Data Processing Agreement

For personal data you put into Omnipresence, you are the data controller and 2026477667 Alberta Ltd. is the data processor. We process that data only to provide the service, on your documented instructions, which are the configuration you set and this agreement.

• Subject matter. Measuring how your brand appears in AI assistants.
• Categories of data. Account identifiers (name, email), the public prompts and brand terms you configure, the resulting AI answers and cited URLs, and billing status. We do not process your internal documents or customer records.
• Data subjects. Your authorised users. The measurement data itself is about public content, not individuals.
• Duration. For the life of your account, then deletion as below.

• Process personal data only on your instructions and for the service.
• Keep the data confidential and ensure our staff are bound to confidentiality.
• Apply appropriate technical and organisational security measures (see our Security page).
• Assist you with data-subject requests, and with your own security, breach and impact-assessment obligations.
• Notify you without undue delay if we become aware of a personal-data breach affecting your data.
• Delete or return your personal data at the end of the service, subject to legal retention.

You authorise us to use the following sub-processors, each scoped to one purpose. We remain responsible for their compliance, and will give notice of any intended change so you can object.

• Supabase — Database and authentication (hosted on AWS us-east-1).
• Railway — Application hosting and compute.
• Stripe — Payments and subscription management. Card details never reach our servers.
• OpenAI — Running measurement probes against ChatGPT models.
• OpenRouter — Gateway that routes measurement probes to Anthropic (Claude), Google (Gemini) and Perplexity.
• DataForSEO — Search-demand and SERP data used to size and rank tracked queries.
• Resend — Transactional email such as invitations, billing notices and digests.
• Google Tag Manager — Analytics on the public marketing pages only — deliberately not loaded inside the authenticated application.

Customer data is stored in AWS us-east-1 (United States). Where a sub-processor transfers personal data across borders, that transfer relies on an appropriate safeguard such as Standard Contractual Clauses. EU data residency can be arranged for enterprise agreements on request.

The security measures we apply are described on our Security page. We will make available the information reasonably needed to demonstrate compliance. On termination we delete your personal and project data within 30 days, except billing records retained for legal reasons.

To receive a countersigned DPA, email [email protected] with your legal entity name and the signatory.