Data Processing Agreement (DPA)

For personal data you submit or that we process to provide the Service to you (your account staff, your brand data), you are the controller and Ozvor is the processor. For our own operational data (e.g. billing relationship), Ozvor is an independent controller as described in the Privacy Policy.

We process personal data only to provide the Service: running GEO audits, computing the Ozvor AI Visibility Score, benchmarking competitors, generating plans and drafts, monitoring, billing, and support. By design, audit prompts are synthetic and contain no personal data; competitor names are never sent to AI providers.

Duration: for the term of your subscription plus the retention periods in the Privacy Policy. Data subjects: your authorised staff/users. Categories: business contact data (name, email), account/role identifiers, brand and domain data, and configuration. We do not intend to process special-category data and ask that you not submit it.

• Process personal data only on your documented instructions (these Terms and your use of the Service);
• Ensure persons authorised to process are bound by confidentiality;
• Implement appropriate technical and organisational measures (Section 6);
• Assist you, taking into account the nature of processing, with data-subject requests and with your obligations on security, breach notification, and DPIAs;
• At your choice, delete or return personal data at the end of services, save where retention is required by law;
• Make available information needed to demonstrate compliance and allow for audits (Section 7).

You authorise us to engage the sub-processors listed in our Privacy Policy §4 (Supabase, Anthropic, OpenAI, Google, Perplexity [US only], DataForSEO/SerpAPI, Stripe, Resend, Railway, Cloudflare). We impose data-protection obligations on each by contract and remain responsible for their performance. We will give advance notice of new sub-processors and a reasonable opportunity to object.

We maintain: multi-tenant isolation via forced row-level security; encryption in transit (TLS) and at rest; AES-256-GCM encryption of stored API keys; append-only audit logging; least-privilege access; SSRF-hardened outbound fetching; prompt-injection sanitisation; and no-training AI inference per provider API terms. Measures are reviewed and may be updated provided protection is not materially reduced.

On reasonable request and subject to confidentiality, we will provide information to demonstrate compliance with this DPA and support audits no more than once per year (or as required by a supervisory authority), via documentation and questionnaires where sufficient.

Where processing involves transfers outside the EEA/UK or Brazil, we rely on EU-hosted inference paths, Standard Contractual Clauses, and/or Data Privacy Framework certification, as described in the Privacy Policy. EU users’ inference is routed to EU-hosted providers and Perplexity is excluded for EU users until safeguards are confirmed.

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you reasonably need to meet your notification duties (including, where applicable, ANPD/supervisory-authority timelines).

This DPA is governed by the Terms of Service and the laws of Brazil. In case of conflict on data-protection matters, this DPA prevails over the Terms. Liability is subject to the limitations in the Terms. Contact: dpo@ozvor.com.