Data Processing Addendum

When this applies

This addendum is part of our Terms of Service. It applies when you use TheSerpAgent to handle personal data for which you are the controller or a processor, and data protection law requires a contract. That includes the EU and UK GDPR, the Swiss data protection act and the UAE data protection law. You accept it by accepting the Terms, and no signature is needed. Write to support@theserpagent.ai for a countersigned copy.

Who does what

"We" means PrismateQ L.L.C-FZ. "You" means the account holder. For the personal data in Annex 1, you are the controller and we are your processor. If you act for a client, such as an agency does, you are the processor and we are your sub-processor. For your own account, billing and usage data, we are the controller and the Privacy Policy applies.

Your instructions

We handle this data only on your instructions. Those are the Terms, this addendum, and what you or your connected AI assistant do in the service. If the law makes us do otherwise, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you.

Your part

You are responsible for having a lawful basis for the data you add, and for telling report recipients what they need to know. Your AI assistant's provider, Slack and your webhook are your own choices and not our sub-processors.

Confidentiality

We keep this data confidential and use it only to run the service for you.

Security

We keep the measures in Annex 2 in place. We may change them, but not so that they protect your data less.

Sub-processors

You allow us to use the sub-processors listed at theserpagent.ai/subprocessors. We email the account owner at least 30 days before adding one that handles this data. You can object in that time on reasonable data protection grounds. If we cannot solve it, you can end the affected service and we refund unused prepaid time. We stay responsible for each sub-processor's work.

Helping you

If someone asks us directly about data you control, we pass it to you and do not answer it ourselves. You can correct and delete data in the app. We help within reason with data protection assessments and regulators' questions.

Breaches

If we become aware of a breach affecting this data, we email the account owner without undue delay and within 72 hours. We say what we know, and we add to it as we learn more.

Deleting

When you delete data or your account, we delete this data within 30 days. Export what you need first. We keep what the law requires. Raw search results and search terms in shared tables stay for the periods in the Privacy Policy, with no connection to you. DataForSEO's search tasks stay for 365 days under its own policy.

Audits

We hold no security certifications. We answer your written questions and give you the information needed to show we meet this addendum. If that is not enough, or a regulator requires it, you can audit us once a year, on 30 days' notice, in working hours, under confidentiality and at your cost.

International transfers

We are in the UAE, which has no EU or UK adequacy decision. Where you send us personal data from the EEA, the standard contractual clauses in EU Decision 2021/914 apply and form part of this addendum. Module Two applies if you are a controller, and Module Three if you are a processor.

For those clauses: Clause 7 applies. Under Clause 9(a), Option 2 applies, with 30 days' notice. The optional wording in Clause 11 does not apply. Under Clause 17, Option 1 applies, with Irish law. Under Clause 18, the courts of Ireland apply. Under Clause 13, the authority is the one competent for you. Annexes 1, 2 and 3 below complete the clauses' annexes. Accepting the Terms counts as signing them.

For data from the UK, the UK Information Commissioner's International Data Transfer Addendum, version B1.0, also applies, with the same details and with neither party able to end it under its Section 19. For data from Switzerland, references to the GDPR read as the Swiss data protection act, and the Swiss regulator is the authority.

California

If the California Consumer Privacy Act applies to you, we are your service provider. We do not sell or share this data, and we do not use it outside our direct relationship with you or for any purpose other than running the service. We do not combine it with other data except as that law allows. We tell you if we can no longer meet that law, and you can then stop unauthorised use.

Liability and order

The limits in the Terms apply to this addendum, except where the standard contractual clauses or the law say otherwise. On personal data, this addendum comes before the Terms, and the standard contractual clauses come before both. Apart from those clauses, the law and courts in the Terms apply.

Annex 1: the processing

Exporter: you, at the details on your account, as controller or processor. Importer: PrismateQ L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, UAE, support@theserpagent.ai, as processor or sub-processor.

People concerned: your staff and contacts, your clients' staff who receive reports, and people named in keywords or search results you track.

Data: report recipients' email addresses, reply-to addresses, company names and logos on reports, project domains, keywords, competitors, Slack and webhook addresses, and ranking data tied to them. We do not expect special categories of data, and the Terms tell you not to add them.

Frequency and nature: continuous, for as long as you use the service. We store this data, read it to show you results, and send reports and alerts where you direct them.

Retention: the periods in the Privacy Policy. Sub-processors: Annex 3.

Annex 2: security measures

In transit: HTTPS on every address, with HSTS. Signed callbacks from Stripe and Mailgun, and a secret address for DataForSEO's callback.

Credentials: passwords hashed, API keys stored as hashes and shown once. API keys last until you revoke them. Dashboard sign-ins expire after 30 days. Connected-app access lasts 1 hour and refresh tokens 30 days, rotating on use. Report links for assistants expire after 1 hour.

At rest: Slack and webhook addresses and signing secrets encrypted in the database. Card details are never stored by us.

Separation: each request for a project is checked against the requesting user's account.

Staff access: admin rights are limited to named accounts. Admin changes and each time staff act as a customer are logged, and that access ends within 60 minutes.

Abuse limits: rate limits on sign-in, on AI calls and on report downloads. Outbound webhooks reach only public HTTPS addresses, with no redirects followed.

Server: hosted on a dedicated virtual server in the EU, administered over SSH.

Annex 3: sub-processors

The list at theserpagent.ai/subprocessors.