Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the DevTune Terms of Service (the Terms) between PLGeek Ltd (DevTune, we, us) and the customer that accepts the Terms (you). It applies whenever we process personal data on your behalf in providing the Service, including during trials and on complimentary or discounted access.

You accept this DPA by accepting the Terms. It needs no signature. To receive a signed copy, email privacy@devtune.ai.

1. Definitions

Controller, processor, personal data, processing, data subject and supervisory authority have the meanings given in Data Protection Law. In this DPA:

• Data Protection Law means the laws that apply to the processing of Customer Personal Data, including the UK GDPR and the Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection and US state privacy laws such as the California Consumer Privacy Act (CCPA).
• Customer Personal Data means personal data that we process on your behalf under the Terms, as described in Annex 1.
• Subprocessor means a third party we engage that processes Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data. Unsuccessful attempts that do not compromise Customer Personal Data, such as port scans, denial-of-service attacks and failed sign-ins, are not Security Incidents.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles

You are the controller of Customer Personal Data and we are your processor. Where you process Customer Personal Data on behalf of your own customers, you are a processor, we are your subprocessor, and this DPA applies in the same way.

We are an independent controller of the personal data we need to run our relationship with you: account, billing and support details, and records of how the Service is used and secured. Our Privacy Policy covers that data. This DPA does not.

3. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA and your use and configuration of the Service, including the projects, prompts, integrations and agents you set up, are your instructions. You may give further reasonable written instructions that are consistent with the Terms.

If we believe an instruction infringes Data Protection Law, we will tell you. If law requires us to process Customer Personal Data in another way, we will tell you before we do, unless that law prohibits it.

You are responsible for the lawful basis and the notices needed for the personal data you bring into the Service. Do not submit special category data, data about criminal convictions or health data. Do not put personal data in tracked prompts; section 5 explains why.

4. How we use Customer Personal Data

We use Customer Personal Data only to provide, support, secure and maintain the Service for you, and to fix errors in it.

We do not sell Customer Personal Data or share it for cross-context behavioural advertising. We do not retain, use or disclose it outside our direct business relationship with you, or combine it with personal data from other sources except as Data Protection Law permits a service provider to. We are your service provider under the CCPA, and we will tell you if we can no longer meet our obligations under US state privacy laws.

We aggregate your project data to produce your reports, such as visibility, share of voice and AI Traffic totals. We may also use aggregated or de-identified information that contains no personal data to operate and improve the Service.

5. AI processing

We do not use Customer Personal Data to train or fine-tune AI models.

To run analyses, audit pages, draft content and run agents, we send requests to AI model providers. We use them under terms that exclude training on the data we send, either directly or through routers that send requests only to providers with that commitment. Providers may keep requests for a limited period under their own terms, for example to monitor abuse.

Tracked prompts work differently. To measure what AI platforms tell buyers, we run your tracked prompts on public AI platforms such as ChatGPT, Perplexity and Google AI Mode, the way a signed-out user would, through the probe providers on the subprocessor list. Those platforms handle the prompt under their own public terms, and we cannot prevent them from using it to train their models. Do not put personal data or confidential information in tracked prompts.

6. Our personnel

Only personnel who need access to provide the Service can access Customer Personal Data, and each is bound by confidentiality obligations that continue after their engagement ends. We review access every quarter and whenever someone's role changes, and remove access that is no longer needed.

7. Security

We maintain the technical and organisational measures in Annex 2 to protect Customer Personal Data, as Article 32 of the UK GDPR and the EU GDPR requires. We may change them as the Service and the threats to it change, but we will not reduce the overall protection they give Customer Personal Data.

8. Subprocessors

You authorise us to use the subprocessors on our subprocessor list, which gives each one's purpose and location. We review each subprocessor's security and data protection terms, and require it to protect Customer Personal Data at least as well as this DPA does, to the extent relevant to its service. Where we have not yet confirmed a provider's data protection terms or transfer safeguard, the list says so. We remain responsible to you for each subprocessor's performance of its data protection obligations.

We will email the owners of your account, and update the list, at least 14 days before a new subprocessor starts processing Customer Personal Data.

You may object on reasonable data protection grounds by emailing privacy@devtune.ai within 14 days of our notice. We will work with you in good faith to resolve the objection, for example by changing how the Service processes your data so that the new subprocessor does not receive it. If we cannot resolve it within 30 days, you may end the affected part of the Service by written notice, and we will refund any fees you prepaid for that part for the rest of its term.

If we must replace a subprocessor urgently to keep the Service running, for example to keep tracking an AI platform when a provider fails, or to fix a security problem, we will give as much notice as we reasonably can and otherwise notify you promptly after the change. Your right to object still applies, and the new subprocessor is bound by the same safeguards.

9. Security incidents

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. We will tell you what we know: what happened, the data and people likely to be affected, the likely consequences, what we have done and will do about it, and who to contact. We will send further details as we learn them.

We will take reasonable steps to contain, investigate and remediate the Security Incident, and help you meet your own obligations to notify supervisory authorities and the people affected. We may share information about it in confidence with our insurers, legal advisers and the providers helping us respond.

Notifying you of a Security Incident is not an admission of fault.

10. Helping you comply

If a data subject asks us to exercise their rights over Customer Personal Data, we will pass the request to you without undue delay and will not respond to it except to refer them to you. Where you cannot respond through the Service, we will help you.

We will give you the information and reasonable help you need for data protection impact assessments and consultations with supervisory authorities about the Service.

If a public authority asks us for Customer Personal Data, we will tell you unless law prohibits it, challenge requests we reasonably consider unlawful, and disclose only what we are legally required to.

