Data Processing Addendum

1. This addendum

This DPA forms part of the agreement between you (the Customer, controller) and the operator of huskyscout.net, trading as HuskyScout (HuskyScout, processor). If there is a conflict about data protection, this DPA controls. A registered legal entity is not yet in place; when one is named on the Terms, that entity is the processor.

The Privacy Policy at https://huskyscout.net/privacy describes website and account data we process as a controller. That processing is outside this DPA except where the same systems also hold Customer personal data.

Contact: [email protected].

2. Definitions and roles

Controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings in Article 4 GDPR (and the UK GDPR equivalent).

Customer personal data is personal data that we process in the service on your documented instructions: for example data about your site, your users that appears in crawled pages or Search Console rows, credentials you store so we can publish, and the content we generate for you.

You are the controller of Customer personal data. We are the processor. We will not determine the purposes of that processing except as this DPA and the product documentation allow.

3. Customer instructions

You instruct us to process Customer personal data in order to provide HuskyScout as configured in your workspace: crawling domains you submit, probing answer engines, running insights, generating and publishing articles, connecting Google Search Console and a CMS, and the related storage, logging and support.

You warrant that you have a lawful basis to submit that data to us, including a basis to crawl sites you do not own only when you are authorized to assess them, and that our processing of public web pages on your instruction will not violate the rights of others.

We will tell you if, in our opinion, an instruction infringes GDPR, unless the law forbids that notice. We may refuse an infringing instruction.

4. Nature, purpose and duration

Nature: collection, storage, retrieval, analysis, generation, transmission to subprocessors and CMS destinations you choose, and deletion.

Purpose: supplying the HuskyScout product described in the Terms.

Duration: the term of your use of the service, plus the deletion window in section 11.

5. Types of data and data subjects

Types of Customer personal data we may process, depending on what you submit and which integrations you enable:

• Identifiers: domain names, URLs, email addresses you enter, account names on connected CMSs.
• Professional and web content: page text, metadata, structured data, search queries and page metrics from Search Console, generated articles.
• Credentials: API keys, application passwords, OAuth refresh tokens, webhook secrets, stored so we can act on your instructions.
• Technical: timestamps, job identifiers, publish results, and IP addresses observed while serving your requests.

Data subjects: you and your personnel; authors and other people identified on the sites you ask us to crawl; search users only to the extent Search Console reports include query strings that happen to be personal; readers of your published content. We do not need special-category data to run the product and you agree not to send it to us on purpose.

6. Confidentiality and security

We will ensure people authorized to process Customer personal data are under a confidentiality obligation.

Taking into account the state of the art, the costs of implementation, and the nature of the data (mostly public web content plus credentials), we implement appropriate technical and organizational measures: HTTPS in transit, network isolation on the Girder/Hetzner host, access limited to operators of the service, encryption of CMS and GSC secrets at rest when CREDENTIAL_KEY is configured, and rate limits on public endpoints.

You are responsible for using a production environment with CREDENTIAL_KEY set before connecting a real CMS or Search Console property, and for reviewing generated content before a live publish.

7. Subprocessors

You authorize us to use the named subprocessors listed below (and in the Privacy Policy) to process Customer personal data for the purposes stated. You also authorize us to use replacements or additions in the same categories, provided we update the public list before they process Customer personal data and you have 14 days to object by emailing support. An objection that we cannot reasonably accommodate may mean you need to stop using the affected feature or the service.

We will impose data-protection terms on subprocessors that are no less protective of Customer personal data than this DPA, and we remain responsible to you for their performance.

No email vendor is live yet. When we start sending product email (waitlist invites, alerts, report delivery), the provider will be Resend (Resend, Inc., United States) or SMTP through the Girder host. The live choice will be named in this list before the first message is sent.

8. International transfers

Where a subprocessor processes Customer personal data outside the EEA or UK, we will ensure a valid transfer mechanism is in place, typically the Standard Contractual Clauses the subprocessor offers, with the UK addendum where required.

You instruct us to make those transfers as needed to provide the service (in particular OpenRouter, search-data vendors, Stripe, Google and IndexNow).

9. Assistance

Taking into account the nature of the processing, we will assist you with data-subject requests, data-protection impact assessments, and consultations with supervisory authorities, by providing the information we hold and the controls already in the product (disconnecting integrations, deleting a site, exporting report data where the API allows).

If a data subject contacts us directly about Customer personal data, we will point them at you where we can identify the Customer, unless the law requires us to respond ourselves.

10. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer personal data, with the facts we know: what happened, which data and subjects are involved, likely consequences, and the measures taken or proposed. We will update you as we learn more.

You are responsible for notifying data subjects and supervisory authorities when the law puts that duty on the controller.

11. Return and deletion

When you disconnect an integration, we stop using those credentials. When you delete a site or account, or when the agreement ends, we will delete Customer personal data within 30 days, except (a) data that has been published to a CMS or search engine you instructed us to notify, which those third parties then control, and (b) copies we must retain under law or for the establishment, exercise or defense of legal claims, kept only as long as needed.

Backups of the Postgres volume rotate on the host's normal cycle after deletion.

12. Audits

Upon reasonable written request, no more than once per year unless a supervisory authority or a confirmed breach requires more, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including this public document, the current subprocessor list, and a written summary of security measures.

If that is not enough for your legal obligation, you may appoint an independent auditor bound by confidentiality, at your cost, with 30 days' notice, during normal business hours, without disrupting the service. We may object to an auditor that is a competitor.

13. Liability and term

Liability under this DPA is subject to the limitations in the Terms, except that nothing in this DPA limits either party's liability to data subjects that cannot be limited under GDPR.

This DPA lasts for as long as we process Customer personal data. Sections that by nature should survive (including deletion, confidentiality and liability) survive.

14. Contact

Processor contact for this DPA: [email protected].

Related documents: Terms of Service (https://huskyscout.net/terms) and Privacy Policy (https://huskyscout.net/privacy).