Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Terms") between MAYA Tech Services LLC, a Delaware limited liability company, 8 The Green, Ste A, Dover, DE 19901, USA ("UpRadar", "we"), and the customer that accepts the Terms ("Customer", "you").

1. How this DPA is executed

1.1 This DPA applies automatically when you accept the Terms and we process Customer Personal Data on your behalf. Using the Service under the Terms is your acceptance; no signature is needed.

1.2 If you need a signed copy, email hello@upradar.ai and we will send a countersigned PDF with the same content. We do not negotiate individual changes.

2. Definitions

"Data Protection Laws" means the laws on processing personal data that apply to a party's processing under the Terms, including the EU GDPR (2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, the California Consumer Privacy Act as amended ("CCPA") and other U.S. state privacy laws. "Customer Personal Data" means personal data in the content that Customer or its users submit to the Service and that we process on Customer's behalf, as described in Annex I. "Sub-processor" means a third party we engage to process Customer Personal Data. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914. Other terms (controller, processor, service provider, sell, share and so on) have the meanings given in Data Protection Laws.

3. Roles

3.1 Customer Data. For Customer Personal Data, Customer is the controller (or a processor for its own client, for example an agency), and UpRadar is the processor (or sub-processor). Under the CCPA, Customer is a business and UpRadar is a service provider and contractor.

3.2 Our own data. UpRadar is an independent controller of the personal data it processes for its own purposes under its Privacy Policy: account data such as your login email, billing and payment records, security and fraud-prevention data, usage analytics, support messages and free-audit leads. This DPA does not apply to that data.

4. Subject matter, duration, nature and purpose

The subject matter, nature and purpose of processing, the types of personal data and the categories of data subjects are described in Annex I. We process Customer Personal Data for as long as we provide the Service, plus the deletion period in section 12.

5. Customer instructions

5.1 We process Customer Personal Data only on Customer's documented instructions, including on international transfers, unless the law requires otherwise; in that case we will tell Customer first unless the law prohibits it.

5.2 The Terms, this DPA and Customer's configuration of the Service (including which AI engines it tracks and which prompts it writes) are Customer's complete instructions. We will tell Customer promptly if we believe an instruction infringes Data Protection Laws.

5.3 Customer is responsible for the lawfulness of the Customer Personal Data it submits. Customer will not submit special categories of personal data, criminal-offense data or data about children, and will include personal data in prompts or brand information only where necessary.

6. U.S. state privacy laws

For Customer Personal Data subject to the CCPA or other U.S. state privacy laws, UpRadar will not (a) sell or share it; (b) retain, use or disclose it for any purpose other than the business purposes in Annex I; (c) retain, use or disclose it outside the direct business relationship with Customer; or (d) combine it with personal information from other sources, except as the CCPA permits. UpRadar will provide the level of privacy protection the CCPA requires, will notify Customer if it can no longer meet these obligations, and certifies that it understands and will comply with this section. Upon notice, Customer may take reasonable steps to stop and remediate unauthorized use.

7. Confidentiality and security

7.1 Everyone we authorize to process Customer Personal Data is bound by confidentiality.

7.2 We maintain the technical and organizational measures in Annex II, appropriate to the risk (Article 32 GDPR). We may update them if the overall level of protection is not reduced.

8. Sub-processors

8.1 Authorization. Customer gives general authorization for UpRadar to engage Sub-processors. The current list, with each one's purpose and location, is at upradar.ai/legal/subprocessors.

8.2 Notice and objection. We give at least 30 days' notice before a new Sub-processor processes Customer Personal Data, by updating the list and emailing customers who ask for updates at hello@upradar.ai. Customer may object on reasonable data-protection grounds within that period. If we cannot reasonably accommodate the objection, Customer may terminate the affected subscription before the change and receive a refund of prepaid fees for the unused period.

8.3 Flow-down. We bind each Sub-processor by written contract to data-protection obligations no less protective than this DPA and remain responsible to Customer for its performance.

8.4 Customer-directed engines. AI engines marked "customer-directed" on the list (currently DeepSeek, which stores data in the People's Republic of China and offers no data-processing agreement) are queried only if Customer enables them. Enabling one is Customer's instruction under section 5, and the Service shows Customer what will be sent before it is enabled.

9. International transfers

9.1 We process Customer Personal Data in the United States and in the countries where our Sub-processors operate, as shown on the list.

9.2 EU. For transfers from the European Economic Area to a country without an adequacy decision, the SCCs are incorporated by reference: Module Two where Customer is a controller, Module Three where Customer is a processor. Clause 7 applies; Clause 9(a) Option 2 applies with the notice period in section 8.2; the option in Clause 11 does not apply; Clause 17 Option 1 (law of Ireland); Clause 18 (courts of Ireland). SCC Annexes I and II are completed by Annexes I and II of this DPA, and Annex III by the Sub-processor list.

9.3 UK and Switzerland. For transfers from the United Kingdom, the ICO International Data Transfer Addendum to the EU SCCs (version B1.0) is incorporated, completed with the information in this DPA. For transfers from Switzerland, the SCCs apply with the FADP in place of the GDPR and the Swiss Federal Data Protection and Information Commissioner as supervisory authority.

9.4 Data Privacy Framework. Transfers to a recipient certified under the EU-U.S. Data Privacy Framework or its UK or Swiss extensions may rely on that certification.

