Data Processing Agreement
Last updated August 14, 2026. This page is provided in English only. A legal agreement is the one document we will not machine-translate, because you would be signing a version neither of us can rely on.
Who is who
You are the controller of your clients’ data. NebulaSEO is your processor: we act on your instructions, which in practice are the settings you choose and the actions you take in the dashboard. Where your client is a business whose own customers leave reviews, you remain the controller of that too.
What we process, and why
Business listing details, review text and reviewer display names as Google publishes them, search-position data, the contact details you enter for a client, and the content our AI drafts for you. We process it to provide the service you are paying for and for nothing else. We do not sell it, we do not use your clients’ data to train models, and we do not use one customer’s data to serve another.
How long we keep it
For as long as the location is active on your account. Delete a location and its data goes with it. Close the account and everything goes. Backups roll off within 30 days. You can export your data at any time from the dashboard without asking us.
Your clients’ rights
If someone asks you to access, correct or delete their data, tell us at privacy@nebulaseo.com and we will help you answer within the time the law gives you. We will not respond to your client directly, because they are your client and not ours.
Security, and what happens if it goes wrong
Data is encrypted in transit and at rest. Access is limited to the people who need it. Sign-in is through Google, and multi-factor authentication is available on every account. If there is a breach affecting your data we will tell you without undue delay and within 72 hours of becoming aware, with what we know and what we are doing.
Where the data lives
The United States. If you are in the UK or the EU, that is an international transfer, and it is covered by the Standard Contractual Clauses. Ask us and we will send them signed.
Subprocessors
The other companies that touch your data, what each one does, and where they are. We will tell you before adding one. If a new subprocessor is not acceptable to you, you can leave and we will refund the unused part of the month.
| Company | Where | What it does for you |
|---|---|---|
| Vercel | United States | Hosting, edge network, file storage for uploaded images |
| Stripe | United States / Ireland | Card payments, subscriptions, agency payouts |
| United States | Business Profile, Places, sign-in, Search Console, Analytics | |
| Anthropic | United States | Generates post drafts, review replies and review insights |
| Telnyx | United States | Phone numbers, call tracking, the voice agent |
| Resend | United States | Transactional and agency-branded email delivery |
| Sentry | United States | Error monitoring |
| Upstash | United States | Rate limiting and short-lived cache |
| Cloudflare | United States | DNS for customer domains |
| DataForSEO | Cyprus | Search-position data for the rank grid |
| Perplexity | United States | AI-visibility checks, on a manual click only |
| Plaid | United States | Bank connection for referral payouts |
| Apple | United States | Push notifications to the iPhone app |
| Yelp | United States | Review data, where a location is connected |
| Jobber, Housecall Pro | Canada / United States | Job data, only if the customer connects them |
Signing it
Email privacy@nebulaseo.com and we will send this as a countersigned PDF, with the Standard Contractual Clauses attached, usually the same day. You do not need to be a customer yet to ask.
See also our privacy policy and terms of service.