Data Processing Agreement

1. Subject matter, parties and term

(1) This agreement governs the processing of personal data by growResonance, owner Lucas Würms, Lindenstraße 15, 88699 Frickingen (hereinafter “Processor”), on behalf of the customer (hereinafter “Controller”) under Art. 28 GDPR. It is an annex to the Terms of Service and is concluded upon their acceptance.

(2) The agreement applies as long as the Processor processes personal data on behalf of the Controller, i.e. for the term of the main contract (including the trial) and beyond that until the data has been deleted or returned under section 9.

(3) In the event of conflicts, this agreement takes precedence over the Terms of Service in matters of data protection.

2. Nature and purpose, data and data subjects

(1) The Processor operates the growResonance platform (measurement and analysis of the visibility of brands in AI answers, website audits, texts, reports, AI assistant, integrations, attribution of inquiries to their origin) and in doing so processes the data that the Controller enters, uploads or connects. Nature of the processing: collection, storage, organization, analysis, transmission to AI services and subprocessors, provision, deletion. The sole purpose is the provision of the agreed services.

(2) Types of personal data, insofar as they occur:

• names, email addresses and roles of team members within the workspaces;
• names and contact details of end clients and their contact persons, recipients of reports and share links;
• personal information in prompts, brand descriptions, competitor lists, documents, uploaded images and messages to the AI assistant;
• data from connected services, in particular Google Search Console and Google Analytics 4 (aggregated values and, per inquiry, source, medium and landing page);
• data from form submissions that the Controller connects: answer to the question about the origin, value, inquiry ID, form name and time of receipt, as well as a non-reversible identifier calculated from the email address; other content of the submission is discarded after receipt;
• usage and log data relating to this content.

(3) Categories of data subjects: employees and agents of the Controller, its customers and their contact persons, recipients of reports, visitors to the Controller’s websites who submit a connected form, and persons who appear in the Controller’s content.

(4) Special categories of personal data (Art. 9 GDPR) are not the subject of the processing; the Controller does not enter them (§ 9(3) of the Terms of Service).

(5) This agreement does not cover data that the Processor processes for its own purposes as a controller, in particular for account and sign-in, billing, security and abuse prevention and communication with the customer (see Privacy Policy), nor anonymized aggregate data under § 11(4) of the Terms of Service.

(6) If the Controller connects forms or uses the code snippet for the origin per inquiry, it is responsible for the lawfulness of the collection on its website and of the transmission to the Processor. It informs the data subjects and obtains any required consents, in particular under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) for Google Analytics. By mapping the fields, it determines which information is stored; it does not transmit data under paragraph 4.

3. Instructions

(1) The Processor processes the data only on documented instructions from the Controller, unless it is required to do so by Union or Member State law; in such a case, it informs the Controller of that legal requirement before processing, unless that law prohibits such information.

(2) The instructions result from the Terms of Service, this agreement and the Controller’s use of the features of the platform. The Controller issues further instructions in text form.

(3) If the Processor considers an instruction to be unlawful, it informs the Controller without undue delay and may suspend its execution until the matter has been clarified.

4. Obligations of the Processor

(1) The Processor ensures that all persons who have access to the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

(2) It takes the technical and organizational measures under Art. 32 GDPR that are described in Annex 1. It may adapt them to the state of the art provided that the level of protection does not decrease.

(3) It assists the Controller to a reasonable extent in complying with the obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and consultations of the supervisory authority.

(4) The Processor is currently not required to appoint a data protection officer under Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG). The contact person for data protection is Lucas Würms, home@growresonance.ai.

5. Subprocessors

(1) The Controller grants general authorization to engage the subprocessors listed in Annex 2.

(2) The Processor informs the Controller in text form at least four weeks in advance of any intended addition or replacement of a subprocessor. If a subprocessor has to be replaced at short notice due to an outage or for security reasons, it informs the Controller without undue delay.

(3) The Controller may object to the change in text form within 14 days of receipt of the information for an important reason under data protection law. If the parties do not find a solution, both may terminate the main contract with effect from the date of the change.

