Data Processing Agreement

1. Definitions

Capitalised terms (“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”) have the meaning given in Article 4 of the GDPR (Regulation (EU) 2016/679). “Customer” means the paying RankCause account holder. “RankCause” means the entity operating the service at prism.com, incorporated in {{FACT_PENDING}}.

2. Scope & role

For all Personal Data processed on behalf of the Customer, RankCause acts as Processor and the Customer acts as Controller. This DPA applies in addition to our Terms of Service and Privacy Policy and prevails in case of conflict on data-protection matters.

3. What Personal Data is processed

The following categories are processed for the duration of the Customer’s subscription:

• Account data — email, hashed password, billing identifiers.
• Usage / telemetry data — feature usage events, log-ins, API call metadata.
• Customer-submitted content — domains, keywords, crawl output, log files, any data the customer uploads or that RankCause fetches on the customer’s behalf.
• Support data — emails, chat transcripts, troubleshooting artifacts voluntarily shared by the customer.

4. Processing purposes & instructions

RankCause processes Personal Data only on the Customer’s documented instructions, which are: (a) providing the services described on the public pricing page; (b) billing and support; (c) complying with applicable law. Anything outside (a)–(c) requires explicit written instruction.

5. Sub-processors

RankCause engages the following sub-processors, each bound by written terms offering at least the same level of protection as this DPA.

In addition, if the Customer chooses to connect their own Google Search Console, Google Analytics, Ahrefs, or Semrush account, RankCause reads data from that account using the access the Customer grants, to power the corresponding dashboard. RankCause does not maintain an independent relationship with those providers on the Customer's behalf for this purpose, but Personal Data may still flow through them as part of that connection. Outbound webhook integrations the Customer configures (e.g. Slack, Discord, Zapier, or a custom URL) send data to a destination the Customer chooses and controls, and are not RankCause sub-processors.

When a new sub-processor is added, RankCause will update this page at least 14 days before the change takes effect. Customers who object may terminate the affected subscription for a pro-rated refund of the unused period.

6. Security

RankCause maintains appropriate technical and organisational measures including: encryption in transit (TLS); encryption at rest of stored OAuth tokens, CMS credentials, and other connected- account secrets (Fernet: AES-128-CBC + HMAC-SHA-256); role-based access control; audit logs for privileged actions; unique per-customer API tokens; least-privilege IAM on infrastructure; automated dependency-vulnerability scanning and secret scanning on every change; and documented incident response.

7. International transfers

Where Personal Data is transferred outside the EEA / UK, RankCause relies on the EU Standard Contractual Clauses (SCCs) and, for UK transfers, the UK Addendum. A copy of the executed SCCs is available on request at {{FACT_PENDING}}.

8. Data subject requests

RankCause will assist the Customer in responding to Data Subject requests (access, deletion, portability, objection, rectification) within the timeframes required by applicable law. Most requests can be serviced directly from the in-app account settings.

9. Breach notification

RankCause will notify affected Customers of a Personal Data breach without undue delay and in any event within 48 hours of becoming aware of it, via the account email on file, including the nature of the breach, categories and approximate numbers of affected Data Subjects, likely consequences, and measures taken.

10. Audit

Upon reasonable prior notice, RankCause will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. RankCause does not currently hold a SOC 2 or other third-party security certification; if that changes, the relevant report will be made available here. On-site audits are subject to a confidentiality agreement and a commercially reasonable fee.

11. Deletion or return of data

On termination or a verified deletion request, RankCause immediately scrubs personally- identifying fields from the Customer's account and deactivates it, and revokes connected OAuth/API credentials. Removal of the remaining Personal Data is targeted within 30 days, unless a longer retention is required by law. The Customer may export account data from the in-app export tool before termination.

12. Term

This DPA remains in force for the duration of the Customer’s subscription and any period in which RankCause processes Personal Data on the Customer’s behalf thereafter.

13. Governing law

This DPA is governed by the law of {{FACT_PENDING}} (matching the Master Service Agreement / Terms of Service).