentially processed: Browser-session information, URLs, page content, screenshots, information entered into the live browser, authentication state, Customer instructions, execution information, session recordings and related diagnostic or observability data.
Browserbase may retain browser-session recordings for up to 30 days as part of its observability infrastructure.
Purpose: Product analytics, usage analysis, session replay, error and exception monitoring, Customer support, troubleshooting and service-improvement analytics for the Superdegree web application.
Data potentially processed: Account or user identifiers, including names and email addresses, product-usage events, browser or device information, session interaction and replay information (which may include Customer Content displayed in the web application), diagnostic information, error information and technical metadata.
PostHog is hosted in the United States. It does not receive data from the Recorder or from applications recorded or operated by the AI Agent.
Purpose: Transactional email delivery.
Data potentially processed: Names, email addresses, message contents and related delivery metadata.
Purpose: Business email hosting and communications.
Data potentially processed: Names, email addresses, message contents, attachments and other Customer Personal Data included in communications with Superdegree.
Purpose: Payment processing, subscription management, billing and related payment infrastructure.
Data potentially processed: Account identifiers, email addresses, subscription and transaction information, billing information and other payment-related information. Stripe may collect payment details and certain billing information directly from users.
Depending on the processing activity, Stripe may act as a processor, service provider or independent controller under its applicable contractual, data-processing and privacy terms.
Customer may elect to connect or use third-party integrations, publishing destinations or other external services through the Services.
Where such a third party processes Personal Data independently under its own terms or directly at Customer’s instruction, that third party may act as an independent controller or processor rather than as Superdegree’s Sub-processor.
Independent payment services and similar providers may likewise process certain information under their own applicable terms.
The Recorder is distributed through the Chrome Web Store. Google processes information about its installation and updates under its own terms, not as Superdegree’s Sub-processor.
Superdegree’s public marketing website uses Microsoft Clarity for session analytics. Clarity is not used in the Superdegree web application, the Recorder or AI Agent executions, and does not process Customer Content.
Questions about this DPA, requests for a countersigned copy and Sub-processor objections can be sent to [email protected]. Our Privacy Policy and Security page describe our practices in more detail.