(4) The Processor contractually obliges each subprocessor to data protection obligations that essentially correspond to those of this agreement. It is liable to the Controller for compliance with these obligations by its subprocessors.

6. Transfers to third countries

Processing outside the EU and the EEA only takes place if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (such as the EU-U.S. Data Privacy Framework) or of the standard contractual clauses of the European Commission. Annex 2 states which basis applies to which subprocessor.

7. Rights of data subjects

The Processor assists the Controller with appropriate measures in responding to requests from data subjects under Chapter III GDPR. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay, provided that it can identify the Controller.

8. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay, where possible within 48 hours after becoming aware of it. The notification contains the information under Art. 33(3) GDPR insofar as it is available; the Processor provides missing information subsequently. It takes the measures necessary to contain the breach and assists the Controller with the Controller’s notification and communication obligations.

9. Deletion and return

(1) After the end of the services, the Processor deletes the data or returns it, at the Controller’s choice, unless there is an obligation to store it. § 18 of the Terms of Service applies to export, retention in read-only access and deletion.

(2) If the Controller deletes data or its account in the platform, the data is removed from the live system. Copies in backups are overwritten when the backups expire in the regular course.

10. Evidence and audits

(1) Upon request, the Processor makes available to the Controller the information necessary to demonstrate compliance with this agreement, in particular the data processing agreements with the subprocessors.

(2) It enables audits, including inspections, by the Controller or by an auditor mandated by the Controller who is bound to confidentiality and is not a competitor of the Processor. On-site audits must be announced with at least four weeks’ notice, take place during normal business hours, must not disrupt operations disproportionately and, except after a breach under section 8 or on the order of a supervisory authority, are permitted at most once a year. The Controller bears their costs.

11. Liability and final provisions

(1) Art. 82 GDPR applies to liability towards data subjects. As between the parties, the liability provisions of the Terms of Service (§ 15) apply.

(2) Amendments to this agreement require text form; § 19 of the Terms of Service applies accordingly to amendments by the Processor. If individual provisions are invalid, the remainder of the agreement remains valid. German law applies.

Annex 1: Technical and organizational measures

• Hosting in the EU: Database, sign-in and file storage at Supabase in Frankfurt am Main; the server functions of the application run at Vercel in Frankfurt am Main. The hosting provider encrypts the stored data.
• Encrypted transmission: All connections run via HTTPS (TLS); HSTS requires the browser to use encrypted connections. A Content Security Policy restricts from where scripts and content may be loaded.
• Access control: Sign-in with a personal account and password (at least eight characters, stored only as a hash); roles per organization (owner, administrator, member); access to the internal administration area separate from the customer area.
• Separation of tenants: Customer data is assigned to a workspace or account; access rules in the database (Row-Level Security) only admit the authorized users.
• Keys and pseudonymization: API, MCP and webhook keys are stored only as a non-reversible hash and can be revoked or regenerated at any time. Access keys for Google services (Search Console, Analytics) are stored in encrypted form. Email addresses from form submissions are stored only as a non-reversible identifier that differs per workspace. IP addresses in consent and inquiry logs are stored only as a salted hash.
• Data minimization towards AI services: Only the content required for the respective feature is sent to language models; text vectors are calculated without a workspace identifier.
• Availability: Backups by the database provider; error monitoring of the servers (Sentry, EU, without IP addresses); retries of failed background processes.
• Deletion: Automatic deletion after fixed periods (e.g. inquiries from the free check, consent logs, inquiries from connected forms after 24 months) and account deletion by the customer in the account settings. Of form submissions, only the mapped fields are stored.
• Organization: Access to customer data only by the owner and only insofar as necessary for operation and support; review of these measures in the event of material changes to the platform.

