Data processing agreement
This agreement applies whenever you use Lala SEO to audit a site on behalf of someone else — a client, an employer, or any other third party. You are the controller of the personal data involved and we are the processor. It forms part of our terms of service and needs no signature: using the service on someone else's behalf accepts it.
If you only ever audit your own site, you are the controller of your own data and this document changes nothing for you. The privacy policy is the one to read.
1. What we process, and why
| Parties | Controller: you, the account holder who starts the audit. Processor: Eshariom, operating from Ontario, Canada. |
|---|---|
| Subject matter | Crawling a website you nominate and producing a technical SEO report about it. |
| Duration | For as long as your account exists. Deleting the account deletes the data. |
| Nature and purpose | Automated retrieval of publicly reachable pages, analysis against a fixed rule set, and storage of the resulting report. |
| Categories of data subject | You, as the account holder. Any individual whose personal data happens to appear in the public HTML of a page we crawl — for example an author byline or a contact address. |
| Categories of personal data | Your name, email address and the IP that started an audit. From crawled pages: page URLs, titles, headings, word counts and response timings, plus whatever text those pages happen to contain. |
| Special category data | We do not ask for any, and no rule looks for any. We cannot prevent a crawled page from containing it. |
2. Our obligations
- We process personal data only on your documented instructions. Starting an audit is the instruction; the rule set is its scope. We do not process it for any other purpose, and we do not sell, rent or share it.
- Everyone with access is bound by confidentiality. Today that is one person: the owner of the business.
- We assist you in responding to a data subject's request. In practice most of it needs no request to us at all — export, correction and deletion are self-service on the account page.
- We tell you about a personal data breach affecting your data without undue delay and within 72 hours of becoming aware of it, with what we know at the time rather than waiting for a complete picture.
- On termination we delete the data. Deleting your account deletes your audits with it, immediately and for good — there is no recovery window, so export first if you want a copy.
3. Security measures
What is actually in place, rather than a catalogue of intentions. Each of these is verifiable on the live service:
- All traffic is served over TLS, and plain HTTP is redirected rather than accepted.
- Passwords are stored as bcrypt hashes. We never hold them in a readable form, and we cannot tell you your password.
- A Content-Security-Policy restricts the page to scripts and styles we serve ourselves.
- The crawler refuses internal addresses and non-standard ports, so it cannot be pointed at a private network.
- Audits are rate limited per IP address.
- The IP that started an audit is erased after 90 days by a nightly job.
- Credentials are held as platform secrets, not in the source tree.
- The database is snapshotted daily and the snapshot is integrity-checked, with a rehearsed restore procedure.
We do not claim ISO 27001, SOC 2, or any other certification. We have not been audited against one. If your client requires a certified processor, we are not it yet.
4. Subprocessors
You consent to the following subprocessors. We will give notice before adding one, so that you can object.
| Who | What for | Where |
|---|---|---|
| Fly.io | Hosting, application database | United States |
| Anthropic | Writing the plain-English explanation of a finding | United States |
| Resend | Transactional email | United States |
| DataForSEO | Search data for paid plans: rankings, backlinks, competitors, brand and AI mentions | Estonia (European Union) |
| Creem | Taking payment and sales tax for paid plans. Creem is the seller named on the receipt. | United States / EU |
| Website analytics for lalaseo.com, only for visitors who consent | United States | |
| Google (PageSpeed Insights) | Optional page-speed measurements, only when the option is ticked on an audit | United States |
| Zoho | Our support inbox — email you send us and our reply | Canada |
Anthropic receives finding codes and example URLs from the audited site. It does not receive your email address, your password, or your account record. Google's PageSpeed service receives only the address of the page being measured.
Creem receives the account holder's email address and a reference to their account from us when a payment is started, and the name, country and card details the account holder enters on Creem's own payment page. It receives nothing from a crawled site.
5. International transfers
Your data is stored in the United States. The service runs in Fly.io's
iad region in Virginia, and every subprocessor above is US-based except
our support inbox, which is held in Canada. If you are
in the UK, the EEA or Switzerland, that is a transfer out of your jurisdiction, made under
the European Commission's Standard Contractual Clauses (Module Two, controller to
processor) together with the UK Addendum where the UK GDPR applies. Those clauses are
incorporated here by reference and prevail over anything in this document that conflicts
with them.
We do not currently offer EU or UK data residency. If your client's policy requires the data to stay in region, say so before you audit their site.
6. Audits and inspections
You may ask us, once in any twelve months, for the information needed to show we are meeting this agreement, and we will answer in writing within 30 days. We are a one-person business, so we do not host on-site inspections; where your own obligations genuinely require more than a written answer, write to us and we will work out what is proportionate.
7. Liability and law
The limitations of liability in our terms of service apply to this agreement too. It is governed by the law of Ontario, Canada, except where the Standard Contractual Clauses require otherwise for a transfer, in which case they govern that transfer.
8. Getting in touch
Questions about this agreement, a data subject request you need help with, or notice of a problem: support@lalaseo.com. There is no separate data protection officer — we are not required to appoint one, and pretending otherwise would just add a name that routes to the same inbox.