Data processing agreement

1. Status of this document

This is a draft of the terms we would expect to sign with a customer who processes personal data through AnswerRank. It becomes binding only when a completed version is executed by both parties. The contracting entity, notice addresses and effective date are [to be completed on legal review].

We publish it early for one reason: a vendor who will not show you their processor terms until late in a deal is asking you to buy first and read second.

2. Roles of the parties

For personal data that a customer processes inside their workspace, the customer is the controller and AnswerRank is the processor acting on their instructions. For our own account administration, billing, website analytics and security telemetry, AnswerRank acts as controller — that processing is described in the privacy notice.

3. Subject matter and duration

Subject matter: provision of AI answer visibility measurement, analysis and reporting. Duration: for as long as the customer holds an active subscription, plus the retention periods set out in Annex 1. Nature and purpose of processing: storage, analysis, aggregation and presentation of measurement data, together with the account and workspace administration needed to deliver it.

4. Processing on instructions

We would process personal data only on the customer’s documented instructions, which include the instructions inherent in using the product: executing the prompts configured in the workspace against the engines enabled for it, crawling the domains the customer asks us to audit, and producing the resulting reports.

Executing a check necessarily transmits the prompt to the third-party answer engine being measured. Customers should not place personal data into tracked prompts.

5. Confidentiality

Personnel with access to customer data would be bound by confidentiality obligations, and access would be limited to what a role actually requires. Administrative access to the platform is controlled by a server-evaluated allowlist rather than a client-supplied claim.

6. Security measures

The measures we have actually implemented are listed in Annex 2 below, alongside the ones we have not. We hold no third-party security certification and have not completed a penetration test; any statement to the contrary would be false. The detail behind each implemented control is on the security page.

7. Sub-processors

The customer would give general authorisation for the sub-processors below, with advance notice of additions and a right to object on reasonable data protection grounds. The notice period and objection process are [to be agreed — commonly 30 days].

Which of these are active depends on the deployment, and processing locations for each are [to be documented on legal review].

8. Data subject requests

Where a data subject contacts us directly about data held in a customer workspace, we would refer them to the customer rather than act ourselves, and would assist the customer in responding using the export and deletion capabilities in the product.

9. Breach notification

We would notify affected customers without undue delay after becoming aware of a personal data breach, with the information available at the time and updates as an investigation proceeds. A specific notification window is [to be agreed — we will not publish a number we have not staffed].

10. Return and deletion

On termination, the customer may export their data for an agreed period, after which we would delete it, save for copies we are required to retain by law or that exist transiently in backups until those backups rotate. Export window and backup rotation period are [to be confirmed].

11. Audits and information

We would make available the information reasonably necessary to demonstrate compliance with these obligations. Since we hold no audit report to hand over, that currently means written answers, the published security page, and the schema-level controls described there — not a certification we do not have. On-site audit rights are [to be agreed].

12. International transfers

Sub-processors and answer engines operate across regions, so international transfers are expected. The transfer mechanism — standard contractual clauses, a UK addendum, or another lawful basis — is [to be selected and executed on legal review]. No transfer mechanism is in place by virtue of this page.

Annex 1 — Processing details

Categories of data subjects

The customer’s own users and team members. Incidentally, individuals named in public web pages or public AI answers that fall within the measured sample.

Categories of personal data

Identification and contact data for workspace users; authentication and role records; usage and billing records; hashed identifiers used for abuse control; and any personal data appearing incidentally in crawled public pages or engine answers.

Special category data

None is requested and none should be submitted. AnswerRank is not designed to process special category or health data.

Frequency and retention

Continuous for the duration of the subscription. Anonymous audit results expire after 30 days by default; workspace data is retained while the account is active; remaining statutory retention periods are [to be confirmed].

Annex 2 — Technical and organisational measures

Stated honestly, including the gaps. A reviewer should be able to check every implemented row against the product.