9.5 Customer-directed transfers. A transfer to a customer-directed engine under section 8.4 happens only on Customer's instruction.

10. Assistance

10.1 We will help Customer, by appropriate technical and organizational measures, respond to data subject and consumer requests. If we receive such a request directly, we will refer the requester to Customer unless the law requires otherwise.

10.2 Customer can delete most Customer Personal Data in the Service. For an export or anything Customer cannot do itself, email hello@upradar.ai; we respond within 30 days.

10.3 We will reasonably assist with Customer's data protection impact assessments, prior consultations and security obligations, to the extent Customer cannot meet them with information available to it.

11. Personal Data Breach

11.1 We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach, by email to the address on Customer's account.

11.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. We will add information as it becomes available and take reasonable steps to contain the breach. A notice is not an admission of fault.

12. Audits, return and deletion

12.1 Audits. On written request to hello@upradar.ai, once in any 12-month period (or more often if a supervisory authority requires it or after a Personal Data Breach), we will provide our completed security questionnaire, a description of our measures (Annex II) and, where we may share them, current audit reports or certifications (such as SOC 2 or ISO 27001) of our infrastructure Sub-processors, and answer reasonable follow-up questions in writing.

12.2 No on-site audits. We do not offer on-site audits. If a supervisory authority formally requires an inspection that section 12.1 cannot satisfy, we will cooperate with a remote review on 30 days' written notice, at Customer's expense and under confidentiality.

12.3 Export and deletion. Customer may ask for an export at hello@upradar.ai before the Service ends; we provide it in a structured, machine-readable format within 30 days. Within 30 days after the Service ends, we delete Customer Personal Data from production systems unless the law requires us to keep it. Backups are overwritten within 30 days and remain protected under this DPA until then. We may keep a de-identified billing record.

13. Liability

Each party's liability arising out of or relating to this DPA is subject to the limitations and exclusions in the Terms, including the cap in section 16 of the Terms (the amounts paid or payable under the Terms in the 12 months before the event giving rise to the claim). The DPA and the Terms share one cap. Nothing in this section limits liability to data subjects under the SCCs or liability that cannot be limited by law.

14. Term, precedence and changes

14.1 This DPA lasts as long as we process Customer Personal Data under the Terms.

14.2 If there is a conflict, the SCCs (and the UK Addendum) prevail over this DPA, and this DPA prevails over the Terms on the processing of Customer Personal Data.

14.3 We may update this DPA to reflect changes in law or in the Service if the update does not materially reduce protection. We will email Customer about material changes at least 30 days before they take effect.

---

Annex I — Description of processing

• Parties. Exporter: Customer (details in its account). Importer: MAYA Tech Services LLC, 8 The Green, Ste A, Dover, DE 19901, USA; hello@upradar.ai.
• Nature. Collection, storage, transmission to AI engines, analysis, display and deletion; continuous for the term of the Terms, including weekly scheduled runs.
• Purpose (business purposes). Measuring how AI engines describe, cite and recommend Customer's brand: sending AI engines questions about Customer's brand, category and competitors and Customer's prompts; fetching robots.txt, the homepage, the sitemap and a limited number of public pages of the domain Customer submits; storing and analyzing answers; producing scores, quotes, comparisons, recommendations, reports and digests; support and security.
• Data subjects. Customer's account users; individuals named in the brand information, topics, prompts or competitor names Customer enters (for example founders, executives, notable clients, sole traders); individuals named in AI engine answers about Customer's brand or competitors; individuals named on public pages of Customer's website.
• Personal data. Names, roles and other information about those individuals contained in brand information (such as company description, notable clients and target audience), prompts, competitor names, stored AI answers and checked web pages.
• Special categories. None intended.
• Retention. As in UpRadar's Privacy Policy and section 12.

Annex II — Technical and organizational measures

1. Encryption in transit. All traffic to the website, app and API uses TLS. Encryption at rest is provided by our database, authentication and hosting providers.

2. Authentication. Sign-in is handled by Supabase Auth (email and password, email confirmation with PKCE); we never store passwords. Session cookies are secure and same-site. API requests use signed tokens verified against the provider's keys.

3. API keys. Customer API keys are stored only as SHA-256 hashes and can be rotated.

4. Outbound fetching. Our crawler fetches only public pages of the submitted domain, through a fetcher hardened against server-side request forgery, with a 5-second timeout, at most 3 redirects and response size limits.

5. Error monitoring. API error reports remove authentication headers, cookies, request bodies, email and IP addresses; background workers do not send default personal data.

6. Abuse protection. The public free audit is protected by rate limiting and a bot check (Cloudflare Turnstile).

7. Data minimization. We store no card data (Stripe handles payments) and send no email addresses or payment details to AI providers.

8. Access and secrets. Production access is limited to authorized personnel; credentials live in providers' secret settings, not in source code.

9. Change management. Code changes are reviewed and tested in continuous integration, including secret scanning, before deployment.

10. Backups. Our database provider keeps automated backups with point-in-time recovery.

11. Account deletion. Deleting an account removes the authentication identity, cancels the subscription and deletes the customer's brand data, prompts, audits and results in one transaction.

12. Incident response and retention. We follow a documented incident response procedure (section 11) and keep data for the periods in our Privacy Policy.