Data Processing Agreement

1. Scope and roles

When we handle business data to deliver the services in your service agreement — Google Business Profile management, local SEO, website design and hosting, business-listing submission and monitoring, review management, lead capture, reporting and the Page One client portal — Page One Insights acts as a service provider / processor and you, the client, decide the purposes and means (you are the business / controller). For our own account, billing and marketing records we act as a controller, as described in the Privacy Policy.

This DPA applies to every client with an active service agreement. It forms part of that agreement; where the two conflict, the service agreement controls for the services it describes.

2. Types of data we process

2.1 Business information

Business name, address, phone, email, website, categories, hours, service areas, service descriptions, branding and the content you ask us to publish. Used to maintain your listings, website and reports.

2.2 Google API data

When a Google account is connected through OAuth we process the data that connection allows: Business Profile listing details, posts, photos, reviews and replies and performance insights; Search Console queries, impressions, clicks and positions; and Google Analytics traffic reports for websites we build. The exact permissions are listed on the Google API Services page.

2.3 Leads and customers of your business

Names, contact details, messages, photos and files submitted by your prospects and customers through forms on your website, calls and texts routed through our systems, Google messages, and the lead and customer records you keep in the portal. This is your customers’ personal information; your own privacy notice governs it and we process it only on your instructions.

2.4 Mailbox data (optional)

If you connect an email account to the portal so lead conversations sync, we process the credentials you enter and the messages in the threads that match your leads.

2.5 Website visitor data

Server logs and analytics for websites we host (IP address, pages viewed, referrer, device) and the contents of contact-form submissions.

2.6 Payment data

Card details are entered directly into our payment gateway’s hosted fields and never reach our servers. We keep transaction metadata — amount, date, status, card brand and last four digits — for billing records.

3. Processing principles

• Instructions. We process your data only to deliver the services you purchased, as described in this DPA, your service agreement and the Privacy Policy, or as you otherwise instruct in writing (including through the portal).
• Lawful basis. Our contract with you, and explicit consent where a Google account or mailbox is connected.
• Purpose limitation and minimisation. We collect and keep only what the services need.
• Confidentiality. Staff with access to client data are bound by confidentiality obligations and see only the accounts they work on.
• No sale, no advertising use. We do not sell client or end-user data and do not use it for advertising or to build advertising profiles.
• AI features. Where a feature uses an AI model to draft text (review replies, lead follow-ups, blog and website copy), the content you submit is sent to our AI provider only to produce that draft. Google user data is never used to train models.
• Storage limitation. Data is kept for the duration of the client relationship plus the periods in section 8.

4. Sub-processors

We use the following third parties to deliver our services. Each is bound by contract to process data only on our instructions and to protect it appropriately. We will update this list when a sub-processor is added or replaced; active clients can ask to be notified of changes by emailing [email protected].

Our own platform (CRM, portal, database and automation) runs on servers we administer; those servers are hosted by the infrastructure provider above. Primary processing takes place in the United States.

5. Security measures

We maintain technical and organisational measures appropriate to the data we handle, including:

• TLS 1.2+ for all traffic; HTTPS enforced on every host
• OAuth refresh tokens and API credentials stored encrypted; card data never touches our servers
• PostgreSQL row-level security isolating each client’s data in a multi-tenant database
• HMAC-signed webhooks and signed, expiring links for account access
• SSH key-only server access with password login disabled; host firewall (UFW) and intrusion prevention (fail2ban)
• Automated daily database backups
• Access logging and audit trails for staff actions in the CRM

No system is perfectly secure. We review access regularly and fix issues we find; if you discover a vulnerability, please report it to [email protected].

6. Data breach notification

If we become aware of a personal-data breach affecting data we process for you, we will notify you without undue delay and in any case within 72 hours of becoming aware, describing the nature of the breach, the data and people affected, the steps we have taken and what we recommend you do. We will cooperate with you on any notifications you are required to make.

7. Data subject requests

If one of your customers asks to access, correct, delete or export their personal information and the request concerns data we process for you, forward it to [email protected] and we will help you respond within the time the law allows. If a request comes to us directly we will refer it to you unless the law requires us to act on it.

8. When services end

On termination of your services, or of a particular service:

• Connected Google accounts are disconnected and tokens and cached Google data deleted within 30 days.
• You may request an export of your lead, customer and content data before the account closes; we provide it in a standard format such as CSV or JSON.
• Portal account data is retained for 90 days so the account can be reactivated without loss, then deleted or anonymised.
• Website files for a site we built are kept for 30 days after hosting ends and can be provided to you on request during that period (see the website ownership terms).
• Invoices and payment records are retained for the period required by tax and accounting law.

Individual account deletion on request is described on the Account & data deletion page.

9. Contact

Data-processing questions, sub-processor notifications and requests can be sent to:

• Page One Insights LLC, 111 NE 1st St., Ste 8646, Miami, FL 33132, United States
• Email: [email protected]
• Phone: +1 (888) 272-1940 (Mon–Fri, 9:00am–6:00pm ET)