Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between AEO Optima ("Processor") and the subscribing organization ("Controller") for the provision of the AEO Optima platform ("Service").

This DPA sets out the terms governing the processing of personal data by the Processor on behalf of the Controller, in compliance with the EU General Data Protection Regulation (GDPR), the India Digital Personal Data Protection Act 2023 (DPDP Act), and other applicable data protection legislation.

By using the Service, the Controller accepts and agrees to this DPA. For enterprise customers requiring a countersigned DPA, please contact hi@techshu.ai.

In this DPA, the following terms apply:

• "Personal Data" means any data relating to an identified or identifiable natural person that is processed by the Processor in connection with the Service.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Sub-processor" means any third-party processor engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Subject" means the individual to whom the Personal Data relates.

The Processor shall process Personal Data only for the purpose of providing the Service as described in the Terms of Service and as instructed by the Controller. Processing activities include:

• Account management and authentication
• Organization and team member management
• Prompt management and answer capture
• Analytics computation and report generation
• Email notifications and digest delivery
• Billing and subscription management
• Audit logging and security monitoring

Categories of Data Subjects: Controller's employees, contractors, and authorized users of the Service; and, where the Controller connects its website's access logs to the Service, visitors to the Controller's website whose requests appear in those logs.

Types of Personal Data: Name, email address, IP address, browser/device metadata, authentication credentials (hashed), usage patterns, and any content the Controller submits to the Service.

Types of Personal Data (website access logs): for those visitors, the IP address, user agent, requested path and time contained in access-log records. The Processor reads these records only to identify requests made by known crawlers, discards every other record without storing it, and stores crawler requests without the IP address, keeping only a keyed hash of the network block, for 90 days.

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required by applicable law.
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption (AES-256-GCM), access controls (RBAC + RLS), and audit logging.
• Assist the Controller in responding to Data Subject requests (access, rectification, erasure, portability) via the platform's built-in data export and account deletion features.
• Notify the Controller without undue delay (within 72 hours) upon becoming aware of a Personal Data breach.
• Delete or return all Personal Data upon termination of the Service, subject to applicable retention requirements.

The Controller provides general authorization for the Processor to engage sub-processors. The Processor shall inform the Controller of any intended changes to sub-processors and give the Controller the opportunity to object. To object, the Controller emails hi@techshu.ai; a Controller that objects to DataForSEO is not routed to it, and its questions tracked outside India then have no Google AI Overview or AI Mode source.

Current sub-processors:

The Processor maintains the following technical and organizational measures:

• Encryption at rest: AES-256-GCM for API keys, tokens, and credentials
• Encryption in transit: TLS 1.2+ for all connections
• Access control: Role-based access control (RBAC) with 4 roles; row-level security (RLS) on 70+ database tables
• Authentication: Email/password with optional MFA (TOTP), OAuth (Google)
• Audit logging: 50+ event types logged with actor, target, IP, and metadata
• Rate limiting: Per-endpoint token bucket with 429 responses and Retry-After headers
• Data retention: Automated weekly purge. Answers (snapshots) and alert history follow the plan's window (Free 45 days · Starter 45 days · Pro-Individual 90 days · Pro-SME 90 days · Enterprise-Brand 365 days · Enterprise-Agency 365 days · Custom 365 days; an Enterprise-Agency or Custom organisation can agree a longer window, up to 2 years), and answers past their window are hidden rather than deleted, their daily totals kept; Google Analytics and Search Console data follow the plan's window until 19 November 2026 and are kept 365 days on every plan from 20 November 2026; audit logs 730 days, consent records 730 days, webhook deliveries 90 days
• Incident response: Breach notification within 72 hours as required by GDPR and 6 hours as required by CERT-In

The Processor provides the following self-service capabilities to assist the Controller in fulfilling Data Subject requests:

• Right of access: Data export feature (JSON format) available in profile settings
• Right to rectification: Users can update their profile, display name, and preferences
• Right to erasure: Account deletion after a 30-day grace period: the account's sign-in, profile, memberships, MCP tokens, scheduled reports and consent records are removed, and an organisation of which it was the only member is deleted with its data; some records are kept, unlinked from the account (section 8)
• Right to data portability: Machine-readable JSON export covering all personal data
• Right to restrict processing: Controller can deactivate team members via organization settings

For requests that cannot be handled via self-service, contact hi@techshu.ai.

Personal Data may be transferred to and processed in jurisdictions outside the Controller's country of residence. The Processor ensures that such transfers are subject to appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules of sub-processors where available

This DPA shall remain in effect for the duration of the Controller's use of the Service. Upon termination:

• The Controller may export all data using the built-in export feature before account closure.
• When an account is deleted, 30 days after the request, the Processor deletes its data as set out in section 6. Audit-log and application error-log entries are kept, unlinked from the account, with any email address, IP address or browser details recorded in them: audit-log entries until their 730-day window ends, error-log entries until they are deleted, as that log has no automatic deletion yet.
• Anonymized and aggregated data (which does not constitute Personal Data) may be retained for analytics purposes.

For questions about this DPA or data processing activities:

• Data Protection Contact: Indranil Banerjee, Head of AI & Innovation
• Email: hi@techshu.ai
• Address: TechShu, Kolkata, India

Enterprise customers requiring a countersigned DPA with custom terms should contact us at the above email address.