1. Parties
Controller: You (the customer using KSHF). Processor: FLOW PLUS FOR COMPUTERS AND INFORMATION SYSTEMS (UAE) operating KSHF.
2. Subject matter
The Processor provides AEO scanning and fix-package generation services. Processing involves: scanning publicly accessible website URLs; temporarily storing HTML content; running automated analysis; generating AI-assisted content recommendations; storing results and fix packages.
3. Duration
Processing continues for the duration of your account. On account deletion, personal data is purged within 30 days. Anonymized aggregate metrics may be retained indefinitely.
4. Nature and purpose
Processing is automated. Purpose: delivery of AEO audit and fix package as described in the Terms of Service. Legal basis: contract performance (Article 6(1)(b) GDPR).
5. Types of personal data
Email address; hashed IP address; hashed session token; website URLs submitted by the customer; scan results (non-personal metadata about submitted websites).
6. Sub-processors
Stripe Inc. (payment processing, US/EU); Mailjet SAS (email delivery, EU); Cloudflare Inc. (R2 object storage); Railway Corp. (compute hosting, US); Neon Inc. (database hosting, US). Customer consents to these sub-processors by using the Service.
7. Processor obligations
The Processor shall: process data only on documented instructions from the Controller; ensure confidentiality; implement appropriate technical and organizational measures; assist the Controller in responding to data subject requests; notify the Controller of any data breach within 72 hours of becoming aware.
8. Controller rights
The Controller may audit the Processor's compliance upon 30 days written notice. The Controller may terminate processing at any time by deleting their account.
9. Contact
Data protection inquiries: kshf@flowplus.ae