Data Processing Agreement

Client data means the personal data, if any, contained in what you or your team put into, or ask us to collect for, a workspace: client brand names and domains, target markets, buyer questions, the answers collected from answer engines about them, evidence observations and notes, remediation tasks, imported files, and the client reports made from them.

For client data, you are the controller and we are your processor under the UK GDPR and the Data Protection Act 2018. Where you are yourself acting for your own client, we are your sub-processor and you are responsible for passing on to your client what this agreement says.

This agreement does not cover data we decide about ourselves — your account details, sign-in and billing records, support requests, site analytics and sales enquiries. For that data we are the controller, and our privacy notice applies.

The details of the processing (subject matter, duration, nature and purpose, types of personal data and categories of data subjects) are in Annex 1.

We process client data only on your documented instructions. Your instructions are: this agreement, the Terms of Service and purchase terms, the way you configure and use the service (for example creating an audit, scheduling collection, starting a Sprint run, verifying a record or issuing a share link), and any other written instruction you give us that we agree to.

That includes transfers outside the UK: we transfer client data to a third country only as described in clause 6 and Annex 3, or where UK law requires it, in which case we will tell you first unless the law forbids it.

If we think an instruction breaks the UK GDPR or other data protection law, we will tell you promptly and may decline to follow it until it is confirmed or changed.

Everyone we authorise to process client data is bound by a duty of confidentiality, contractual or statutory. Access is limited to the people who need it to run and support the service.

We implement the technical and organisational measures in Annex 2, which we consider appropriate to the risk of the processing as required by Article 32. We may change those measures, but not in a way that materially reduces the overall protection of client data. Annex 2 is a description of what is actually in place, not a list of aspirations: where we do not do something, it says so.

You give us general written authorisation to use the sub-processors listed in Annex 3. Our hosting provider, Cloudflare and OpenRouter are each bound by a written data processing agreement imposing obligations that are, in substance, no less protective than those in this agreement. The AI model providers in Annex 3 are reached only through OpenRouter and are covered by OpenRouter’s agreement, which lets us exclude providers; every request we send allows only providers that do not collect or train on inputs and only zero-data-retention endpoints. We remain responsible to you for the performance of every sub-processor.

Before a new sub-processor starts processing client data, we will update Annex 3 on this page and email the owner of each workspace at least 14 days in advance. You may object on reasonable data protection grounds within that period. If we cannot address the objection, you may end the agreement for the affected service; if that leaves Sprint work you have paid for undelivered, we will refund the fee for that work.

Some sub-processors in Annex 3 only receive data when a particular feature or gateway is switched on for the deployment; the “When” column says which.

Client data is stored in the United Kingdom (OVH Limited, London), so storing it involves no international transfer. Some sub-processors process data elsewhere, as shown in Annex 3. For each restricted transfer we rely on the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the recipient is certified, or on the UK Addendum to the EU Standard Contractual Clauses, which is a transfer tool under Article 46: for OpenRouter (which is not certified), the UK Addendum in its data processing agreement; for Cloudflare and Stripe, the UK-US data bridge with the UK Addendum as a fallback. We do not use the UK International Data Transfer Agreement (IDTA) with any sub-processor at present; the UK Addendum does the same job.

AI answer engines, and the China-origin comparison models. A Sprint asks the models behind ChatGPT, Claude, Gemini and Perplexity and five comparison models developed by companies based in China (DeepSeek, Qwen, Kimi, GLM and MiniMax), all through OpenRouter; the brand-extraction and report-drafting steps run on MiniMax, GLM or DeepSeek models. These are open models that many hosts serve. Every request we send to OpenRouter excludes China-hosted endpoints, and Qwen is limited to Alibaba’s US endpoint, so these requests are served outside China — mostly in the United States, and for some endpoints by companies based in Singapore. The transfer to OpenRouter relies on the UK Addendum in its data processing agreement, and we have carried out a transfer risk assessment, which is available on request. On top of that, personal data is excluded by design from everything sent to any AI model:

• What is sent is business information: the agreed buyer questions (written without the client brand), the target market, and, for the extraction and report steps, one stored engine answer or the computed findings, which include the client brand name and domain and the names of competing businesses.
• No request contains your name, your email, your team’s details, your client’s contact details or any login data. Before any text is sent, the service automatically removes anything that looks like an email address, a phone number or a UK postcode, whichever field or stored answer it came from.
• You agree not to enter personal data in the brand, domain, question or market fields (clause 11).

