Data Processing Agreement

Effective June 28, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between PurelySearch LLC ("Processor," "we") and the customer ("Controller," "you") for use of Pickrate (the "Service"). It applies where we process personal data on your behalf and you require a DPA to meet your obligations under the GDPR, UK GDPR, CCPA, or similar laws. If you need a countersigned copy, email privacy@pickrate.io.

1. Roles

For personal data contained in your Service content — including the Agent Attribution events you send us about your end users — you are the Controller and we are the Processor. We process that data only to provide the Service and on your documented instructions (which the agreement, your use of the Service, and your configuration choices such as a webhook destination constitute), unless required otherwise by law.

As Controller, you are responsible for having a lawful basis to collect and send us the attribution data, for providing your end users any required privacy notices, and for obtaining any consents needed — including for the first-party cookie our optional browser helper sets on your site. You are responsible for the security and lawfulness of any webhook endpoint you designate.

2. Scope of processing

• Subject matter — providing the Pickrate Service.
• Duration — the term of your agreement, plus any legally required retention.
• Nature and purpose — hosting, storing, and processing your inputs to run evaluations and return results; account and billing operations; and, for Agent Attribution, ingesting and storing the events you send, resolving them into attribution, making the results available to you, and delivering them to any webhook endpoint you designate.
• Types of data — account identifiers (email), billing identifiers, the content you submit (prompts, competitor lists, configurations) and results, and — for Agent Attribution — visitor identifiers, a hashed email or opaque user reference, conversion events (type, value, timestamp), and touch signals (such as referrer, source tag, or AI agent). Raw email addresses are hashed on receipt and not stored.
• Data subjects — your authorized users, any individuals referenced in the content you submit, and — for Agent Attribution — your website visitors and end users.

3. Our obligations

• Process personal data only on your documented instructions.
• Ensure people authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Trust & Security), including encryption in transit and at rest and least-privilege access.
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification, and impact-assessment obligations.
• Notify you without undue delay after becoming aware of a personal-data breach affecting your data.
• On termination, delete or return personal data, except where retention is required by law.

4. Sub-processors

You authorize us to engage the sub-processors listed below to process personal data. The current list also appears on our Trust & Security page. We will update this list and aim to notify you before a new sub-processor that handles personal data takes effect, so you have the opportunity to object on reasonable grounds. We remain responsible for our sub-processors' performance.

5. International transfers

We and our sub-processors primarily process data in the United States. Where personal data is transferred from the EEA, UK, or Switzerland, the parties will rely on a lawful transfer mechanism (such as the EU Standard Contractual Clauses), incorporated by reference where applicable.

6. Audits

On reasonable written request, and subject to confidentiality, we will make available information necessary to demonstrate compliance with this DPA. Where we hold third-party audit reports or certifications in the future, providing those will satisfy this obligation.

7. Liability and precedence

This DPA is subject to the limitation of liability in our Terms of Service. If there is a conflict between this DPA and the Terms on the processing of personal data, this DPA controls.

8. Contact

PurelySearch LLC — privacy@pickrate.io