Data Processing Agreement

Summary: When you put personal data into AgenticSEO, you are the controller and we are your processor. We use that data only on your instructions, keep it confidential and secure, use only the subprocessors we list, tell you about a breach within 72 hours, help you with requests, and delete the data when you leave. Standard Contractual Clauses cover transfers out of the EU and UK. This summary helps you read the agreement; the full text below is what applies.

This Data Processing Agreement ("DPA") is part of the Terms of Service between you ("Customer") and Andolasoft Inc. ("Processor", "we"), 2059 Camden Ave, #118, San Jose, CA 95124, USA. It applies when we process Customer Personal Data while providing AgenticSEO (the "Service"). If this DPA and the Terms conflict on data protection, this DPA wins.

1. Definitions

• Data Protection Laws: all laws on personal data that apply to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
• Customer Personal Data: personal data that Customer, its users or its connected services put into the Service, and that we process for Customer.
• Controller, processor, data subject, personal data breach, processing and supervisory authority have the meanings given in the GDPR. "Controller" includes a "data fiduciary" and "processor" includes a "data processor" under the DPDP Act. "Processor" includes a "service provider" under the CCPA.
• Subprocessor: a third party we engage to process Customer Personal Data.
• SCCs: the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, and the UK International Data Transfer Addendum where relevant.

2. Roles

• Customer is the controller of Customer Personal Data. We are the processor.
• For our own account, billing, security and legal records, we are an independent controller. Our Privacy Policy covers that data.
• Services Customer connects with its own accounts (for example Google Search Console, Google Analytics, PostHog, DataForSEO, X and CMS targets) are not our subprocessors. AI providers used to run the AI in Customer's plan are our subprocessors. Customer chooses them, holds its own agreements with them, and tells us to send data to them. Customer is responsible for that relationship.

3. Details of the processing

4. Our duties

We will:

1. Process Customer Personal Data only on Customer's documented instructions. The Terms, this DPA and Customer's settings and use of the Service are those instructions. We will tell Customer if we think an instruction breaks Data Protection Laws.
2. Make sure everyone we allow to process the data is bound by confidentiality.
3. Keep the technical and organisational measures in Annex 1 in place.
4. Not sell or share Customer Personal Data, and not keep, use or disclose it for any purpose other than providing the Service, or outside our direct business relationship with Customer, except as the CCPA allows. We will not combine it with other data except as the CCPA allows. We certify that we understand these limits.
5. Not use Customer Personal Data to train AI models.
6. Help Customer, as far as is reasonable, with data subject requests, security, breach notices, data protection impact assessments and consultations with authorities, taking into account the nature of the processing.

5. Customer's duties

Customer confirms that it has a lawful basis and has given all notices needed for the processing, that its instructions follow Data Protection Laws, and that it is responsible for the services it connects with its own accounts.

6. Subprocessors

• Customer gives general authorisation for us to use subprocessors. The current list is on our Subprocessors page.
• We will update that page and notify Customer by email or in the app at least 30 days before a new subprocessor starts to process Customer Personal Data, except in an emergency.
• Customer may object on reasonable data protection grounds within that period by emailing support@agenticseo.com. We will try to find a solution. If we cannot, Customer may end the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
• We put data protection terms in place with each subprocessor that are at least as protective as this DPA. We remain responsible for our subprocessors.

7. International transfers

Where Customer Personal Data is transferred from the EU or EEA to a country without an adequacy decision, the SCCs, Module 2 (controller to processor), apply and are included in this DPA by reference. For the SCCs:

• Clause 7 (docking clause) applies.
• Clause 9: option 2 (general authorisation) applies, with the notice period in section 6.
• Clause 11: the optional language does not apply.
• Clauses 17 and 18: the law and courts of Ireland apply.
• Annex I is filled in by section 3 of this DPA, Annex II by Annex 1 below, and Annex III by the Subprocessors page.

For transfers from the UK, the UK International Data Transfer Addendum applies, with the SCCs as above. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss law, and the Swiss Federal Data Protection and Information Commissioner as the competent authority. Transfers from India follow the DPDP Act and any rules made under it.

8. Personal data breaches

We will notify Customer without undue delay, and within 72 hours, after we become aware of a personal data breach affecting Customer Personal Data. The notice will include, as far as we know at the time, what happened, the data and data subjects involved, the likely effects, and what we are doing about it. We will send more details as we learn them. A notice is not an admission of fault.

9. Data subject requests

If a data subject contacts us about Customer Personal Data, we will pass the request to Customer and will not answer it ourselves unless Customer tells us to or the law requires it. Customer can view, export, correct and delete most data directly in the Service.

10. Audits

• We will make available the information reasonably needed to show that we comply with this DPA. This includes answers to reasonable security questionnaires, no more than once a year.
• If that information is not enough, or if an authority requires it, Customer may audit our compliance once a year, with at least 30 days' written notice, during business hours, at Customer's cost, with minimal disruption, and under confidentiality. The auditor must not be our competitor.
• Audits do not include access to other customers' data or to our subprocessors' premises.

11. Deletion and return

When the Terms end, Customer can export its content as described in the Terms for 30 days. After that, we delete Customer Personal Data from our live systems. Backups are overwritten on their normal cycle and are protected until then. We may keep data the law requires us to keep, and we will continue to protect it under this DPA.

12. Liability

Each party's liability under this DPA is subject to the limits in the Terms, unless Data Protection Laws do not allow that.

13. Contact

Data protection questions: support@agenticseo.com

Annex 1: Technical and organisational measures

• Encryption at rest of secrets: third-party API keys, service account keys and access tokens are encrypted with AES-256-GCM before they are stored.
• Passwords: stored only as bcrypt hashes.
• Tokens: session and password reset tokens are random and stored only as hashes. Session cookies are HttpOnly, Secure and SameSite=Lax.
• Encryption in transit: HTTPS (TLS) for all connections to the Service.
• Tenant isolation: every request that uses a site checks that the signed-in user owns that site.
• Access control: least privilege for staff and systems; production access only for people who need it.
• Bot and abuse protection: Google reCAPTCHA on sign-up, login, password reset and review pages.
• Hosting: the Service runs on [Hosting provider — set COMPANY_HOSTING], which provides physical and network security.
• Backups and recovery: regular backups of the database.
• Incident response: a process to find, contain, look into and report incidents, including the 72-hour notice in section 8.
• Vulnerability reports: a responsible disclosure process, described on our Security page.