The residual risk, stated plainly. The automatic removal does not catch a person’s name. An answer engine can name a person in its answer — most often a company founder or spokesperson — and that answer is sent to a model for brand extraction. Such a name is information the engine itself produced about a business, not data you gave us, but it can still be personal data. You can leave the China-origin models out for a workspace in Settings. They are then not asked at all, and brand extraction and report drafting for that workspace run on US-developed models instead.

Taking into account the nature of the processing and the information available to us, we will help you:

• respond to requests from individuals exercising their rights. Most requests can be met directly from the workspace: records can be viewed, corrected by adding a new version, exported as CSV, and deleted by deleting the workspace or account. If a request about client data reaches us, we will pass it to you without undue delay and not answer it ourselves unless you ask us to;
• meet your obligations on security (Article 32), breach notification (Articles 33 and 34), data protection impact assessments and prior consultation (Articles 35 and 36).

Help that goes beyond what the service already provides, or beyond a reasonable amount of time, may be charged at a rate we agree with you first.

If we become aware of a personal data breach affecting client data, we will notify you without undue delay and in any event within 48 hours, by email to the workspace owner. The notice will describe, as far as we then know: what happened, the categories and approximate number of individuals and records concerned, the likely consequences, what we have done and propose to do, and who to contact. Where we do not yet have all of that, we will send what we have and follow up as we learn more.

We will take reasonable steps to contain the breach and reduce its effects, and will not notify the Information Commissioner or affected individuals about client data on your behalf unless you ask us to or the law requires it. Notifying you is not an admission of fault.

You control deletion while you use the service:

• You can export a Sprint’s evidence ledger at any time as a CSV file from the evidence page, and print or save the client report as a PDF.
• Deleting your account removes, immediately, every workspace where you are the last member together with its audits, evidence, collected answers, imports and remediation tasks. The account deletion page lists exactly what is removed and what is kept.

When the services end, you should export what you want to keep and then delete the account. If you ask us in writing, we will delete the client data ourselves within 30 days and confirm when it is done, unless UK law requires us to keep part of it. We do not keep separate long-term archives of client data; copies that exist only in operational backups or logs are not restored into the service and are overwritten in the ordinary course. Order and payment records are our own records, not client data, and are kept as the purchase terms say.

We will make available to you the information reasonably necessary to show that we meet Article 28 and this agreement, including this page, Annex 2 and Annex 3, and written answers to reasonable security questionnaires.

If that information is not enough to show compliance, or a regulator requires it, you (or an independent auditor you appoint who is bound by confidentiality and is not our competitor) may audit our processing of client data, on at least 30 days’ written notice, during business hours, no more than once in any twelve months unless a breach or a regulator requires otherwise, and in a way that does not compromise other customers’ data. Each side bears its own costs.

• You are responsible for having a lawful basis, and any notice or permission your own clients require, for putting client data into the service and for the processing you instruct.
• The service is built to work with business information. Do not enter special category data, criminal offence data or data about children, and keep personal data out of the brand, domain, question and market fields, which are sent to answer engines.
• Keep your team’s sign-in details secure and remove members who should no longer have access.

This agreement lasts for as long as we process client data for you. Each party’s liability under it is subject to the limitations in the Terms of Service, except where the law does not allow it to be limited. If this agreement and the terms conflict on the protection of personal data, this agreement wins. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

For questions about this agreement or to send a notice under it, email support@answer-lift.com.