VercatusLegal
Data processing agreement
This agreement applies to every workspace as part of the terms of service, so no customer has to ask for it. Enterprise customers who need a signed copy on their own paper write to us; the clauses are the same.
Version 7 · 2 October 2026Vercatus, Budapest, Hungary · hello@vercatus.com
Parties and scope
This data processing agreement is between the customer that holds a workspace (the controller) and Vercatus, Budapest, Hungary (the processor). It forms part of the terms of service and applies whenever the processor processes personal data on the controller's behalf in providing the service. It is written to meet Article 28 of the GDPR and the equivalent provisions of the UK GDPR and the Swiss FADP.
The processing
| Subject matter | Measuring how AI answer engines answer the questions on the controller's topics and what they say about its brand; fetching and analysing pages of websites the controller has verified it controls; and producing Answer Share, the Why lenses, Engine Briefs, plays, verdicts and reports from them. |
|---|---|
| Duration | The life of the workspace, plus the deletion period in the retention statement. |
| Nature and purpose | Building the controller's topics and questions from its site, its connected sources and its own input; asking answer engines those questions, with and without their web search, and questions about the controller's brand and its leading competitor, and recording the answers, the brands they name and the sources they cite; looking up the searches the engines ran in public search results, and the volumes of the topics' searches; fetching the controller's public pages under named crawler identities; extracting and storing their text; reading answers and text with language models to find what engines read and to write plays, their guides and drafts; running each play's acceptance check and reading its verdict against topics left alone; sending reports and alerts to addresses the controller names. |
| Types of personal data | Whatever personal data the controller's public pages contain, typically names of authors and staff, business contact details, quotations and reviews; names and business details of people that answer engines mention in their answers about the controller's topics and brand, such as founders or authors; and the text of questions the controller supplies, including searches from its Search Console and its tracked prompts. Account and billing data of the controller's users are processed by Vercatus as controller and are covered by the privacy policy, not this agreement. |
| Categories of data subjects | People named or quoted on the controller's website or in the answers recorded for it; the controller's users, as recipients of reports and alerts. |
| Outside this agreement | The public pages of other websites that answer engines cite are kept by the processor once for all its customers, with nothing about which customer's answers cited them, and the figures it pools across customers identify no customer, site, topic, question or person. The processor is controller for both, as the privacy policy describes. |
Instructions
- The processor processes personal data only on the controller's documented instructions. Creating a workspace, verifying a domain, choosing a plan and its topics, adding questions and competitors, starting a run, setting a schedule, connecting an integration and naming recipients are the instructions; the terms of service and this agreement complete them. Connecting Search Console is the instruction to use its data as the privacy policy describes, including asking its buyer, problem and brand searches of the answer engines; disconnecting it is the instruction to delete that data as described there.
- Those instructions include two uses across customers. An answer to a public question of the controller's poll may be reused for another customer who asks an identical question within six hours, and the controller may receive answers first asked for another, with nothing in the shared answer about who asked; answers to questions the controller keeps private, and to every question taken from its Search Console, are never shared, and the controller can turn sharing off. And the processor may derive from the processing aggregate figures that identify no customer, site, topic, question or person, as the privacy policy describes, and use them to provide and improve the service for all customers.
- The processor tells the controller if, in its opinion, an instruction infringes data protection law, and may wait for the controller to confirm it.
- Where the law of the EU or a member state requires the processor to process the data otherwise, the processor tells the controller before doing so unless that law forbids it.
Confidentiality
Everyone the processor authorises to process personal data is bound by confidentiality, by contract or by law, and has access only to what their role needs. The processor's own staff reach a workspace's data only to provide the service, to investigate a fault the controller reported, or as the law requires, and every such access is recorded in the audit log the workspace can read.
Security
The processor applies the technical and organisational measures described on the security page, which is the current statement of those measures: tenancy enforced by row-level security in the database, hashed credentials, encryption in transit, an append-only audit log, a crawler that signs its requests and honours robots.txt, and the retention periods in the retention statement. A measure the page describes as planned is not yet in place. The processor may improve the measures at any time and does not reduce the level of protection during the agreement.
Sub-processors
- The controller gives general authorisation for the sub-processors in the annex, which is the same list the privacy policy carries.
- The processor tells workspace owners by email at least thirty days before adding or replacing a sub-processor. The controller may object on reasonable data-protection grounds within that time; if the parties cannot resolve the objection, the controller may cancel the plan and the remaining fees of the current period are refunded.
- The processor binds every sub-processor to obligations at least as protective as this agreement and remains responsible to the controller for their performance.
- A controller that routes analysis through its own model-provider account takes that provider off the processor's list for its workspace's analysis. The answer engines the poll asks stay on the list, including a provider whose engine is one of them.
