Data Processing Agreement

Customers who process personal data through the product will need a Data Processing Agreement (DPA). A signed version is available on request and is finalised as part of onboarding.

The services that process data for BrandWater AI are listed under Sub-processors below, and we update that list when it changes.

• Roles of the customer and BrandWater AI, and the purposes of processing.
• The types of data and the people it relates to.
• Security measures and confidentiality.
• Use of sub-processors and how customers are told about changes.
• Assistance with data subject requests.
• Notification of personal data incidents.
• Return or deletion of data at the end of the service.

These services process data on our behalf today.

• Supabase: Accounts, sign in and the product database. Data involved: Account details, workspace and brand records.
• Resend: Sending email from this website's contact form and account emails. Data involved: Name, email address and the message you send.
• Upstash: Rate limiting, to protect the site and the product from abuse. Data involved: A short-lived counter tied to a network address.
• Google: Analysing public website text to draft Brand Intelligence (Gemini), and website analytics only if enabled and you allow it. Data involved: Public website content; anonymised visit data if you opt in.
• DataForSEO: Observing what Google's AI Overview and AI Mode search surfaces show for your tracked prompts. Data involved: The prompt text and the public search results it returns.

We will update this list before we add a service that processes customer personal data.

Email hello@brandwaterai.in with the subject line DPA request and your organisation name.