Data Processing Addendum
Last updated: August 9, 2026
This Addendum applies where you use Zuhya to process personal data belonging to your own clients or their customers. For that data you act as the controller and Zuhya LLC acts as the processor. Where we determine the purposes of processing (your own account and billing data), the Privacy Policy governs instead.
1. Roles
You are the controller of the personal data you upload or collect through the Service on behalf of your clients. Zuhya LLCprocesses that data only on your documented instructions, which the ordinary use of the Service constitutes, and for no independent purpose of its own. We do not sell personal data, and we do not use your clients' personal data to train models.
2. What we process on your behalf
- Review programme data: recipient names, email addresses, phone numbers, star ratings and the free-text feedback reviewers write.
- CRM data: lead names, contact details and message content arriving through connected channels.
- Business Profile data: the content, reviews and media of profiles you connect, including reviewer names as Google returns them.
- Client records: the businesses and locations you manage in the platform.
Ranking scans process search terms, coordinates and public business listings; those contain no personal data of your clients' customers.
3. Duration
We process this data for as long as your account is active. On termination, data is deleted or returned on request; residual copies in backups age out on the backup schedule.
4. Security
Data is encrypted in transit and at rest. Access is scoped per tenant at the database level, and administrative access is limited to what operating the Service requires. Diagnostic data passes through a redaction layer before it reaches our error monitoring.
5. Subprocessors
You authorise the subprocessors below. We will give notice before adding a new one, and we remain responsible for their performance.
Supabase
- Purpose: Primary database, authentication and file storage: the system of record.
- Data: Account data, client and location records, CRM leads, review feedback, scan results.
- Location: EU / US (project region)
Vercel
- Purpose: Application hosting, edge routing and server-side execution.
- Data: Request metadata and anything transiting the application in normal use.
- Location: US / global edge
DataForSEO
- Purpose: Search-engine ranking data, keyword metrics and website crawling.
- Data: Search terms, target business identifiers and coordinates. No end-customer personal data.
- Location: US / EU
Google (Maps Platform, Business Profile API)
- Purpose: Map rendering, geocoding, and reading/writing the customer’s own Business Profile.
- Data: Coordinates and place identifiers; for connected profiles, business content and reviews.
- Location: US / global
Anthropic
- Purpose: AI drafting and analysis (post drafts, review replies, audits, support assistance).
- Data: Only the content submitted for that task; not used to train models.
- Location: US
Paddle
- Purpose: Merchant of record: payment processing, invoicing and sales-tax handling.
- Data: Billing name, email, address and payment details (held by Paddle, not by us).
- Location: UK / EU / US
Twilio
- Purpose: SMS and WhatsApp messaging for CRM inbound and review requests.
- Data: Phone numbers and message content.
- Location: US / global
Resend
- Purpose: Transactional email delivery (notifications, reports, review requests).
- Data: Recipient email addresses and message content.
- Location: US / EU
Sentry
- Purpose: Error monitoring and diagnostics.
- Data: Error traces and request context, passed through a redaction layer before sending.
- Location: US / EU
6. International transfers
Some subprocessors are located outside the EEA and the United Kingdom. Where personal data is transferred, it is done under the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism offered by that subprocessor.
7. Assistance
We will assist you, taking into account the nature of the processing, in responding to data-subject requests and in meeting your security, breach-notification and impact-assessment obligations. We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you.
8. Deletion and export
You can export or delete the data in your account at any time from the product. On written request we will delete or return the personal data we process on your behalf.
9. Contact
Data protection enquiries: privacy@zuhya.com.
Zuhya LLC
New Mexico, United States