11. Audits

On request, we will give you the information needed to show that we meet this DPA, including answers to reasonable security questionnaires and summaries of our security policies and procedures. That information is our confidential information.

If that information is not enough to show compliance, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance with this DPA. Audits take place no more than once in any 12 months unless a Security Incident or a supervisory authority requires another, on at least 30 days' written notice, during UK business hours, within a scope agreed in advance and without unreasonable disruption to the Service. You pay for your audit. We may ask for it to be carried out remotely.

12. Return and deletion

While you use the Service, you can retrieve your project data through the app, the REST API and the MCP server, and delete projects or your account yourself.

When the Service ends, or earlier if you ask in writing, we will return Customer Personal Data to you in a commonly used, machine-readable format or delete it, as you choose, within 30 days, unless law requires us to keep it. We will confirm deletion in writing on request.

Copies in our database backups are overwritten within 30 days, and copies held by subprocessors are deleted under their terms. Until then, those copies stay protected under this DPA and are used only to recover the Service.

13. International transfers

We are in the United Kingdom. Customer Personal Data is stored in the United States and processed in the locations on the subprocessor list. We transfer it to subprocessors outside the UK and the European Economic Area only under a safeguard that Data Protection Law recognises, such as an adequacy decision, the SCCs or the UK Addendum.

Transfers to us from the European Economic Area and Switzerland rely on their adequacy decisions for the United Kingdom. Where a transfer to us is not covered by an adequacy decision or another safeguard, the SCCs apply and are incorporated into this DPA as follows:

• Module 2 applies where you are a controller, and Module 3 where you are a processor.
• Clause 7 does not apply. Under Clause 9, Option 2 applies, with the notice period in section 8. The optional wording in Clause 11 does not apply.
• The competent supervisory authority is determined under Clause 13. Under Clauses 17 and 18, the law and courts of Ireland apply.
• Annexes 1 and 2 of this DPA complete Annexes I and II of the SCCs, and the subprocessor list completes Annex III.
• For transfers subject to Swiss law, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, and references to the GDPR include the Swiss Federal Act on Data Protection.
• For transfers subject to the UK GDPR, the UK Addendum applies with the SCCs as set out above. Either party may end it as its Section 19 allows.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. This does not limit liability to data subjects under the SCCs, or liability that law does not allow to be limited.

15. Precedence, term and changes

For the processing of Customer Personal Data, the SCCs prevail over this DPA where they apply, and this DPA prevails over the Terms.

This DPA lasts for as long as we process Customer Personal Data.

We may update this DPA to reflect changes in law or in the Service. We will email the owners of your account before a material change takes effect. No change will reduce the protection this DPA gives Customer Personal Data during your current subscription term without your agreement.

This DPA is governed by the law of England and Wales, except where the SCCs require otherwise.

Annex 1: Details of the processing

• Data exporter: you, as identified in your DevTune account.
• Data importer: PLGeek Ltd, C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom, as processor or subprocessor. Contact: privacy@devtune.ai.
• Subject matter and purpose: providing the Service. That means measuring what AI platforms say about your product and who they cite, monitoring what AI systems fetch from your website and who they send to it, recommending fixes and measuring their results, and running the agents, integrations, API and MCP access you configure.
• Nature of the processing: collection, storage, organisation, analysis, retrieval, generation, display, export and deletion.
• Duration and frequency: continuous, for as long as the Terms apply, followed by the return and deletion period in section 12.
• Data subjects: your personnel and the other authorised users of your account; people who visit your website, or are sent to it from AI answers, whose requests are recorded by the AI Traffic sensors you install; people in your connected Slack workspace who use DevTune agents; and people named in content you submit or that we collect for you, such as prompts, uploaded documents, agent instructions and AI answers.
• Categories of personal data: names, email addresses and roles of users; IP-derived identifiers, user agents, referrers and request paths in AI Traffic logs; Slack user identifiers and the messages exchanged with DevTune agents; the Search Console and Google Analytics data you connect; API request logs, including IP address and user agent when you enable it; and personal data contained in prompts, AI answers, uploaded documents, agent instructions, conversations and outputs.
• Special categories of data: none. You must not submit them (section 3).
• Retention: as set out in the retention table in our Privacy Policy and in section 12.
• Subprocessors: as set out on the subprocessor list.
• Competent supervisory authority: the UK Information Commissioner's Office, or the authority determined under Clause 13 of the SCCs where they apply.

Annex 2: Security measures

• Tenant isolation: every table in our database enforces row-level security, so one account cannot read another account's data. API keys and MCP credentials are scoped to an account and its permissions. Automated tests cover these boundaries.
• Access control: access within an account is role-based. Internal access to Customer Personal Data is limited to named staff using individual accounts protected by multi-factor authentication, and is reviewed every quarter and whenever a role changes.
• Encryption: data is encrypted in transit with TLS and at rest by our hosting and database providers. Credentials for connected services are also encrypted by the application.
• Logging: privileged administrative actions are recorded in an audit log kept for 400 days.
• Secure development: every change goes through pull request review and automated tests, including authorisation tests, before release. Automated security screening reviews code changes, and dependencies are scanned for known vulnerabilities and updated.
• Incident response: a documented incident response plan, exercised at least once a year, with controls to suspend affected users and accounts and revoke their sessions, API keys, webhooks and share links.
• Backups: the database has point-in-time recovery, and backups are overwritten within 30 days.
• Minimisation: each subprocessor receives only the data its purpose needs. Full AI answer text and individual AI Traffic events are deleted on the fixed schedules in the Privacy Policy.
• Subprocessor oversight: we review each subprocessor's security and data protection terms before we use it and when its role changes.
• Deletion: a documented procedure covers deleting live data, stored files, subprocessor copies and backups, with written confirmation on request.