Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Dot Aero (OPC) Private Limited (trading as Aero Business Solutions), operator of AeroSearchAI ("Processor"), and the customer ("Controller") that has accepted the Terms of Service. It governs the processing of personal data by the Processor on behalf of the Controller where the Controller is a business customer subject to the EU/UK GDPR.

2. Subject Matter & Duration

The Processor processes personal data only to provide the AeroSearchAI service to the Controller. Processing continues for as long as the Controller's account is active, and is governed by the data retention rules in our Privacy Policy.

3. Nature & Purpose of Processing

• Account creation, authentication and access control.
• Running SEO, GEO and AI-visibility audits on URLs provided by the Controller.
• Generating AI recommendations and storing audit history.
• Connecting to Google Search Console / Google Analytics on the Controller's behalf (read-only).
• Billing through our payment provider (Paddle, acting as Merchant of Record).
• Customer support and abuse prevention.

4. Categories of Data Subjects & Personal Data

Data subjects: the Controller's authorised users. Personal data: name, email, authentication identifiers, project configuration (URLs, industry), Google API metrics, support communications, usage logs, IP address and device identifiers.

5. Processor Obligations

• Process personal data only on documented instructions from the Controller.
• Ensure that staff authorised to process personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures (Section 9).
• Assist the Controller in responding to data-subject requests.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return all personal data after termination, subject to retention required by law.

6. Sub-processors

The Controller authorises the Processor to engage the following categories of sub-processors:

• Cloud hosting and managed database (Supabase, AWS).
• Payment processing and Merchant of Record (Paddle).
• Transactional email delivery.
• AI inference providers used to generate recommendations.
• Product analytics and error monitoring.

The Processor will notify the Controller of any intended change to sub-processors and gives the Controller the opportunity to object on reasonable grounds.

7. International Transfers

Where personal data is transferred outside the EEA/UK, transfers are made on the basis of the EU Standard Contractual Clauses (and UK IDTA where applicable) entered into with the relevant sub-processor.

8. Data-Subject Rights

The Controller can fulfil most data-subject rights directly from the application: authorised users can export their personal data and permanently delete their account from Settings → Account. The Processor will assist with any remaining requests within statutory deadlines.

9. Security Measures

• TLS in transit, AES-256 at rest.
• Row-level security enforced in the database.
• OAuth tokens stored server-side, never exposed to the client.
• Principle of least privilege for staff access; SSO + MFA on admin tooling.
• Regular dependency scans and code review.
• Backups encrypted and retention-controlled.

10. Audit Rights

The Processor will make available to the Controller, on reasonable request, the information necessary to demonstrate compliance with Article 28 GDPR, including third-party security certifications held by sub-processors.

11. Acceptance & Contact

By using AeroSearchAI as a business customer subject to the GDPR, the Controller accepts this DPA as binding. Questions or signed-DPA requests: privacy@aerobusinesssolutions.com.