1. What does this agreement cover?
This agreement applies when AEO Corner (“we”) handles personal data on behalf of a customer (“you”) while providing the service under our Terms of Service. For that data you are the controller and we are the processor. For our own account, billing and security records, we are a controller, as the Privacy Policy says.
2. What data do we process, and why?
Only what is needed to measure your brand in AI answers and to help you apply fixes you approve, as listed here.
- Subject matter: measuring how AI answer engines describe your brand, checking your website, and helping you apply fixes you approve.
- Data: the names and work email addresses of your team members, the brand, competitor and question details you enter, the public web pages and AI answers we collect for you, and credentials you give us to connect your own systems (stored encrypted).
- People: your team members and any individuals named in public pages or AI answers about your brand.
- Duration: while your account exists, then as described in section 8.
3. What do we commit to?
We handle your data only on your instructions, keep it confidential, help with requests, and report breaches promptly.
- We process the data only on your documented instructions, which are these terms and your use of the service. If we think an instruction breaks the law we will say so.
- People who can reach the data are bound by confidentiality. Our staff console records what staff do, and a reviewer role cannot see which customer a record belongs to.
- We keep the security measures in section 4.
- We help you answer requests from individuals and regulators, as far as the data we hold allows. We tell you promptly if an individual writes to us about your data.
- We tell you without undue delay, and within [72] hours, after we become aware of a breach affecting your data.
4. How do we keep the data secure?
Each organisation’s data is kept apart and tested for leaks, and credentials are encrypted outside the database.
- Each organisation’s data is separated in the application and checked by automated tests that try to read one organisation’s data from another.
- Connection credentials (for example a WordPress application password or a Google token) are encrypted with a key that is held outside the database, and only our background worker can open them.
- Data is encrypted in transit. Sign-in is handled by a dedicated provider; our staff sign in separately with two-step verification.
- Requests from other companies (payments, email, sign-in) are accepted only when their signature checks out.
- Websites we are asked to read are fetched through a guarded client that refuses internal addresses, so a customer’s address cannot be used to reach our own systems.
- [Backups, access reviews and incident response: counsel to confirm wording against the final runbooks.]
5. Which companies help us handle it?
You allow us to use the companies on the subprocessors page. We bind each to data-protection terms no less protective than these. We tell you at least 30 days before adding one, and you may object as that page describes.
6. What happens to data sent abroad?
[Counsel to complete: the transfer mechanism for data sent outside the EEA/UK, such as the standard contractual clauses and the UK addendum.]
7. Can you check that we keep to this?
On reasonable notice, and no more than once a year unless there has been a breach, we will give you what you need to check we are keeping to this agreement: answers to a security questionnaire and, where we have them, the reports of our subprocessors.
8. What happens when the service ends?
When your account closes you can export your data. We then delete it within [30] days, except what the law requires us to keep (for example invoices), and what remains in backups, which is overwritten on the normal cycle.
9. Who do you contact?
Dot Bd Solutions, 335/Kha, TV Road, East Rampura, Dhaka-1219, Bangladesh. [email protected].