Legal

Data processing agreement (DPA)

This agreement under Art. 28 GDPR (German: Auftragsverarbeitungsvertrag, AVV) applies when HUNTR processes personal data on behalf of a customer. It is part of the terms of service and accepted with them. Draft: to be reviewed by counsel before launch.

Last updated

1. Parties and roles

Controller: the customer (brand or agency). Processor: Sirat Studios Dijital Sanayi ve Ticaret Limited Şirketi, Yavuz Sultan Mah., Rıhtım Cad. No:42, Kat:1 Daire:1, 60 Evler – Derince, 41940 İzmit/Kocaeli, Türkiye (the operator named in the imprint). Agencies that add client stores act as processors for their clients; this agreement then applies as a sub-processing agreement.

2. Subject, nature and duration

Subject: providing the AI visibility service (collecting and analysing AI answers, store catalog import, attribution of AI-referred orders, reports, alerts, data chat). Duration: as long as the customer account exists, plus the deletion period below.

3. Types of data and data subjects

  • Users of the customer (name, email, role, login and audit data).
  • Client viewers invited by agencies (name, email).
  • If Shopify is connected: order identifiers, totals, currency, timestamps, referring site, landing page and UTM parameters. Customer names and addresses are not needed and not stored.
  • Free-scan leads are processed by us as controller, not under this agreement.

4. Instructions and confidentiality

We process data only on documented instructions of the customer (these terms, the settings in the app and support requests), unless EU or member state law requires otherwise. Persons authorised to process data are bound to confidentiality.

5. Technical and organisational measures

  • Encryption in transit (TLS) and of stored Shopify tokens (AES-GCM).
  • Passwords hashed with PBKDF2-SHA256 and per-user salt; sessions stored only as hashes.
  • Tenant isolation enforced in one data-access layer; read-only, tenant-scoped API keys and data chat.
  • Rate limiting, bot protection, audit log of security-relevant actions, least-privilege access.

6. Sub-processors

The customer agrees to the following sub-processors. We inform customers about intended changes in advance by email or in the app; the customer may object for good cause.

  • Cloudflare, Inc. (hosting, database, storage, queues, bot protection).
  • Paddle.com Market Limited (reseller and Merchant of Record for subscriptions; only billing contact data; acts as an independent controller for checkout, payment and tax data).
  • Resend (transactional email).
  • DataForSEO and cloro (collection of AI answers; prompts only, no personal data of the customer).
  • Anthropic, PBC (analysis of AI answers and the data chat).

7. Transfers outside the EU/EEA

Where sub-processors process data in third countries (notably the USA), transfers rely on the EU-US Data Privacy Framework for certified recipients or on the EU Standard Contractual Clauses.

8. Assistance, breaches and audits

We assist the customer with data subject requests and data protection impact assessments as far as reasonable, notify personal data breaches without undue delay, and provide the information needed to demonstrate compliance. Audits take place on reasonable notice, during business hours and without disclosing other customers' data.

9. Deletion and return

The customer can export data as CSV at any time and delete the account in the settings. On deletion we remove tenant data and stored raw answers without undue delay, except records we must keep by law.