1. Parties and roles
This addendum applies to the telemetry data (logs, traces and metrics) a customer sends to Logthread. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), the customer is the data fiduciary and Logthread is the data processor. For account data about the customer's own users, Logthread decides the purposes and is described in the Privacy Notice.
2. Subject matter
- What: the log records the customer sends, and the queries and alert rules the customer runs on them.
- Purpose: receive, store, search, tail, alert on, and delete the telemetry for the customer. Nothing else.
- Duration: for the retention period of the workspace, plus the deletion steps below.
- Types of data: whatever the customer puts in its logs, traces and metrics. The customer decides what to send and should not send data it has no basis to process.
3. Processing on instructions
Logthread processes telemetry data only on the customer's documented instructions, which are its use of the service, its workspace settings (such as retention) and its requests to delete data. Logthread does not use log content for advertising or for any purpose of its own.
4. Confidentiality and security
Staff and systems access telemetry data only as needed to run the service. The technical measures are listed in the Privacy Notice: role-based access, hashed credentials and keys, write-only ingest keys, encryption of provider credentials with AES-256-GCM, HTTPS in transit, rate limiting and an audit log.
5. Location and subprocessors
Telemetry data is stored in the Mumbai region, India. Logthread uses the providers on the Subprocessors page. Logthread will list a new subprocessor there and notify workspace owners by email before it begins processing telemetry data; the notice period is to be confirmed before publication.
6. Assistance and deletion
- Owners can shorten retention and can delete the workspace in Settings. After a 7-day grace period, keys are revoked, retention at the storage provider is set to its minimum of 7 days, and the storage sub-organization is deactivated.
- Logthread helps the customer respond to requests from data principals where the customer cannot do so through the product. Contact details are to be confirmed before publication.
- Usage and billing records, which contain no log content, are kept for 7 years as legal and billing records.
7. Personal data breach
If Logthread becomes aware of a personal data breach affecting customer telemetry data, it will tell the workspace owners without undue delay. The notification timeline is to be confirmed before publication.
8. Records
Workspace admins can see account and key changes in the audit log. Logthread will provide information reasonably needed to show compliance with this addendum.