Data Processing Agreement

Last updated November 4, 2026.

This agreement covers personal data you send us while using aivisibilityskill, under the GDPR, the UK GDPR and similar laws. It forms part of our Terms of Service for every customer, without needing a signature. If you'd like a countersigned copy, email ahmed@aivisibilityskill.com.

1. Roles

You are the controller of personal data in what you send us (for example customer ids, metadata, or names in questions). Ahmed Gagan, trading as aivisibilityskill.com ("we"), processes it as your processor. For your own account details (sign-in email, billing), we're a controller under our Privacy Policy.

2. What we process

• Subject matter and purpose: running the checks, analysis and reports you ask for, and the features around them (webhooks, usage reports, audit log).
• Duration: while your account is open, plus the deletion times below.
• Types of data: whatever you put in questions, brands, project names, customer ids and metadata; IP addresses and key names in the audit log. We ask you not to send sensitive data, and the service isn't designed for it.
• Data subjects: your users, your customers and their staff, as far as their data appears in what you send.

3. Our commitments

• We process your data only on your instructions: your use of the service, its settings, and this agreement. We tell you if we think an instruction breaks the law.
• Anyone who can access your data is bound to keep it confidential. Today that's only the founder.
• We protect it with the measures on our security page, including encryption in transit, hashed API keys, keys that can be locked to IP addresses, and an audit log.
• We help you answer requests from data subjects. You can delete everything stored for one of your customers yourself through the API (POST /v1/customers/{customer}/delete-data).
• We tell you without undue delay, and within 48 hours of becoming aware, of a breach affecting your data, with what we know and what we're doing about it.
• We give you the information you need to show compliance with this agreement, and answer reasonable written questions about it once a year (more often after a breach).

4. Subprocessors

You authorise these subprocessors. We tell you by email at least 30 days before adding or replacing one, and you can object; if we can't resolve it, you can end your plan and get back prepaid fees for months not yet started.

• Cloudflare, Inc. (global): hosting, databases, storage and email.
• DataForSEO: AI and search engine answers.
• OpenRouter, Inc. (US) and DeepSeek (China): AI engine answers. Only the questions and settings of a check are sent.
• Google LLC (US): Gemini, used to read AI answers; sign-in with Google.
• Dodo Payments and Wise: payments (account and billing data only).

5. Transfers

We and our subprocessors may process data outside the EEA and the UK. Where the law needs it, the EU Standard Contractual Clauses (module two, controller to processor, or module three where you are a processor yourself) and the UK addendum apply to those transfers, and are incorporated here by reference. This agreement fills in their annexes.

6. Deletion

• Per customer: through the API at any time, usually completed within minutes.
• Your whole account: within 30 days of your request, apart from billing records the law makes us keep.
• Automatically: results after your plan's history period, webhook logs after 30 days, the audit log after a year.

7. Liability and order

The liability limits in our Terms of Service apply to this agreement. If this agreement and the terms disagree about personal data, this agreement wins; the Standard Contractual Clauses win over both.

Signature

For aivisibilityskill: Ahmed Gagan, Founder of aivisibilityskill.com.