Data processing agreement
The terms under which Stagely processes personal data for its customers, built on the Common Paper Data Processing Agreement, with the EU and UK clauses.
Effective date: 12 October 2026
This page is the Cover Page of the data processing agreement (the “DPA”) between Provider and Customer. It incorporates the Common Paper Data Processing Agreement Standard Terms Version 1.1 (the “DPA Standard Terms”). The DPA Standard Terms are © Common Paper, Inc., and are used under CC BY 4.0. Where this Cover Page differs from the DPA Standard Terms, this Cover Page controls.
Customer accepts this DPA when it accepts the Terms of service. The DPA applies to the personal data that Customer gives to Stagely.
Parties and agreement
| Variable | Value |
|---|---|
| Provider | Yaroslav Kravtsov, Latvia. Data importer, as Processor or Subprocessor. |
| Customer | The business that accepts the Terms of service. Data exporter, as Controller or Processor. |
| Agreement | The Terms of service |
| Provider Security Contact | support@stagely.dev |
| Governing Member State | Latvia |
Annex I: details of the processing
| Variable | Value |
|---|---|
| Categories of Data Subjects | Customer’s members and the people whom they invite, and any person whose personal data Customer puts into Stagely |
| Categories of Personal Data | GitHub user ID, login, name, public email address and avatar URL; email addresses of invited people; any personal data in project names, config values, deploy logs, .stagely.yml, Compose files and the files they reference |
| Special Category Data | None. Customer must not put special category data into Stagely. |
| Frequency of Transfer | Continuous, while Customer uses Stagely |
| Nature and Purpose of Processing | Hosting and processing to provide the Service: sign-in and access control, planning and recording deploys, showing deploy logs, opening stagelets, and billing |
| Duration of Processing | The term of the Agreement, and then the retrieval and erasure periods in the Terms of service. Deploy logs are deleted 90 days after the deploy ends. Database backups expire within 7 days. |
| Competent Supervisory Authority | The supervisory authority that Clause 13 of the EEA SCCs names |
Annex II: technical and organizational measures
- All traffic to the console, the API, the MCP endpoint and the agent and gateway sessions uses TLS.
- The database accepts connections only from the control plane.
- Stagely stores tokens, sessions and invitation links only as hashes.
- Stagely checks each console request against the member’s current membership and role.
- Access tokens of coding agents last 15 minutes, and each grant lasts at most one hour.
- When a member is removed or a grant is revoked, access to stagelets ends within about 50 seconds.
- Cloud credentials and secret values stay in Customer’s own cloud account. Stagely stores only the name and key of each secret.
- The database has daily backups, kept for 7 days.
The security model describes these measures in more detail.
Annex III: subprocessors
The Approved Subprocessors are on the subprocessor list.
Changes to the DPA Standard Terms
- Security reports. Section 7.2 (Security Reports) does not apply. Provider has no audit report from an independent auditor. Customer can still send due diligence requests under Section 7.3.
- Notice of subprocessor changes. Provider gives the notice of Section 3.1 by email to the billing email address of Customer, and on the subprocessor list.