between the company that orders an analysis or books a team area from us (controller, hereinafter “customer”) and seora.one, Peter R. Stuhlmann, Martha-Arendsee-Str. 10, 12681 Berlin (processor, hereinafter “provider”). This agreement is concluded when a business (§ 14 BGB) orders an analysis or when a team plan is booked, and supplements the general terms and conditions. It governs the processing of personal data on behalf of the customer under Art. 28 of the General Data Protection Regulation (GDPR).
1 Subject matter and duration
The provider analyses websites for the customer and makes the results available to the customer; for team plans it also provides a team area. In doing so it processes personal data on behalf of the customer insofar as the data belongs to the customer’s website, its data sources and its team.
The agreement applies for as long as the customer has analyses stored with us or uses a team plan, and ends with the deletion of the last analysis or of the team area. It does not cover data that the provider processes as an independent controller: the customer account, order, payment and invoice, communication with the customer, and the retrieval of public data about competitors and about the people named by an analysed website (the provider’s privacy policy).
2 Type of data, purpose, data subjects
Data subjects: people named on the customer’s website (such as owners, employees, authors); visitors to the customer’s website in aggregated form, insofar as the customer connects data sources; employees and agents of the customer whom it invites to the team area (members), and people with whom reports are shared by link.
Analysis data: texts, metadata and screenshots of publicly accessible pages of the customer’s website, including the information about people published there; the customer’s details for the analysis (company, industry, region, goals, target group, competitors, details about the business); data from data sources the customer connects – Search Console (search queries and pages with clicks, impressions, click-through rate, position), Google Analytics (aggregated visit data per channel, landing page, device and country, no data on individual visitors), Tag Manager (published container), Matomo and Microsoft Clarity (aggregated values per page); status, people responsible and comments in the action tracker; share links (name, validity, visits without IP address).
Member data: name, email address and role, their profile picture if they upload one; sign-in times and devices for session management (shortened IP address); for sign-in with Google or LinkedIn, the ID of the account there and its email address; rights per member; which member started which analysis; invitations (email address, rights, personal message) and joins through the invitation link that are not yet confirmed (name, email address); members’ conversations with the AI assistant; the log of access by connected apps; the team’s activity log.
Purpose: carrying out, displaying and sharing the analyses; providing the team area, sign-in, managing members and rights, traceability for the team admin, notifications by email, the AI assistant’s answers to members’ questions.
3 Instructions
The provider processes the data only on documented instructions from the customer – that is, as this agreement, the service description, the customer’s details when ordering and the settings in the account or team area specify. The customer gives further instructions in text form to the provider’s email address. If the provider considers an instruction unlawful, it informs the customer. The customer is responsible for the lawfulness of the processing towards the data subjects – including informing them and, where one exists, involving the works council (the activity log and the “started by” note show who did what).
4 Duties of the processor
The provider commits everyone involved in the processing to confidentiality, supports the customer to the usual extent and at no additional cost with requests from data subjects, data protection impact assessments and notifications to supervisory authorities, and keeps a record of processing activities. The provider is not required to appoint a data protection officer and has not appointed one; the contact is the provider at its email address.
5 Security of processing
The provider takes the technical and organisational measures described in Annex 1 and keeps them state of the art. It may adapt them as long as the level of protection does not fall.
6 Sub-processors
The customer agrees to the use of the sub-processors named in Annex 2. The provider announces new or replaced sub-processors at least 30 days in advance on this page and by email to the team admins. The customer may object for good cause; if no solution can be found, the customer may cancel the team plan as of the time of the change or delete its analyses. The provider contractually commits sub-processors to an equivalent level of protection.
7 Transfers to third countries
The application and its database run in Germany. Where sub-processors process data outside the EU (see Annex 2), this happens only with appropriate safeguards under Art. 44 et seq. GDPR – an adequacy decision such as the EU-US Data Privacy Framework or the EU Commission’s standard contractual clauses.
8 Rights of data subjects
If a data subject contacts the provider with a request (access, rectification, erasure …), the provider forwards it to the customer without delay and supports the customer in answering it. The customer can delete analyses itself; the team admin can remove members in the team area themselves – the provider then deletes that person’s access to this team. The analyses they started stay in the team.
