Data Processing Agreement

Last updated: September 1, 2026

This DPA supplements our Terms of Service and Privacy Policy and applies automatically whenever RanqerSEO processes personal data on your behalf as a processor. If your organization requires a countersigned copy for its own records, contact us at the address in Section 15.

This Data Processing Agreement ("DPA") is entered into between the customer using RanqerSEO ("Customer," "Controller") and Anqor Studios LLC FZ, operating RanqerSEO ("Anqor Studios," "Processor," "we," "us"). It governs the processing of personal data that Anqor Studios carries out on Customer's behalf in the course of providing RanqerSEO.

1. Definitions

• Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach have the meanings given in the EU General Data Protection Regulation ("GDPR"), and equivalent terms under the UAE Personal Data Protection Law ("PDPL") or any other applicable data protection law carry the corresponding meaning under that law.
• Sub-processor means any third party Anqor Studios engages to process personal data in order to provide RanqerSEO, as listed in Annex II.
• Services means RanqerSEO as described in the Terms of Service.

2. Roles of the parties

Customer is the Controller of personal data it submits to or processes through RanqerSEO (including any personal data incidentally present on a page it submits for audit, or in content it connects via Google Search Console, WordPress, Shopify, or a custom publish endpoint). Anqor Studios is the Processor, acting only on Customer's documented instructions as set out in this DPA and the Terms of Service.

3. Subject matter, duration, nature and purpose of processing

Full details are in Annex I. In summary: Anqor Studios processes personal data for as long as Customer maintains an active RanqerSEO account (or as otherwise required by law), to the extent necessary to run audits, generate AI-written analysis and content, retrieve keyword and performance data, generate images, and publish content to platforms Customer connects.

4. Processor obligations

Anqor Studios shall:

• Process personal data only on Customer's documented instructions, including as set out in the Terms of Service and this DPA, unless required to do otherwise by law (in which case we will inform Customer of that legal requirement first, unless the law prohibits this).
• Ensure persons authorized to process personal data are bound by confidentiality.
• Implement the technical and organizational security measures described in Annex III.
• Not engage a new Sub-processor without giving Customer prior notice, per Section 5.
• Taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures in responding to requests from data subjects exercising their rights.
• Assist Customer in ensuring compliance with security, breach-notification, and impact- assessment obligations, taking into account the information available to Anqor Studios.
• At Customer's election, delete or return all personal data after the end of the provision of Services, and delete existing copies, except where retention is required by law (see Section 10).
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, per Section 9.

5. Sub-processors

Customer authorizes Anqor Studios to engage the Sub-processors listed in Annex II to provide the Services. Each Sub-processor is engaged only for the specific purpose listed, and Anqor Studios remains responsible for that Sub-processor's performance of its data protection obligations. If Anqor Studios adds or replaces a Sub-processor, we will update Annex II and, for a material change, notify Customer by email at least 10 days before the change takes effect. Customer may object on reasonable data-protection grounds by contacting us within that window; if the parties cannot resolve the objection, Customer may terminate the affected Service.

6. International transfers

Anqor Studios is based in the United Arab Emirates. The Sub-processors in Annex II are primarily based in, or process data in, the United States. Where personal data is transferred to a country without an adequacy decision recognized by the relevant data protection authority, Anqor Studios relies on the transfer mechanism available for that Sub-processor (such as Standard Contractual Clauses or the Sub-processor's own certified compliance framework, per that Sub-processor's own data processing terms) to ensure an adequate level of protection.

7. Personal data breach notification

Anqor Studios will notify Customer without undue delay, and in any case within 72 hours of becoming aware, of any confirmed Personal Data Breach affecting Customer's data, with the information reasonably available at the time, and will provide reasonable further information as it becomes available.

8. Data subject rights

If Anqor Studios receives a request directly from a data subject to exercise their rights regarding data processed on Customer's behalf, we will not respond to it directly (unless legally required to) and will instead promptly forward it to Customer. Customer can otherwise exercise these rights directly from the RanqerSEO product (Settings) or by contacting us, as described in the Privacy Policy.

9. Audits

On reasonable written notice, and no more than once per 12-month period (except following a confirmed Personal Data Breach), Anqor Studios will provide Customer with the information reasonably necessary to demonstrate compliance with this DPA. Given Anqor Studios' size, this is ordinarily satisfied through documentation and a written questionnaire response rather than an on-site audit; an on-site or third-party audit may be arranged by mutual written agreement, at Customer's expense.

10. Return or deletion of data

On termination of Customer's account, Anqor Studios will delete Customer's account data, connected-service credentials, and generated content from its production systems within 30 days, except for data we are legally required to retain (for example, billing records), which is retained only for as long as that legal obligation requires and is not otherwise processed.

11. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability set out in Section 8 of the Terms of Service.

12. Term

This DPA takes effect when Customer starts using RanqerSEO in a manner that involves processing personal data, and remains in effect for as long as Anqor Studios processes personal data on Customer's behalf under the Terms of Service.

13. Order of precedence

In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA governs.

14. Governing law

This DPA is governed by the laws of the United Arab Emirates, consistent with the Terms of Service.

15. Contact

Questions about this DPA, or to request a countersigned copy: hello@anqorstudios.com.

Annex I — Description of processing

Categories of data subjects

• Customer's own personnel who use the RanqerSEO account.
• Individuals whose personal data may incidentally appear on pages Customer submits for audit (e.g. names or contact details published on an "About" or "Team" page).
• Individuals whose data appears in performance data pulled through a connected Google Search Console property, WordPress site, Shopify store, or custom publish endpoint.

Categories of personal data

• Account data: name, email address, hashed password.
• Content incidentally present in crawled page data (see above).
• Connected-service credentials: OAuth tokens, API keys, application passwords, stored encrypted at rest.
• Billing metadata (subscription status, plan, trial dates) — full card details are handled entirely by Stripe and never reach Anqor Studios' systems.

Nature and purpose of processing

Crawling and analyzing submitted URLs; generating AI-written audit findings, fixes, and articles; retrieving keyword, backlink, and performance data; generating images; publishing content to a connected platform; processing subscription payments; operating and securing the Customer account.

Annex II — Sub-processors

Annex III — Technical and organizational security measures

• Passwords are hashed with bcrypt; plaintext passwords are never stored.
• Connected-service credentials (OAuth tokens, API keys, application passwords) are encrypted at rest.
• All traffic to and from RanqerSEO is served over HTTPS/TLS.
• Access to production systems is restricted to authorized personnel.
• Credit and billing changes are logged to an internal ledger for accountability.