Data processing

The short version

For a standard audit we process almost nothing on your behalf. We fetch publicly available pages the way any visitor could, and the only personal data involved is the contact details of whoever requested the audit — which we process as a controller, covered by our privacy notice rather than by a processing agreement.

Implementation engagements are different. If you give us access to a codebase, a CMS or a staging environment, we may encounter personal data belonging to your users. At that point we act as your processor and a data processing agreement applies.

What a processing agreement covers

• Subject matter and duration — limited to the statement of work and its term.
• Nature and purpose — remediation of agent readiness findings in systems you control.
• Categories of data — whatever is already present in the systems you grant access to. We do not collect additional personal data, and we do not export datasets.
• Our obligations — act only on your documented instructions, keep the data confidential, apply appropriate technical and organisational measures, assist with data subject requests, and delete or return everything at the end of the engagement.
• Sub-processors — named in the agreement, with notice before any change.
• International transfers — we are established in India, so any engagement with a client in Singapore or the United States involves a cross-border transfer. The agreement sets out the safeguards.

How we minimise what we touch

We ask for the least access that will do the job. Read-only where possible, staging rather than production where a staging environment exists, and scoped repository access rather than organisation-wide. We do not copy databases to local machines and we do not need production credentials to fix structured data.

Requesting an agreement

Email dpo@agentfriendlyrank.com and we will send our standard agreement, or review yours. We are comfortable signing a client paper where it is reasonable.

Sub-processors

For the website and our own operations we use Vercel (hosting), Resend (transactional email) and Plausible (cookieless analytics). Engagement-specific sub-processors, if any, are named in the agreement before work starts.