Requests from data subjects
If a data subject writes to the processor about data processed under this agreement, the processor forwards the request to the controller within five business days and does not answer on the controller's behalf unless instructed. The processor helps the controller answer, with the export and deletion capabilities the product provides, at no charge for ordinary requests.
Breaches
The processor tells the controller's workspace owners without undue delay, and in any case within seventy-two hours of becoming aware, of a personal data breach affecting the controller's data. The notice says what happened, which data and how many people are affected as far as is known, what the processor has done and recommends, and whom to contact; what is not yet known follows as it becomes known. The processor keeps a record of every breach.
Assistance and audits
- The processor helps the controller meet its obligations on security, breach notification, data protection impact assessments and prior consultation, as far as the processor's role allows, at cost where the work is substantial.
- The processor makes available the information needed to demonstrate compliance with this agreement: the security page, the audit log, the sub-processor list and, on request, written answers to a security questionnaire.
- The controller, or an auditor it appoints who is not a competitor of the processor, may audit the processor's compliance once in any twelve months, on thirty days' notice, during business hours, in a way that does not disturb other customers' data or the service. A third-party attestation, when the processor holds one, satisfies the audit for the scope it covers; no attestation is held today and none is implied.
International transfers
The processor stores the controller's data on servers in Amsterdam, Netherlands, and the answer engines' full responses and fetched page bodies in the object storage named in the annex. It transfers personal data outside the EU, EEA, UK or Switzerland only to the sub-processors in the annex, under the EU-US Data Privacy Framework where the recipient is certified and otherwise under the European Commission's standard contractual clauses (Decision 2021/914, module three, processor to processor, or module two where the sub-processor acts as processor for the controller), with the UK addendum or the Swiss adaptations where those laws apply. The processor keeps the transfer documentation and shows it to the controller on request.
Return and deletion
The controller can export its workspace's data at any time from the workspace, as CSV and JSON in one zip: its sites, runs, findings, verified fixes, tracked questions, the answers behind Answer Share, goals, audit log and usage. The results the workspace shows can also be read through the API on the plans that include it. When the workspace closes, whether by the controller's request or at the end of the read-only period after a cancellation, the processor deletes the personal data it holds for the controller within thirty days and confirms by email, except what the processor must keep by law, which stays confidential and is deleted when the obligation ends. The retention statement is:
Vercatus retains fetched page bodies for 30 days and then deletes them; answers, briefs, plays, verdicts and reports are kept for the life of the site and deleted within 30 days of the workspace's closure; a cited page's text is deleted 24 months after Vercatus last read it; pooled figures identify no workspace and are kept; account data is kept until the account is deleted; server logs for at most 30 days.
The poll's answers, the Engine Briefs, the plays and the verdicts are derived data of the workspace and are deleted with it. The public pages of other websites that answer engines cite, and the figures pooled across customers, carry no workspace, site, topic or question of the controller and are held by the processor as controller (see "The processing"), so they are not part of this deletion; the readable text of a cited page's version is deleted 24 months after the processor last read it.
Liability and precedence
Liability under this agreement is subject to the limits in the terms of service. Where this agreement and the terms conflict on the processing of personal data, this agreement prevails; where this agreement and the standard contractual clauses conflict, the clauses prevail. This agreement is governed by the law that governs the terms, except that the standard contractual clauses are governed by the law they name.
Annex: sub-processors
Current as of the version date at the top of this page.
