Data processing agreement
This agreement applies when AImasterz LLC ("processor") processes personal data on behalf of a customer ("controller") under the terms of service. The customer accepts it by clicking accept when signing up.
- Subject and duration. Producing the customer's weekly SEO report and measuring their changes, for as long as they are a customer plus the deletion period.
- Data and people. Search Console performance data (including search queries, which may contain personal data typed by searchers), index status of the customer's pages, public page content, the customer's contact details.
- Instructions. We process the data only to provide the service and on the customer's written instructions.
- Confidentiality and security. Access is limited to people who need it and bound by confidentiality. Measures include encryption at rest in our database, a dedicated read-only service account for Search Console, keys held in a secrets manager and per-customer separation of reports.
- Subprocessors. The customer authorises the providers below. We will tell the customer 30 days before adding or replacing one, and the customer may object and cancel.
| Provider | What it does | Data it sees | Location |
|---|---|---|---|
| Supabase | Database | All stored customer data | United States |
| Resend | Sends the weekly report email | Report content, recipient email | United States |
| Stripe | Payments | Billing details; never Search Console data | United States |
| OpenRouter, and the model it routes to (currently DeepSeek) | Writes draft titles and page sections | Page text and aggregated search terms for the pages being drafted | United States (routing); the model operator is outside the United States |
| TypeSafe | Checks drafts against the page | Page text and aggregated search terms | United States |
| Source of Search Console data | n/a (we read from it) | n/a |
- Help with requests. We help the customer answer requests from the people whose data it is, and tell the customer without delay of any breach affecting their data.
- Return and deletion. On cancellation or request we delete the customer's data within 30 days, except what the law requires us to keep.
- Audits. The customer may ask for the information needed to show we follow this agreement.