9 Personal data breaches
The provider reports personal data breaches to the customer without delay, at the latest within 48 hours of becoming aware of them, with the information the customer needs for its own notification, and takes the necessary measures to limit the consequences.
10 Evidence and audits
The provider demonstrates compliance with this agreement on request, usually by providing information and documents. On-site inspections are possible after at least four weeks’ notice during normal business hours, at most once a year unless there is a special reason; they must not endanger operations or the confidentiality of other customers’ data. The customer bears the costs of an on-site inspection carried out without a specific reason.
11 Deletion and return
During the term the provider deletes entries in a team’s activity log after 3 months, entries in the log of connected apps after 90 days, records of emails sent after 90 days and conversations with the AI assistant after 180 days without activity. Records of what a deletion period removed automatically (numbers and identifiers only) are deleted after 12 months. If the team admin removes a member, that person’s access ends immediately and the provider deletes their access to this team together with the associated sessions, conversations with the AI assistant and connected apps. If the customer deletes an analysis, the provider deletes it immediately together with screenshots, downloads, share links and data from data sources.
When the team area ends, the members are signed out and all share links are closed. The team admin can still read and download analyses, downloads (PDF and spreadsheet file) and invoices for 30 days. After that the provider deletes the team completely – analyses, share links, members’ accounts, invitations and activity log – unless there is a statutory retention obligation (invoices: 8 years). Copies in backups expire after 14 days at the latest. If the provider locks a team area, it is closed to everyone.
12 Final provisions
In the event of contradictions between this agreement and the general terms and conditions, this agreement takes precedence in matters of data protection. Liability is governed by Art. 82 GDPR and otherwise by the provisions of the general terms and conditions. The provider announces changes with the notice period under section 6; the version shown above is authoritative. German law applies.
Annex 1 – Protective measures
- Access to the system: sign-in by email link, password (stored only as a check value, checked against known data breaches) or – where set up – with Google or LinkedIn (the provider only receives the ID, email address and name of the account there – from LinkedIn also the link to the profile picture and the language setting, which it discards –, no access to data there); limited sign-in attempts; sessions per device can be viewed and ended; team accounts are valid only on their team’s address.
- Access to data: data separated per account and per team; rights per member (read, start, share), administration by the team admin only; share links with expiry date, password and lock, recipients can only read.
- Transmission: encrypted only (TLS); team addresses, analyses and share links are blocked for search engines.
- Traceability: activity log per team, deleted after 3 months; log of access by connected apps.
- Protection against misuse: limits on the number of calls for sign-in, booking and downloads; only an encrypted check value (pseudonymous) is stored, never the IP or email address itself.
- Server: operated in a data centre in Frankfurt am Main; administrative access to the server only for the provider and only encrypted; the application runs separately in containers without administrator rights; updates are checked automatically before they are installed.
- Backups: daily backup of the database and the data folder; retention for 14 days on the server and 30 days in a copy at the provider in Germany; a deletion list ensures that deleted data stays deleted after a backup is restored.
- Secrets: the provider’s access keys to services are kept only in the server’s environment – not in the database and not in the interface. If a customer stores its own access to AI services, the provider stores these keys encrypted; the interface shows only their last four characters. If a customer chooses to store access to a data source (Google, Matomo, Microsoft Clarity) for the follow-up audits of an annual pack, this access is likewise stored encrypted in the database – at most until the last follow-up audit of the pack, the refund of the pack, the deletion of the account or until the customer disconnects it.
- Organisation: access to customer data only insofar as necessary for operations, troubleshooting or a request from the customer; exports of personal data by the provider are recorded.
Annex 2 – Sub-processors
Which provider takes on which task is determined by the platform’s settings; the list shows today’s state. The report texts are written by OpenAI, the suggestions in the order form by OpenAI; the AI assistant runs via OpenAI, the translation of reports via OpenAI; for visibility in AI answers we question ChatGPT, Gemini, Perplexity and Claude.
Hostinger International Ltd.
