Data Processing Agreement

1. Scope, parties and roles

This Data Processing Agreement ("DPA") forms part of the Terms of Service between GrubGuru, British Columbia, Canada (the "Processor"), and the customer that holds the SEOAgent workspace (the "Controller"). It applies when the Controller's use of SEOAgent involves personal data protected by the GDPR, the UK GDPR or PIPEDA - for example, personal data inside a connected analytics account or in content the Controller supplies. Accepting the Terms accepts this DPA; no separate signature is needed. A countersigned copy is available on request from [email protected].

2. Processing instructions

The Processor processes personal data only to provide the Service as described in the Terms, on the Controller's documented instructions - the Controller's use of the Service and its settings are those instructions - and as the law requires. The Processor tells the Controller if it believes an instruction breaks the law. People authorized to process the data are bound by confidentiality.

3. Sub-processors

The Controller authorizes the following sub-processors:

• Hetzner - Hosting, database and backups (Finland)
• Stripe - Payments and invoicing (USA / EU)
• Google - OAuth sign-in, Search Console, GA4 and Indexing API data you connect (USA / EU)
• DataForSEO - Keyword, SERP, backlink, rank and AI-answer data (USA)
• OpenRouter (routing to Anthropic and Google models) - Article drafting, scoring, rewriting, images (USA)
• Firecrawl / Jina - Reading your own site's pages to build its topic model (USA)
• DeepSeek - Answering in-app support chat messages, with the account details the answer needs (plan, credits, sites, article status) (China)
• Ahrefs - Domain Rating lookups (domain names only) (Singapore)
• Resend - Transactional email (USA)
• Sentry - Error monitoring (USA / EU)

The Processor binds each sub-processor to data protection terms no less protective than this DPA and stays responsible for it. A new sub-processor is listed on this page at least 14 days before it starts processing; the Controller may object by email, and if the objection cannot be resolved, may close the account.

4. International transfers

Personal data is hosted in Finland. Where a sub-processor processes it in a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant) or another safeguard the law recognizes.

5. Security

Connections are encrypted in transit. Credentials the Controller stores (CMS passwords, Google service-account keys) are encrypted at rest with AES-256-GCM. Access to production systems is limited to the people who run the Service, and security-relevant actions are recorded in an audit trail.

6. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting the Controller's data, with the information the Controller needs to meet its own obligations.

7. Assistance and audits

The Processor helps the Controller answer data-subject requests - Settings gives the Controller export, correction and deletion directly - and with data protection impact assessments where the Processor's information is needed. The Processor makes available the information needed to show compliance with this DPA; audit requests go to [email protected], with reasonable notice, at most once a year unless a breach or a regulator requires otherwise.

8. Deletion and return

The Controller can export its data at any time from Settings → Account. On account deletion, the workspaces only the Controller is in - and shared ones it owns, if it chooses - are deleted immediately with their sites, articles and connected credentials; a single site can be deleted on its own at any time (see the Privacy Policy). Nightly database backups are kept for 14 days, so deleted data leaves every backup within 14 days.

9. Contact

GrubGuru
British Columbia, Canada
[email protected]