Data processing agreement

Parties and roles

The customer, as workspace holder, acts as controller. ASKAIDE ASBL acts as processor for data processed within that workspace.

This agreement supplements the terms of service and prevails over them in everything concerning the processing of personal data on the customer's behalf.

Subject matter, duration and nature of processing

• Subject matter: providing search visibility analyses of the sites the customer declares.
• Duration: the term of the subscription, plus the retention periods set out in the privacy policy.
• Nature: collection of public pages, technical analysis, production of findings, presentation and export.
• Categories of data subjects: people whose data appears in the public content of analysed pages, and users of the workspace.
• Categories of data: public content of crawled pages, metrics returned by connectors the customer links, and workspace member identities.

Processor commitments

• Process data only on the customer's documented instructions, save where required by law.
• Ensure the confidentiality of persons authorised to process the data.
• Implement the technical and organisational measures described in the privacy policy.
• Assist the customer with security obligations, breach notification and impact assessments.
• Notify the customer of any data breach without undue delay after becoming aware of it.
• Make available the information needed to demonstrate compliance with article 28 and allow audits.
• On termination, delete or return the data at the customer's choice, save where retention is legally required.

Sub-processors

The customer authorises the categories of sub-processors listed below. Any addition is notified before it takes effect, and the customer may object on legitimate grounds.

Cloud hosting and database

Running the application, primary database, analysis job queue and technical logs — European Union (Belgium).

Payments and invoicing (Stripe)

Subscription payments, invoicing and EU VAT handling — Ireland (EU).

Sign-in providers (Google, GitHub)

Signing in with Google or GitHub, only if you choose to, and Google connectors (Search Console, Analytics 4) only if you link them — European Union.

Transactional email

Sending verification and invitation emails, scheduled reports, and “Talk to a human” form requests to NeoRank mailboxes — European Union.

Domain name and mailboxes

The neorank.ai domain name and receipt of email sent to us — European Union.

Audience measurement (optional, consent-based)

Google Analytics on public pages, only after you agree — Ireland (EU); may involve international processing under Google's applicable terms. Analytics account settings and Google's applicable processing terms require verification before activation.

AI providers

AI-visibility measurement (your tracked prompts are submitted to the observed AI engines), answers from the NeoRank AI help assistant, including on the Support and Contact pages (Google Gemini), and from the optional home page assistant (Google Gemini) and from NeoRank Research and its chat (OpenAI, Anthropic, Perplexity, Google, DeepSeek and, once activated, xAI and Meta), and from Neo AI, the dashboard assistant, from the measured data of the site concerned (configured provider, Anthropic by default), and optional correction, at your request, of the text of a customer review (Google Gemini) — May involve processing outside the European Union, depending on the provider. Processing is governed by each provider's applicable terms, set out in the complete named list.

SERP data for AI Overviews (DataForSEO OÜ)

Automatic tracking of Google AI Overviews, when enabled: keywords tracked by the customer and their market (country, language, device), no personal data — Estonia (EU); the provider also lists an office in Ukraine, outside the European Union. No personal data is sent; processing is governed by DataForSEO's terms.

Anti-bot protection (Cloudflare Turnstile)

Anti-bot verification of the public Express check and its email-report form: IP address and the browser and device technical signals needed for the check — May involve processing outside the European Union. Processing is governed by Cloudflare's applicable terms.

The complete named list of sub-processors is available to customers on request at privacy@neorank.ai, and any change is notified before it takes effect.

Transfers outside the European Union

The application, its database and its processing workloads are hosted in the European Union (Belgium). The other sub-processors process within the European Union, unless the table above states otherwise (optional audience measurement, AI providers, the SERP data provider for AI Overviews and Cloudflare Turnstile anti-bot protection, which may involve international processing).

Contact

To request signature, ask a question or exercise a right under this agreement: privacy@neorank.ai.