Data Processing Agreement

The customer is the controller of personal data contained in the data it connects or sends to RankDebug, and we process it as processor. We are controller only for our own account, billing and website data, as described in our privacy policy.

• Subject matter: providing search traffic analysis, crawling, alerts, the agent and reports.
• Duration: the term of the contract, plus the deletion period below.
• Data subjects: users of the customer’s workspace, and visitors to the customer’s websites where their data appears in server logs or analytics the customer provides.
• Personal data: names and email addresses of workspace users; IP addresses and user agents contained in uploaded server logs; any personal data contained in files, comments or questions the customer submits.
• Search Console, Analytics and CDN data is pulled in aggregated form and does not, in our normal operation, identify individual visitors.

We process personal data only on the customer’s documented instructions, which are the contract, this DPA and the customer’s use of the service, unless the law requires otherwise, in which case we inform the customer first where permitted.

Everyone authorised to process the data is bound by confidentiality. We maintain appropriate technical and organisational measures, including industry-standard encryption in transit and at rest, encrypted storage of credentials, read-only access to connected services, per-workspace separation of data and access controls limiting staff access to what is needed to support the customer.

The customer authorises us to use subprocessors in these categories: cloud infrastructure, email delivery, payment processing, AI processing, product analytics and error monitoring. Each is bound by terms at least as protective as this DPA. We provide the current list of named subprocessors on request and give notice of new ones so the customer can object.

Questions put to the agent, with the workspace data needed to answer them, are sent to an AI processing subprocessor solely to produce the answer. Customer data is not used to train models.

We assist the customer, by appropriate measures, in responding to requests from data subjects exercising their rights, and forward to the customer any such request we receive directly.

We notify the customer without undue delay after becoming aware of a personal data breach affecting its data, with the information the customer needs to meet its own obligations.

Where personal data is transferred outside the EU, EEA, UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses apply, and are incorporated by reference into this DPA.

At the end of the contract, the customer may export its data. On the customer’s request we delete its personal data, except where the law requires us to keep it.

We make available the information reasonably needed to demonstrate compliance with this DPA, and allow for reasonable audits on prior written notice, no more than once a year unless a breach requires it.

To request a countersigned copy of this DPA, use our contact form. The processor is:

Porter Bridge, LLC
131 Continental Dr, Suite 305
Newark, DE 19713
United States