Data Processing Addendum

011. Parties and scope

This DPA is between the customer that buys a paid plan ("Customer") and MVR Capital Holdings LLC, 8 Roaring Creek Ct, Trophy Club, TX 76262, United States ("we" or "Processor").

It applies when we process personal data for the Customer while providing the service at whywontai.com ("Customer Personal Data").

It does not cover data that we process for our own purposes as a controller, such as sign-in, account security, billing, enquiries and site analytics. The privacy notice covers that data.

TermsPrivacy notice

022. Definitions

• "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it applies in the United Kingdom, with the UK Data Protection Act 2018.
• "CCPA" means the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), and its regulations.
• "Controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings in the GDPR. "Business", "service provider", "sell" and "share" have the meanings in the CCPA.
• "Subprocessor" means a third party that we engage to process Customer Personal Data.

033. Roles

The Customer is the controller of Customer Personal Data. We are its processor.

If the Customer acts as a processor for its own clients, for example on the Agency plan, we are its subprocessor, and the Customer passes its clients' instructions to us.

Under the CCPA, the Customer is the business and we are its service provider.

044. Processing details

• Subject matter: providing the service under the Terms. This includes crawler scans, AI visibility prompt checks, search connection dashboards, fix pull requests, Ask AI, report emails, API keys and the MCP server.
• Duration: while the Customer has an account, and until deletion under section 11.
• Nature: collecting, storing, organizing, analyzing, sending and deleting data, as the service needs.
• Purpose: to provide the service that the Customer uses, and for no other purpose.
• Types of personal data: names and email addresses of the Customer's users; display name, company and website; connected Google or Microsoft account email; site-level daily search and analytics totals (no visitor-level data); scan results with details taken from public pages, such as titles, headings and opening paragraphs, which can include names; the buyer questions the Customer tracks and the AI answers returned; Ask AI chat messages; the GitHub repositories the Customer chooses and the file changes in fix pull requests; email addresses that receive reports; hashed API keys; salted IP address hashes used for scan limits.
• Categories of data subjects: the Customer's users; people whose names or contact details appear on public pages the Customer scans or in content the Customer submits; people who receive report emails that the Customer requests.
• Special categories: the service is not built for special category data. The Customer must not submit it.

055. Our obligations

• We process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's settings in the service are those instructions. Law may require other processing. If so, we tell the Customer first, unless the law forbids it.
• We tell the Customer if we think an instruction breaks data protection law.
• We help the Customer meet its duties on security, breach notice, data protection impact assessments and prior consultation, as far as our role and the information we hold allow.
• We make available the information needed to show that we meet this DPA, as section 12 describes.
• Under the CCPA, we do not sell or share Customer Personal Data. We do not keep, use or disclose it for any purpose other than providing the service, or outside our direct business relationship with the Customer. We do not combine it with personal data we get from others, except as the CCPA allows. We follow the CCPA and give the same level of privacy protection that it requires. We tell the Customer if we can no longer meet these duties. The Customer may then take reasonable steps to stop and fix unauthorized use.

066. Confidentiality

Anyone we allow to process Customer Personal Data must keep it confidential. We give access only to people who need it to run the service.

077. Security measures

We use the technical and organizational measures described on our Security page. In summary:

• HTTPS for every page and backend call, with HSTS for one year, including subdomains.
• Sign-in with Google or Lovable. We do not ask for or store passwords.
• Row level security on the database tables in both backends. Server functions check the caller before they read or write member data.
• A salted hash of the IP address, not the address itself, for free scan limits.
• The scanner requests only public addresses, checks each redirect and stops reading a response after 2 MB.
• API keys stored as SHA-256 hashes. Refresh tokens for Google and Bing stored in an encrypted secret store.
• A GitHub App that the Customer installs only on the repositories it chooses. It opens pull requests and does not merge them.
• Card details entered on Stripe pages only. Keys for outside services kept on the server, not in the website code.
• We do not hold SOC 2 or ISO 27001.

Security

088. Subprocessors

The Customer gives general authorization for the subprocessors on our Subprocessors page.

We will email the Customer's account email address at least 30 days before we add or replace a subprocessor. The Customer may object in writing during that time, on reasonable data protection grounds. We will then try to resolve the objection. If we cannot, the Customer may end the affected paid plan before the change takes effect.

We bind each subprocessor by written contract to data protection duties that protect Customer Personal Data at least as well as this DPA. We remain responsible to the Customer for each subprocessor's work.

Subprocessors

099. Data subject requests

The service lets the Customer correct its profile, disconnect Google and Bing, revoke API keys and delete its account in account settings.

For other requests, we give the Customer reasonable help to answer data subjects who use their rights. If a data subject contacts us directly about Customer Personal Data, we pass the request to the Customer and do not answer it ourselves, unless the law requires us to.

1010. Personal data breach

We tell the Customer without undue delay, and within 72 hours, after we become aware of a personal data breach that affects Customer Personal Data. We give the information we have about the nature of the breach, the data and people affected, the likely effects and the steps we are taking. We add more information as we learn it.

1111. Deletion or return

When the service ends, or when the Customer asks in writing, we delete or return Customer Personal Data, as the Customer chooses, unless the law requires us to keep it.

Deleting the account in account settings removes the sign-in account and profile. For other Customer Personal Data, email us. Copies can stay in our providers' backups and logs until those expire.

1212. Audits

On written request, and at most once a year, we will answer reasonable written questions and share documents that show how we meet this DPA. Audits are by document review. A supervisory authority may also audit as the law allows.

1313. International transfers

We are in the United States and process Customer Personal Data there.

This DPA does not include the EU Standard Contractual Clauses or the UK International Data Transfer Addendum. A Customer that needs them for transfers from the European Economic Area, Switzerland or the United Kingdom must contact us before it sends that data to the service.

Section 4 gives the processing details. Section 7 gives the security measures. The Subprocessors page gives the list of subprocessors.

1414. Liability

Each party's liability under this DPA is subject to the limits in the Terms, as far as the law allows.

1515. Order of precedence

If this DPA and the Terms conflict, this DPA applies.

1616. Governing law

This DPA is governed by the laws of the State of Texas, without regard to its conflict-of-law rules. Courts in Denton County, Texas, have exclusive jurisdiction, the same as the Terms.

1717. Request a signed copy

Email Mitchell@whywontai.com with "DPA" in the subject line and the legal name of your company.