This Data Processing Addendum ("DPA") supplements the RankBull Terms of Service. It says plainly who processes what — which, in a self-hosted product, is not the usual arrangement.
1. The split
The RankBull backend runs on a Convex deployment you own. Any personal data you put into it — your team, your clients, visitors to your websites, anything in your tracked prompts — is processed by you, on your infrastructure, with providers you contract with directly. For that data you are the controller, and we are not a processor of it: we have no access, no copy, and no ability to act on it. If a data subject asks about it, only you can answer.
Separately, we hold a small license record about you. For that data we are the controller, and this DPA describes how we handle it.
2. What we process
- License registry: your email, license key and tier, deployment address, encrypted Convex deploy key, and install history.
- Website and support data: request logs, free-tool inputs, analytics events, and anything you send us by email.
Full detail, including retention, is in our Privacy Policy.
3. Purpose and duration
We process that data only to sell and validate your license, install and update your deployment, route you to it, support you, and keep the service secure — for as long as your license exists, or until you ask us to delete the record.
4. Special category data
We do not ask for and do not intentionally process special category data. Keeping sensitive personal data out of tracking prompts and site content in your own deployment is your responsibility.
5. Sub-processors
See /legal/subprocessors. We give 30 days' notice before adding a sub-processor that touches the license registry. The AI, SEO, and CMS providers your deployment calls are yours, not ours, and are not covered here.
6. International transfers
Our website and license registry are hosted in the United States. EU/UK transfers of registry data rely on the European Commission's 2021 Standard Contractual Clauses, incorporated by reference, plus encryption in transit and at rest and the minimisation described above. Where your own deployment runs is set by your Convex account.
7. Security measures
See /trust.
8. Data subject rights
We answer access, rectification, deletion, restriction, and portability requests under Articles 15–22 GDPR for the data we hold. Requests about data in your deployment must be handled by you; we cannot assist technically because we cannot reach it.
9. Breach notification
If we discover a personal data breach affecting data we hold, we notify affected users without undue delay and in any case within 72 hours of discovery, with enough information to meet Article 33 obligations. A breach of your own deployment is yours to detect and report.
10. Deletion
Ask us and we delete your license record, with backups purged within 30 days. Note that deleting it ends sign-in through our interface. Data in your deployment is deleted by you, whenever you choose.
To execute this DPA on behalf of your organisation, email support@rankbull.iowith your signatory's details.