Data processing agreement

You are the controller of personal data you put into the service about your clients and their customers. We are your processor for that data.

For your own account and billing data, we are a separate controller, as our privacy notice explains.

• Subject: providing the service under our terms.
• Duration: for as long as you use the service, and until deletion under section 7.
• Nature and purpose: storing client business details, tracking questions in AI engines, analysing answers and producing reports.
• Types of data: names and contact details of client staff, business details, and any personal data that appears in AI answers (for example, a sole trader's name).
• Data subjects: your clients' staff and contacts, and people named in AI answers.

In line with Article 28, we will:

• process the data only on your documented instructions, which are these terms and how you use the service, unless the law requires otherwise;
• make sure anyone who processes the data is bound by confidentiality;
• keep appropriate security measures in place (see section 5);
• only use sub-processors under section 4;
• help you respond to requests from data subjects exercising their rights;
• help you meet your security, breach-notification and data protection impact assessment duties;
• delete or return the data when the service ends (see section 7);
• give you the information you reasonably need to show compliance, and allow reasonable audits (see section 8).

We'll tell you if we think an instruction breaks data protection law.

You give us general permission to use the sub-processors below. Each is bound by written terms that protect the data at least as well as this agreement.

Consumer ChatGPT and Google AI answers are collected through DataForSEO, so we don't send your questions to OpenAI or Google for them, and we never send them your personal data. Integrations you connect yourself (such as your identity provider for SSO) receive data on your instructions; they are your providers, not our sub-processors.

We'll give you at least 30 days' notice of any new sub-processor by email. You can object on reasonable data protection grounds. If we can't resolve it, you can cancel and we'll refund prepaid fees for the unused period.

Transfers outside the UK use the safeguards described in our privacy notice.

• Encryption in transit (TLS) and at rest.
• Each customer's data is kept separate, with access checked on every request.
• Staff access limited to what's needed.
• No IP addresses stored (abuse checks use a salted one-way hash, deleted within 48 hours). Bot protection and rate limiting on public forms.
• Secrets and API keys kept out of code.
• Backups and logs kept for limited periods only.

If we become aware of a personal data breach affecting your data, we'll tell you without undue delay. We'll give you the information you need to assess it and to notify the ICO and data subjects if required.

Before your account closes, you can ask us for a copy of your data. We then delete your personal data within 30 days, unless the law requires us to keep it.

Copies in backups are overwritten in the normal backup cycle and are not restored in the meantime.

We'll answer reasonable written questions about our data protection practices. If that isn't enough, you may audit our compliance once a year, with 30 days' notice, at your own cost, and under confidentiality.

The liability limits in our terms of service apply to this agreement. It's governed by the law of England and Wales.