Data Processing Addendum

Last updated: September 25, 2026

This Data Processing Addendum (“DPA”) is part of the SEOTrack.app Terms of Service between the customer who holds the account (“Customer”, the controller) and BOT-HOLDINGS, LLC, doing business as codedatda.casa (“Provider”, the processor). It applies whenever Provider processes personal data on Customer's behalf through SEOTrack.app, and it takes precedence over the Terms for that subject. Terms such as “personal data”, “processing”, “controller” and “processor” have the meanings in the GDPR, the UK GDPR, and, where applicable, the CCPA/CPRA (where Provider acts as a “service provider”).

1. Subject matter, duration, nature and purpose

Provider processes the personal data contained in the data that Customer and its users put into SEOTrack.app or ask it to fetch (Customer Data), in order to provide the service described in the Terms: storing it in Customer's workspace, fetching search-result and keyword data, sending prompts to the AI provider Customer chooses using Customer's API key, importing Google Search Console and Google Analytics data where Customer connects them, publishing to Customer's WordPress site where Customer asks, and emailing reports to the recipients saved in Customer's settings (the field starts empty). Processing lasts for as long as Customer has an account and until the data is erased under section 9.

Categories of data subjects: Customer's users who sign in to the workspace; people Customer enters as report recipients; people whose names or details appear in search results, AI answers, Search Console data or articles that Customer tracks, imports or drafts.

Categories of personal data: email addresses and Argon2id password hashes of users; workspace settings; report-recipient email addresses; WordPress usernames and application passwords and AI-provider API keys (stored encrypted); Google authorization tokens (encrypted) and the Search Console query and page statistics and Google Analytics figures imported with them; images Customer uploads (article images and product, brand or character reference pictures, which may show people and keep their embedded metadata); tracked keywords, domains, search results, AI answers and article drafts, which may contain the names of people or businesses.

Special categories: none are intended; Customer agrees not to put special-category data, or data about children, into the service.

2. Instructions

Provider processes Customer Data only on Customer's documented instructions, which are: the Terms, this DPA, Customer's use of the service's features and settings, and any further written instruction that is consistent with them. Provider will tell Customer if it believes an instruction breaks data-protection law, and may stop processing until the instruction is confirmed. Provider will also process Customer Data where required by law, and will inform Customer of that requirement before processing unless the law forbids it.

3. Confidentiality

Provider limits access to Customer Data to staff and contractors who need it to provide the service, all of whom are bound by confidentiality obligations. Provider's support staff access a Customer's workspace only to provide support Customer requested, to investigate abuse or a security incident, or as required by law, and such access is logged.

4. Security

Provider implements the technical and organizational measures in Annex II, and reviews them regularly. Provider will not reduce the overall level of protection during the term.

5. Sub-processors

Customer authorizes Provider to use the sub-processors listed in Annex III. Provider will give Customer at least 30 days' notice by email or in-app notice before adding or replacing a sub-processor; Customer may object on reasonable data-protection grounds within that period, and if the objection cannot be resolved Customer may terminate the affected service and receive a pro-rata refund of prepaid fees. Provider remains responsible for its sub-processors and imposes on them data-protection obligations no less protective than this DPA.

6. Assistance

Taking into account the nature of the processing, Provider will help Customer respond to data-subject requests (access, correction, deletion, portability, objection, restriction) using the service's export and deletion features and, where those are not enough, by reasonable manual assistance. Provider will forward to Customer, without answering on the merits, any request it receives directly that concerns Customer Data. Provider will also help Customer with security, breach notification, data-protection impact assessments and prior consultation with a supervisory authority, to the extent the information is available to Provider.

7. Personal-data breaches

Provider will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point, and will be updated as more becomes known. Provider will cooperate with Customer's investigation and any notification Customer must make.

8. Audit

On written request, no more than once a year unless a supervisory authority requires otherwise or a breach has occurred, Provider will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of any independent security assessments it holds, and will allow an audit by Customer or an independent auditor bound by confidentiality, at Customer's cost, on 30 days' notice, during business hours, and without disrupting other customers.

9. Deletion and return

Customer can delete projects, keywords, competitors and articles, and remove its API keys and WordPress credentials, at any time in the service. When the workspace owner deletes the account, sign-in is disabled immediately and the workspace database and the users' stored AI-provider API keys are erased 30 days later; when a subscription lapses, the workspace is archived after 90 days and erased 30 days after archival. After erasure Provider keeps the invoice history for accounting, the deactivated sign-in records (email address and password hash) and account activity records until Customer asks for their deletion, WordPress application passwords and Google authorization tokens that were not removed in the service until Customer asks for their deletion, and copies in operator-held recovery snapshots taken before software updates until those snapshots are deleted.

10. International transfers

Provider is established in the United States. Where Customer Data is subject to the GDPR or UK GDPR and is transferred to Provider or a sub-processor outside the EEA, UK or Switzerland, the parties rely on the EU Standard Contractual Clauses (Module Two, controller to processor; and Module Three, processor to processor, for sub-processors), which are incorporated by reference with Provider as data importer and Customer as data exporter, the UK International Data Transfer Addendum where UK data is transferred, and the Swiss amendments where Swiss data is transferred, or on the sub-processor's Data Privacy Framework certification where it holds one. Provider will provide signed copies on request.

11. CCPA/CPRA

Where the CCPA/CPRA applies, Provider acts as Customer's service provider: it will not sell or share Customer Data, will not retain, use or disclose it for any purpose other than the business purpose of providing the service, will not combine it with data from other sources except as the CCPA permits, will comply with the CCPA and provide the same level of privacy protection it requires, will notify Customer if it can no longer meet its obligations, and grants Customer the right to take reasonable steps to stop and remediate unauthorized use.

12. Liability and term

Each party's liability under this DPA is subject to the limitation of liability in the Terms, except that nothing limits a party's liability for a breach of its obligations to data subjects that the law does not allow to be limited. This DPA lasts as long as Provider processes Customer Data.

Annex I: Details of processing

Described in section 1 and in the service documentation. Frequency: continuous while Customer uses the service. Location of the service: Provider's own server in Las Vegas, Nevada, United States, reached through Cloudflare.

Annex II: Technical and organizational measures

• Public traffic reaches the service only through Cloudflare. The web app sends HSTS so browsers use HTTPS after their first visit, and the apps and every link Provider publishes use HTTPS; the application sets its sign-in cookie HttpOnly and SameSite=Lax, checks a CSRF token on state-changing requests, sends a Content-Security-Policy, and rate-limits requests, with a tighter limit on sign-in.
• Each workspace's SEO data is stored in its own database in a separate directory; every request is bound to the signed-in user's workspace and checked against per-project access grants.
• Sign-in records for all workspaces are kept in one shared user database; passwords are stored only as Argon2id hashes.
• API keys, WordPress application passwords, Google authorization tokens and mail credentials are encrypted at rest in the service's single credential vault (Fernet, with a key derived by Argon2id from a machine key held on the server).
• Only a platform administrator can see which shared credentials are set, or change them.
• Before software updates the operator takes recovery snapshots of the databases and the credential vault and keeps them off the server.
• Personal-data breaches affecting Customer Data are notified to Customer as set out in section 7.

Annex III: Sub-processors

Questions about this DPA: dev@codedatda.casa.