Data Processing Agreement
Last updated: October 11, 2026
This Data Processing Agreement ("DPA") is part of the Arrowsterr Terms of Service between the customer ("Customer") and Arrowsterr ("Arrowsterr"). It applies when Arrowsterr processes personal data for the Customer under the GDPR, UK GDPR, Swiss data protection law, or US state privacy laws.
1. Roles
The Customer is the controller. Arrowsterr is the processor. Arrowsterr processes personal data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use of the app are those instructions.
2. What is processed
| Subject matter | Running the Arrowsterr service |
| Duration | While the Customer has an account, plus the deletion periods below |
| Purpose | AI visibility tracking, SEO research, content tools, website analytics and reports |
| Data subjects | The Customer's team members; visitors to the Customer's websites (if the tracking script is installed); people named in content the Customer adds |
| Types of data | Names, email addresses, IP-derived country, device and browser type, page views, referrers, click events, and any personal data in Customer content |
| Sensitive data | None. The Customer agrees not to add special category data. |
3. Arrowsterr's duties
Arrowsterr will:
- process personal data only on the Customer's instructions, and tell the Customer if it thinks an instruction breaks the law;
- make sure everyone with access is bound by confidentiality;
- keep the security measures in section 6;
- help the Customer answer data subject requests, using the app's tools or on request;
- help the Customer with security, breach notices, impact assessments and talks with authorities, where they relate to Arrowsterr's processing;
- tell the Customer without undue delay, and within 72 hours, after it becomes aware of a personal data breach, with the details it has;
- delete or return personal data when the service ends, as set out in section 8;
- give the Customer the information needed to show compliance with this DPA, and allow audits as set out in section 9.
4. Sub-processors
The Customer gives general approval for Arrowsterr to use sub-processors. The current list:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database and sign-in | – |
| Render | App hosting | – |
| Stripe | Payments | United States |
| Anthropic | AI processing | United States |
| OpenAI | AI processing | United States |
| AI processing, Google Analytics API | United States | |
| Perplexity | AI processing | United States |
| DataForSEO | Search and AI answer data | – |
| Umami | Website analytics | – |
| Sentry | Error monitoring | – |
| Resend | Service emails | – |
Arrowsterr will give at least 30 days' notice before adding or replacing a sub-processor, by email or on this page. The Customer may object on reasonable data protection grounds. If the two sides cannot agree, the Customer may cancel and get a refund of prepaid fees for the unused period. Arrowsterr binds each sub-processor to data protection terms at least as strong as this DPA, and stays responsible for them.
5. International transfers
Where personal data moves from the EU, EEA, UK or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where relevant) apply and are made part of this DPA by reference, with the UK International Data Transfer Addendum for UK data.
6. Security measures
- Encryption in transit (TLS) and at rest.
- Connected-account tokens encrypted again at the app level (AES-GCM).
- Row-level access rules so each workspace sees only its own data.
- Role-based access for Customer team members (owner, admin, editor, viewer).
- Staff access limited to people who need it, with multi-factor sign-in.
- Daily backups, error monitoring and logging.
- The tracking script sets no cookies, does not read form contents, and does not store full IP addresses.
7. Customer duties
The Customer is responsible for having a legal basis for the processing, giving its website visitors the notices and choices its laws require, and not adding sensitive data.
8. Deletion
When the Customer deletes a workspace or account, Arrowsterr deletes its personal data within 30 days, and from backups within a further 30 days, unless the law requires it to be kept. The Customer can export its data before deleting.
9. Audits
Arrowsterr will answer reasonable written security questions once a year. If the Customer needs more to meet a legal duty, it may run an audit, at its own cost, with 30 days' notice, during business hours, and under confidentiality.
10. US state privacy laws
For CCPA and similar laws, Arrowsterr is a "service provider" or "processor". It will not sell or share personal data, use it outside the direct business relationship, or combine it with other data, except as those laws allow.
11. Order of terms
If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses conflict with this DPA, the clauses win.
Contact for data protection questions: privacy@arrowsterr.com.