Data Processing Addendum

1. Parties & scope

This Data Processing Addendum (“DPA”) supplements the AnswerRank Terms of Service between you (“Customer”, the controller) and SG Systems PTE. LTD., a Singapore company operating AnswerRank (“AnswerRank”, the processor). It governs the processing of personal data Customer submits to the service.

2. Subject matter and nature

AnswerRank processes the URLs, prompts, competitor lists and AI-engine responses Customer provides, plus account / contact data, solely to provide the AEO tracking, audit and reporting features described in the product.

3. Customer instructions

AnswerRank only processes personal data on Customer's documented instructions (including via the product UI and API). AnswerRank notifies Customer if an instruction infringes applicable law.

4. Confidentiality

Personnel authorised to process personal data are bound by written confidentiality obligations.

5. Security measures

• Transport encryption (TLS 1.2+) for all customer traffic; storage encryption at rest for the production database.
• OAuth credentials (e.g. Google Search Console) are encrypted with AES-256-GCM using a key derived from AUTH_SECRET before being stored.
• Authentication via Auth.js v5 (Google, GitHub, magic link) — no plaintext passwords stored.
• Least-privilege access; production access logged and reviewed.

6. Sub-processors

AnswerRank uses the following sub-processors to deliver the service. Customer authorises this list and is notified before any addition.

• Vercel (hosting)
• Neon / Supabase Postgres (database)
• Stripe (billing)
• Resend (transactional email)
• Kit.com (waitlist + product newsletter)
• OpenAI / Anthropic / Google / Perplexity (AI engine queries on Customer's behalf)
• Google (Search Console API, on Customer's authorisation)

7. International transfers

Where transfers leave the country of origin, AnswerRank relies on Standard Contractual Clauses and equivalent transfer mechanisms with its sub-processors.

8. Data subject rights

AnswerRank assists Customer in responding to data subject access, rectification, erasure and portability requests through the product and, on request, by direct support.

9. Personal data breach

AnswerRank notifies Customer without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting Customer's personal data, with the information needed for Customer's own notification obligations.

10. Deletion & return

On termination Customer may export their data; AnswerRank deletes personal data within 30 days of termination unless retention is required by law.

11. No training, no resale

AnswerRank does not sell Customer's personal data and does not use it to train its own or third-party machine learning models.

12. Audits

AnswerRank makes available all information necessary to demonstrate compliance with this DPA on reasonable written notice.

Contact

DPA requests, sub-processor change notifications and security enquiries: sebastian@sg-systems.co.