Annex 2: Subprocessors

Last updated: Oct 27, 2026

• Supabase Inc. (USA): Database, sign-in, file storage.
  Data: All account, workspace and usage data, uploaded files, sign-in data. Place of processing: EU (Frankfurt am Main). Legal basis: Data processing agreement; EU standard contractual clauses (Module 2) for any access from the USA.
• Vercel Inc. (USA): Hosting of the website and the application; with consent, audience measurement (Web Analytics) and load time measurement (Speed Insights).
  Data: Connection data (IP address, time, page accessed, browser), content of requests to the application. Place of processing: EU (Frankfurt am Main) for server functions; worldwide network for delivering static files. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Stripe Payments Europe Ltd. (Ireland): Payment processing, invoices, subscriptions.
  Data: Name, email address, billing address, VAT ID, payment data, contract data. Place of processing: EU; additionally Stripe, Inc. (USA). Legal basis: Data processing agreement (Stripe Data Processing Agreement); EU standard contractual clauses for US components.
• Anthropic PBC (USA): Language model Claude: analysis of the answers, Prompt Research, articles and content optimization, AI assistant and free visibility check.
  Data: Prompts, brand names, competitors, page and article content, messages to the AI assistant with workspace context. Place of processing: USA. Legal basis: Data processing agreement (Commercial Terms); EU standard contractual clauses (Module 2); certified under the EU-U.S. Data Privacy Framework.
• OpenAI (USA): Language model (ChatGPT) via the API: free visibility check; technical fallback for the visibility measurement.
  Data: Prompts and brand names; with batch processing, the requests are stored temporarily at OpenAI until they are evaluated. Place of processing: USA. Legal basis: Data processing agreement (Business Terms); EU standard contractual clauses (Module 2); certified under the EU-U.S. Data Privacy Framework.
• Google Cloud EMEA Limited (Vertex AI) (Ireland): Language model Gemini via the API: free visibility check; technical fallback for the visibility measurement.
  Data: Prompts and brand names. Place of processing: EU (region europe-west4, Netherlands). Legal basis: Google Cloud Data Processing Addendum.
• Google Ireland Limited / Google LLC (Ireland / USA): Google Search Console and Google Analytics 4 (only if you connect them), Sign in with Google (where offered), PageSpeed Insights for the Technical Audit, retrieval of website icons (favicons) for domains.
  Data: Search Console data of your website, aggregated Google Analytics data and the origin of individual inquiries (retrieved via inquiry IDs), Google account ID and email address when signing in, URLs of the checked pages, domain names. Place of processing: EU and USA. Legal basis: Data processing agreement or Google's data protection terms; EU standard contractual clauses (Module 2); Google LLC is certified under the EU-U.S. Data Privacy Framework.
• DataForSEO OÜ (Estonia): Search engine data: Google results and keyword data, answers from ChatGPT, Gemini and Google AI Mode via their public user interfaces for the visibility measurement, Google AI Mode for the free visibility check, Google top 10 for articles.
  Data: Search terms, prompts, article topics, domains, cities and markets; personal data only if you enter such data in prompts yourself. Place of processing: EU (Estonia); the company also names a location in Ukraine. Legal basis: Data processing agreement (DataForSEO Data Processing Agreement).
• Voyage AI (USA): Calculation of text vectors (embeddings) for keyword groups, internal linking, Content Audit and Prompt Research.
  Data: Search terms, page titles and short text excerpts of crawled pages, article sections, prompt suggestions; without workspace identifier. Place of processing: USA. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Inngest Inc. (USA): Orchestration of background processes (measurement runs, audits, reports, email delivery).
  Data: Identifiers of accounts, workspaces and jobs, domains, URLs, prompts and intermediate results of the processes. Place of processing: USA. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Resend Inc. (USA): Sending of emails: sign-in, invitations, trial and billing notices, reports (also to recipients you name), results of the visibility check, inquiries.
  Data: Email addresses, names, content and attachments of the emails. Place of processing: EU region for sending; provider based in the USA. Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Functional Software, Inc. (Sentry) (USA): Error monitoring of the servers.
  Data: Error messages with technical details, account and workspace identifiers; no IP addresses. Place of processing: EU (Frankfurt am Main). Legal basis: Data processing agreement; EU standard contractual clauses (Module 2).
• Frosthaus GmbH (Friendly Captcha) (Germany): Protection of the free visibility check against abuse, if enabled.
  Data: Technical characteristics of the request for the verification puzzle; the script is loaded via the jsDelivr network. Place of processing: EU. Legal basis: Data processing agreement.