Data Processing Agreement

This agreement applies when your business is established in the EU, the EEA or the UK, or when the EU or UK GDPR otherwise applies to personal data we process for you. It forms part of our Terms of Service, and you accept it by subscribing. Where it and the terms disagree about personal data, this agreement wins.

Who is who

You are the controller of the personal data that comes through your blog and your account: the people who send you an enquiry, the visitors to your blog, and the people named in your business details. SEO Web Boss is your processor: we handle that data only to run the service for you.

Data we hold about you as our customer — your sign-in email, your billing records — is ours to look after as controller, and our Privacy Policy covers it.

What we process, and why

• Subject matter and purpose: writing and publishing content for your business on your domain, hosting your blog, receiving the enquiries visitors send through it and passing them to you, reporting how your content performs, and sharing posts to the accounts you connect.
• Nature: collection, storage, display in your dashboard, email notification, analysis in aggregate, and deletion.
• Duration: for as long as your subscription runs, then until the deletion described below is complete.
• People concerned: people who contact you through your blog; visitors to your blog; you and the staff named in your business details.
• Categories of data:
  • enquiries: name, email, phone, message, the page sent from, and the campaign tags and ad click identifiers in the link the visitor arrived by;
  • site analytics: page views and search performance read from the Google Analytics, Search Console and Bing accounts connected to your site, including the search terms people used;
  • content: your business profile, the posts we write for you, and their images.

We do not ask for, and you should not send us, special categories of data (health, religion, and so on) about the people who contact you.

Your instructions

We process this data only on your documented instructions: these terms, the settings you choose in your dashboard, and what you ask us in writing. If the law requires us to do something else with it, we will tell you first unless the law forbids that. If we think an instruction breaks data-protection law, we will say so.

Confidentiality

Only staff who need it to run or support the service can see your data, and they are bound to keep it confidential.

Security

• All traffic to the dashboard, your blog and our backend is encrypted in transit.
• Access tokens for the accounts you connect are encrypted at rest (AES-256-GCM), used only by our backend, and never sent to a browser.
• Your data is scoped to your account; the console that can see across accounts is limited to our staff accounts.
• Customers sign in with emailed one-time links; we store no customer passwords.
• Blogs of EU-based customers are set up to ask visitors for consent before loading analytics, advertising pixels or our attribution cookie. If yours does not, tell us.
• If a personal-data breach affects data we process for you, we will tell you without undue delay after we become aware of it, with what we know.

Sub-processors

You authorise us to use the providers below. We will update this list, and email you, before a new one starts processing your data; if you object, you may cancel.

The accounts you connect (Google, Meta, LinkedIn, Apple Business Connect) and the search engines we notify about your pages receive what we publish or submit for you, under their own terms. They act on your instruction as separate services, not as our sub-processors.

International transfers

We process your data mainly in the United States, and in Singapore if you choose the Moonshot writing model. Where personal data leaves the EU, the EEA or the UK for a country without an adequacy decision, the transfer relies on the European Commission’s Standard Contractual Clauses (controller to processor between you and us, processor to processor between us and our sub-processors), together with the UK International Data Transfer Addendum for UK data. Those clauses are incorporated into this agreement by reference, and they prevail over anything here that conflicts with them.

Helping you answer the people concerned

Your enquiries are listed on the Leads page of your dashboard. When someone asks you to access, correct, delete, restrict, move or stop processing their data, email us and we will do what is needed on our side, in time for you to meet your own deadline. We will also help with a data-protection impact assessment or a question from a regulator where it concerns our processing.

At the end of the service

When your account closes we revoke and delete the access tokens for the accounts you connected straight away. Ninety days after it closes we erase the contact details and click identifiers in your enquiries (a dated count of them remains) and the stored search terms. The posts we wrote are your content, not personal data, and we keep them unless you ask us to delete everything — use our data deletion page to ask, at any time. We keep billing records and the audit log of publishing actions where the law requires it.

Audits

On written request we will give you the information you need to check that we keep to this agreement. If that is not enough, you or an auditor bound to confidentiality may audit our processing on reasonable notice, at your cost, no more than once a year unless a regulator requires it.

Contact

[email protected]