Data Processing Agreement (DPA)

Last Updated: July 4, 2026  · [email protected]

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (“Agreement”) between 9rank.ai (“Processor”, “we”, “us”) and the customer (“Controller”, “you”) and applies to the processing of personal data by 9rank.ai on your behalf across all products: 9Rank SEO, RAG9, and Kernel9.

This DPA is designed to meet the requirements of the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws.

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person, as defined in applicable data protection law.
• “Processing” means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• “Data Subject” means an identified or identifiable natural person whose personal data is processed.
• “Sub-processor” means any third party engaged by 9rank.ai to process personal data on behalf of the Controller.
• “Controller” means the entity that determines the purposes and means of processing personal data (you, the customer).
• “Processor” means the entity that processes personal data on behalf of the Controller (9rank.ai).

2. Scope and Roles

2.1 Controller Data

When you use 9Rank SEO tools, you submit URLs, keywords, and business content for analysis. You are the Controller of this data, and 9rank.ai acts as the Processor.

2.2 Kernel9 Customer Interaction Data

When you deploy a Kernel9 chat widget on your website, your end-users (“Visitors”) interact with the AI chatbot and human agents. You are the Controller of all Visitor data (conversation logs, names, email addresses). 9rank.ai processes this data solely to provide the Kernel9 service on your behalf.

2.3 RAG9 Knowledge Base Data

When you connect data sources (websites, e-commerce platforms, APIs) to RAG9, 9rank.ai indexes and processes this data to build your RAG-powered knowledge base. You are the Controller; 9rank.ai is the Processor.

3. Obligations of the Processor

9rank.ai shall:

• Process personal data only on documented instructions from the Controller, unless required to do so by applicable law.
• Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
  • Access controls with role-based permissions.
  • Regular security assessments and vulnerability testing.
  • Incident response procedures.
• Not engage a sub-processor without prior written authorization from the Controller (see Section 5).
• Assist the Controller in responding to Data Subject requests (access, rectification, erasure, portability, restriction, objection).
• Notify the Controller without undue delay (and in no event later than 72 hours) after becoming aware of a personal data breach.
• Delete or return all personal data to the Controller upon termination of the Agreement, unless applicable law requires continued storage.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits.

4. Obligations of the Controller

You, as the Controller, shall:

• Ensure that your use of 9rank.ai services complies with applicable data protection laws.
• Obtain all necessary consents and authorizations for the processing of personal data by 9rank.ai.
• Provide clear, documented instructions for the processing of personal data.
• Be responsible for informing Data Subjects about the processing of their data, including providing a privacy notice that references 9rank.ai as a data processor where required.

5. Sub-processors

9rank.ai currently uses the following sub-processors:

We will notify the Controller at least 14 days before engaging any new sub-processor, providing the Controller an opportunity to object. If the Controller objects on reasonable grounds related to data protection, both parties will work in good faith to find a resolution. If no resolution is reached, the Controller may terminate the affected service.

6. International Data Transfers

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA) or the UK. For such transfers, we rely on:

• Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914).
• UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable.
• Transfer Impact Assessments (TIAs) conducted for each sub-processor to evaluate the legal framework in the recipient country.

Copies of executed SCCs are available upon request by contacting [email protected].

7. Data Retention

• 9Rank SEO data: Audit reports and analysis results are retained while your account is active and for 90 days after account deletion.
• RAG9 data: Knowledge base data is retained while your workspace is active. Upon workspace deletion, data is purged within 30 days.
• Kernel9 conversation data: Chat logs and ticket data are retained while your Kernel9 subscription is active. After cancellation, data is retained for 30 days before deletion.
• Backup copies: Backup copies are automatically purged within 90 days of the primary data deletion.

8. Data Subject Rights

9rank.ai will assist the Controller in fulfilling its obligations to respond to Data Subject requests, including:

• Right of Access: We will provide the Controller with copies of personal data upon request.
• Right to Rectification: We will correct inaccurate personal data upon instruction from the Controller.
• Right to Erasure: We will delete personal data upon instruction from the Controller, subject to any legal retention obligations.
• Right to Data Portability: We will provide personal data in a structured, commonly used, machine-readable format upon request.
• Right to Object / Restrict Processing: We will cease or restrict processing upon instruction from the Controller.

Requests should be directed to [email protected]. We will respond within 10 business days.

9. Security Incident Notification

In the event of a personal data breach, 9rank.ai shall:

• Notify the Controller without undue delay, and no later than 72 hours after becoming aware of the breach.
• Provide the Controller with sufficient information to enable the Controller to fulfill its own breach notification obligations under applicable law.
• Include in the notification: a description of the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to mitigate the breach.
• Cooperate with the Controller and take commercially reasonable steps to assist in investigating, mitigating, and remediating the breach.

10. Audits

Upon reasonable request and subject to appropriate confidentiality obligations, 9rank.ai shall make available to the Controller all information necessary to demonstrate compliance with this DPA. The Controller may conduct audits, including inspections, either directly or through an independent third-party auditor, no more than once per calendar year. The Controller shall provide at least 30 days' written notice before conducting any audit.

11. Term and Termination

This DPA shall remain in effect for the duration of the Agreement. Upon termination of the Agreement, 9rank.ai shall, at the Controller's election, delete or return all personal data processed on behalf of the Controller within 90 days, unless applicable law requires continued storage.

12. Limitation of Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability provisions of the Agreement.

13. Contact

For DPA-related inquiries, data processing questions, or to request a signed DPA for enterprise agreements:
[email protected]
Data Protection Contact: [email protected]