| Provider | Entity and location | Purpose | Data | When |
|---|---|---|---|---|
| Railway | Railway Corporation; Servers in Amsterdam, Netherlands (EU West); the company is in the United States | Hosting of the application and the database | All workspace data, account data, crawled content, poll answers, the text of cited public pages, logs | Always |
| Cloudflare | Cloudflare, Inc.; United States; global network | Serving vercatus.com, DNS, network security; R2 object storage for fetched page bodies and for the answer engines' full responses | Connection logs; fetched page bodies (30 days); each engine's full response to a question, kept as long as the answer it belongs to | Always |
| Anthropic | Anthropic, PBC; United States | Language models, under no-training terms, that build a site's topics and questions, read the poll's answers, the pages engines cite and the Engine Briefs for the brands and facts they state, read the sampled pages of the customer's site and write the run's analysis, write a play's steps and draft and, for a play on the site, the page itself, and answer questions in the in-app assistant. Claude is also one of the answer engines the poll, the run's panel and the Engine Briefs ask | Text of the customer's verified pages; when topics are built, the site's profile, the start of its home page's text, its tracked prompts and, when Search Console is connected, its buyer, problem and brand searches with their impressions; in a run's analysis, the search figures and top searches of the site's pages; the questions and their answers; the text of cited public pages; for the assistant, the question asked and the workspace data it reads to answer, which can include connected Analytics and Search Console data | Every day the poll runs; when topics are built, a run analyses pages or someone asks for a play's steps, draft or page; once a week (the Engine Briefs); each question to the assistant. A workspace that routes analysis through its own provider account takes the analysis off this list; Claude is still asked as an answer engine |
| OpenAI | OpenAI OpCo, LLC; United States | The ChatGPT answer engine: the questions on a site's topics, with web search and without, and the Engine Briefs' questions about its brand and its leading competitor. Where ChatGPT's own app is read through DataForSEO, the poll's search questions go that way and the API answers only when the app cannot be read | The questions, which can include tracked prompts and the site's Search Console searches word for word; the brand's name and domain; no account data | Every day the poll runs; each run's panel; once a week (the Engine Briefs) |
| Google Ireland Limited; Ireland; United States | The Gemini answer engine, with Google Search and without, for the poll, the run's panel and the Engine Briefs. With the customer's permission and their own read-only scopes, Google sign-in and the reading of Search Console and Google Analytics; and the Chrome UX Report's public performance figures for the site's pages | The questions, which can include tracked prompts and the site's Search Console searches word for word; the brand's name and domain; no account data. For the connections, the tokens that read the property and nothing else; for the Chrome UX Report, the addresses of the site's public pages | Every day the poll runs; each run; once a week (the Engine Briefs); Search Console and Analytics only when a workspace connects them, on each sync | |
| Perplexity | Perplexity AI, Inc.; United States | The Perplexity answer engine, with its web search: the poll, the run's panel and the Engine Briefs | The questions, which can include tracked prompts and the site's Search Console searches word for word; the brand's name and domain; no account data | Every day the poll runs; each run's panel; once a week (the Engine Briefs) |
| xAI | X.AI LLC; United States | The Grok answer engine, with its live search and without: the poll, the run's panel and the Engine Briefs | The questions, which can include tracked prompts and the site's Search Console searches word for word; the brand's name and domain; no account data | Every day the poll runs; each run's panel; once a week (the Engine Briefs) |
| Mistral AI | Mistral AI SAS; France | The Le Chat answer engine, with its web search and without: the poll, the run's panel and the Engine Briefs | The questions, which can include tracked prompts and the site's Search Console searches word for word; the brand's name and domain; no account data | Every day the poll runs; each run's panel; once a week (the Engine Briefs) |
| You.com | You.com (SuSea, Inc.); United States | The You.com answer engine, only where it is switched on, and then only in a run's citation panel; never in the daily poll or the Engine Briefs | The questions, which can include tracked prompts and the site's Search Console searches word for word; the brand's name and domain; no account data | Each run's panel, where You.com is switched on |
| DataForSEO | DataForSEO OÜ; Estonia | Answers and search data from the search engines' own pages: Google's AI Overviews and AI Mode, Bing's Copilot Search, and ChatGPT's and Gemini's own apps for the questions on a site's topics; Google and Bing results for the searches the engines ran and for checking a brand's review profiles; Google Ads search volumes for the topics' names, questions and searches | The questions, which can include tracked prompts and the site's Search Console searches word for word; the searches the engines ran; the brand's name with a review platform's domain; the keywords whose volume is looked up, which can include the site's Search Console searches; no account data | Every day the poll runs; each run's panel; when topics are built and once a month when demand is estimated; when a play's acceptance check runs |
| Brave | Brave Software, Inc.; United States | The Brave Search API: the searches Claude ran while answering are looked up in Brave's index, the index Claude searches | Those searches, as the engine ran them; no account data | When the Search lens checks a site's searches |
| Resend | Resend, Inc.; United States | Transactional email: confirmation links, invitations, reports, alerts, briefs | Email addresses, report contents | When an email is sent |
| Stripe (Link) | Stripe Payments Europe, Ltd. and Stripe, Inc.; Link is Stripe's service; Ireland; United States | Subscription billing as merchant of record: checkout, card processing, receipts and invoices, tax, refunds and disputes. For the payment itself Stripe acts as an independent controller, not our processor | Billing contact, tax identifiers, payment details entered on Stripe's own pages and never seen by us | When a workspace pays |
| Sentry | Functional Software, Inc. (Sentry); United States | Error reporting, only while it is switched on: unexpected failures of the application and the worker | The error's message and stack trace, which can quote what failed (such as a question or a page address), with workspace, run, step and request identifiers; no cookies, IP addresses or user details | When an unexpected error occurs |
Signed copies for Enterprise: write to hello@vercatus.com with the legal names of the parties; the clauses above are returned on the customer's paper unchanged.