- Service
Server (VPS): operation of the application and storage of all data
- Place of processing
Cyprus (registered office); data centre in Frankfurt am Main, Germany
- Data
all data under section 2
Resend
- Service
- Sending emails (invitations, sign-in links, allowance notices, “report is ready”)
- receiving emails to the provider’s addresses
- Place of processing
USA – EU-US Data Privacy Framework (certified)
- Data
name, email address, content of the message concerned – for invitations also the team admin’s personal message
OpenAI Ireland Ltd.
- Service
- Report texts (analysis model)
- Suggestions in the order form
- AI assistant
- Translation of reports
- Queries on visibility in ChatGPT
- Place of processing
Ireland; access from the USA on the basis of the EU standard contractual clauses
- Data
- Report texts: content of the analysed website – including people named there –, measurements and the details for the analysis (company, industry, region, goals, target group, competitors); if the customer has connected them, also data from Search Console (search queries and pages with clicks, impressions, click-through rate, position) and from Google Analytics (name of the property; sessions, engagement and conversions per channel, landing page, device and country).
- Suggestions: address, title, description, headings and a text excerpt of the homepage, the text of the legal notice and the company name.
- AI assistant: the member’s messages and – if they ask about them – content of the analyses and details from their account and about the team: name, email address, signed-in devices (without IP address), role, rights and usage, for the team admin also details of the subscription; billing address and VAT ID if stored in the account.
- Translation: the texts of the report.
- Visibility: questions about the analysed website, brand and industry.
Anthropic Ireland, Limited
- Service
- Queries on visibility in Claude
- Web search for competitors
- Place of processing
Ireland; access from the USA on the basis of the EU standard contractual clauses
- Data
- Visibility: questions about the analysed website, brand and industry.
- Competitors: domain, offering and region of the analysed website.
- No account or member data.
Google Ireland Limited / Google LLC
- Service
- Queries on visibility in Gemini
- Measuring load times with PageSpeed Insights and Chrome UX Report
- Entity at Google (Knowledge Graph, Natural Language)
- Search Console – only if the customer connects it for an analysis
- Google Analytics – only if the customer shares it for an analysis
- Google Tag Manager – only if the customer shares it for an analysis
- Place of processing
Ireland and USA – Google LLC certified under the EU-US Data Privacy Framework
- Data
- Visibility: questions about the analysed website, brand and industry.
- Load times: addresses of the pages checked.
- Entity: company name and text excerpts of the home page and the about-us page of the analysed website.
- Search Console: the sign-in with Google; click and search data of the connected website is read.
- Google Analytics: the sign-in with Google; aggregated visit data of the connected website is read (sessions, channels, landing pages, devices, countries, conversions), no data on individual visitors.
- Google Tag Manager: the sign-in with Google; the published version of the connected website’s container is read (types and names of tags, measurement IDs, consent settings), no visitor data.
- No account or member data.
Perplexity AI, Inc.
- Service
Queries on visibility in Perplexity
- Place of processing
USA – EU standard contractual clauses; requests are not stored
- Data
- Visibility: questions about the analysed website, brand and industry.
- No account or member data.
DataForSEO OÜ
- Service
- Search results, keyword metrics and backlinks
- business profile, reviews, mentions and answers from AI search about the analysed website
- Place of processing
Estonia (EU)
- Data
search terms, domains, company name and questions about the analysed website; names of people whom the analysed website itself names as owners or authors (search for professional profiles) – no account or member data
ElevenLabs (Eleven Labs Inc.)
- Service
Voice-over for the analysis video – only with the add-on
- Place of processing
USA – EU-US Data Privacy Framework (certified)
- Data
the narration text of the video: company, website and results of the analysis – no account or member data
Payments are handled by Stripe Payments Europe, Limited (Ireland) as an independent controller; for this Stripe receives the customer’s billing details, no data of the members.
The application also calls services that receive no data of the members and no data about people: the European Commission’s VIES interface (the customer’s VAT ID), “Pwned Passwords” from Have I Been Pwned (the first 5 characters of a check value when someone sets a password) and public registers and archives for the analysis – Wikidata, the Wikimedia Foundation (page views of a Wikipedia article), domain registries (RDAP), Internet Archive, directories of TLS certificates, Common Crawl, HTTP Archive, the ad libraries of Google and Meta, and Brave Search; they receive the domain and company name of the analysed website, Wikimedia the title of the article.