Data processing agreement

1. Subject, duration and purpose

The processor processes personal data only to provide the Notable service to the customer: measuring how AI assistants mention and recommend the customer's brands, and running the customer's workspace. This agreement lasts as long as the customer uses the service, and until the data is deleted under section 9.

2. The data and the people it is about

• People: the customer's workspace members, the people they invite, and (where the customer connects them) visitors counted in aggregate by Google Analytics and Search Console.
• Data: names and email addresses of members and invitees; their roles; sign-in records; email preferences; daily aggregate figures from connected Google accounts (no data about identifiable visitors).
• No special category data is needed for the service, and the customer will not enter any.

3. Instructions

The processor processes the data only on the customer's documented instructions, which are this agreement and the customer's use of the service, unless the law requires otherwise; in that case it tells the customer first, unless the law forbids that. It tells the customer if it believes an instruction breaks data protection law.

4. Confidentiality

Everyone who can reach the data on the processor's behalf is bound to keep it confidential.

5. Security

The processor takes the technical and organisational measures in Annex 1, and keeps them appropriate to the risk.

6. Sub-processors

The customer authorises the sub-processors in Annex 2. The processor tells the customer at least 30 days before adding or replacing one, and the customer may object on reasonable grounds; if the parties cannot agree, the customer may end the contract. The processor binds each sub-processor to obligations equivalent to these and remains responsible for it.

7. Transfers

Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses.

8. Helping the customer

The processor helps the customer, as far as it reasonably can, to answer requests from the people the data is about, and with security, breach notification, impact assessments and prior consultation. It tells the customer of a personal data breach without undue delay, and within 48 hours of becoming aware of it, with the information the customer needs to meet its own obligations.

9. End of the service

When the service ends, the processor deletes the customer's personal data within 30 days (and from backups within 8 weeks), unless the law requires it to keep some. The customer can export its brands' data before then.

10. Audits

The processor makes available the information needed to show it meets these obligations, and allows audits by the customer or an auditor it appoints, on reasonable notice, at most once a year unless a breach or an authority requires more.

Annex 1: technical and organisational measures

• Data hosted in the EU (Frankfurt), encrypted in transit (TLS) and at rest by the hosting providers.
• Access tokens for connected Google accounts encrypted again by the application (AES-256-GCM).
• Every query that touches workspace data checks the user's workspace and, for client viewers, the brand.
• Sign-in by one-time email link; no passwords are stored.
• Rate limits on sign-in, the free report and public links.
• Daily backups by the database provider, and our own backups with a restore tested on every change.
• Error tracking and structured logs; dependency scanning on every change.
• Personal data kept no longer than the periods in our privacy policy.

Annex 2: sub-processors

• Vercel Inc.: hosting of the web application (EU region, Frankfurt).
• Supabase Inc.: database (Frankfurt).
• Render Services Inc.: background processing (Frankfurt).
• Stripe: payments and invoicing.
• Resend: email delivery.
• Functional Software Inc. (Sentry): error tracking (EU region).
• Anthropic, OpenAI and Perplexity: AI answers to the customer's tracked questions (no personal data sent).
• Google: only where the customer connects Google Analytics or Search Console.
• [To check: each company's legal name and address before signing.]