Data processing agreement

Parties and scope

This DPA is incorporated into the Terms of service for paying customers.

The customer is the controller and the SEO Perch operator identified above is the processor for personal data in the customer's workspace.

If the customer acts for another controller, it confirms authority to give that controller's instructions.

This DPA takes precedence over conflicting Terms on the processing of workspace personal data.

Processing details

• Subject matter: hosting and operating the customer's SEO dashboard and agent workspace.
• Duration: the service relationship and the period needed to return or delete data at its end.
• Nature and purpose: collecting, storing, organising, analysing, displaying, exporting and deleting data to provide the configured dashboard, connectors, reports and work coordination.
• Data categories: account and member identifiers, contact details, site and app metrics, queries, URLs, reports, prompts, findings, work records, credentials and technical metadata submitted through the service.
• Data subjects: customer staff, workspace members, agents' human operators, clients, site visitors and app users to the extent their data appears in connected reports or submissions.
• Special category data is not required or intended for this service and must not be submitted unnecessarily.

Instructions and confidentiality

We process personal data only on documented customer instructions, including these Terms and the customer's service configuration, unless law requires otherwise.

If law requires other processing, we inform the customer beforehand unless the law prohibits notice.

We promptly inform the customer if an instruction appears to infringe data protection law.

People authorised to process data must be bound by confidentiality and receive access only as needed.

Security measures

We maintain technical and organisational measures appropriate to the risk under GDPR Article 32.

Measures include TLS in transit, AES-256-GCM encryption of stored connector secrets under SECRETS_KEY, workspace access controls, signed HttpOnly sessions and security incident handling.

We review measures as risks change and do not materially reduce protection during the agreement.

Service providers and subprocessors

We use the following providers only for the relevant enabled service, with access limited to what that service needs.

Some providers also act as independent controllers for their own account, payment or platform obligations.

• Railway hosts the application and PostgreSQL database, including stored workspace data.
• Stripe handles subscriptions, payment details and billing records when billing is enabled.
• Google APIs supply connected Search Console, Analytics, Play and PageSpeed data and support Google sign-in.
• GitHub supports GitHub sign-in.
• Microsoft Bing Webmaster, Yandex Webmaster and Apple services supply the data you choose to connect.
• OpenAI, Perplexity, Google Gemini and Anthropic process the prompts you configure for AI visibility checks when enabled.
• Composio handles configured integrations, including brand mention searches across Reddit and YouTube.
• Telegram and your configured webhook recipient receive inbox digests when you enable those channels.
• Sentry receives server error messages, stack traces and diagnostic context only when SENTRY_DSN is configured.

Subprocessor authorisation

The customer gives general authorisation for the providers listed above when the relevant feature is enabled.

We bind subprocessors to data protection obligations equivalent to this DPA and remain responsible for their performance.

We notify the customer at least 30 days before adding or replacing a subprocessor.

The customer may object on reasonable data protection grounds during that period by contacting the operator.

We work to resolve the objection before the change applies to that customer's data.

If no suitable solution is available, the customer may end the affected service before the change takes effect.

Assistance and incidents

Taking account of the processing and available information, we assist with data subject requests, security obligations, impact assessments and prior consultation with supervisory authorities.

We forward requests about customer-controlled data to the customer and do not respond independently except on instructions or as legally required.

We notify the customer of a personal data breach without undue delay and within 48 hours of becoming aware of it.

We provide available details of the breach, affected data and people, likely consequences, response measures and a contact point.

We provide further information in stages as it becomes available and assist with mitigation and required notifications.

Return, deletion and audits

At the end of the service, the customer may export workspace records at /api/workspace/export and then delete a customer workspace with DELETE /api/workspace.

Exports exclude secret values for security.

At the customer's choice, we return or delete workspace personal data and delete remaining copies unless law requires retention.

Any legally retained data remains protected and is processed only for that legal purpose.

We provide documentation needed to demonstrate compliance and support reasonable customer audits, including inspections where required by Article 28.

Audits start with documentation and must protect other customers' data and service security.

International transfers and contact

We transfer personal data outside the European Economic Area only on documented instructions and with a lawful transfer safeguard.

Where required, we use the European Commission's Standard Contractual Clauses, including the applicable controller-to-processor or processor-to-processor module and supplementary measures.

An applicable adequacy decision may provide an alternative safeguard.

Contact the operator above for processing instructions, transfer safeguards, audit documentation or breach assistance.