Acordo de tratamento de dados

1. Scope and roles

This Data Processing Agreement (“DPA”) is part of the Terms between you (the “Customer”) and DIGIT ME, LLC (“DIGIT-ME”). It applies when DIGIT-ME processes personal data on the Customer's behalf: report recipients' email addresses, personal data contained in data from connected Google Search Console or Analytics accounts, and any personal data included in the information the Customer submits. The Customer is the controller (or a processor acting for its own clients) and DIGIT-ME is the processor and, under U.S. state privacy laws, the service provider or contractor.

2. Instructions

DIGIT-ME processes Customer personal data only to provide the Services, on the Customer's documented instructions (these Terms, the Customer's settings and use of the Services), unless required by law.

3. Confidentiality and security

Persons authorized to process the data are bound by confidentiality. DIGIT-ME applies appropriate technical and organizational measures, including encryption in transit, encryption at rest of connected-account tokens, row-level security, least-privilege access and hashed IP addresses.

4. Sub-processors

The Customer authorizes the following sub-processors:

Supabase (USA) — database and authentication; our database is hosted in Ireland (EU).

Netlify (USA) — website hosting and serverless functions.

Stripe (USA / Ireland) — payments, invoicing and tax calculation.

Resend (USA) — transactional email, processed in the EU.

Anthropic (USA) — AI analysis, report writing, the report assistant, and measurement of Claude answers.

OpenAI (USA), Google (USA), Perplexity (USA) and SerpApi (USA) — measurement of ChatGPT, Gemini, Perplexity and Google AI Overviews answers to buyer questions (no personal data), and Google PageSpeed Insights for performance tests; Google Search Console and Analytics APIs only if you connect them.

DIGIT-ME imposes data protection obligations on its sub-processors and remains responsible for them. Changes are published on this page; the Customer may object by cancelling the Services.

5. Assistance and data breaches

DIGIT-ME assists the Customer with data subject requests and with data protection impact assessments where required. DIGIT-ME notifies the Customer of a personal data breach without undue delay, and in any case within 72 hours after becoming aware of it.

6. Deletion

When the Customer deletes its account, DIGIT-ME deletes Customer personal data immediately, except billing records kept as required by law; copies in encrypted backups are erased within 30 days.

7. Audits

DIGIT-ME makes available the information reasonably necessary to demonstrate compliance with this DPA and answers the Customer's reasonable written questions.

8. International transfers

Where Customer personal data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914, Module 2 or 3), the UK International Data Transfer Addendum and the Swiss amendments are incorporated by reference, with DIGIT-ME as data importer.

9. U.S. state privacy laws

DIGIT-ME does not sell or share Customer personal data, does not retain, use or disclose it for any purpose other than providing the Services, does not combine it with other data except as permitted by law, and complies with the obligations applicable to service providers and contractors.

10. Liability and precedence

Liability under this DPA is subject to the limitations of the Terms. In case of conflict between this DPA and the Terms on the processing of personal data, this DPA prevails.