Data Processing Addendum

Last updated: October 25, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Servicebetween SEOLZ.com, an assumed name of Wheelock Group, Inc., based in Sparta, Michigan (“SEOLZ”, “we”, “us”) and the customer using SEOLZ (“Customer”, “you”) — including agencies that audit websites on behalf of their own clients. It applies whenever SEOLZ processes personal data on your behalf while providing the service. Where this DPA and the Terms conflict on data protection, this DPA wins. It sits alongside our Privacy & Cookie Policy, which describes the same practices from your own (account holder) point of view.

1. Roles

  • You are the controller (or, for an agency acting for its clients, a processor passing on its client's instructions) for personal data contained in the websites, Google accounts and report recipients you connect to SEOLZ.
  • SEOLZ is your processor for that data. We process it only to provide the service you configure — running audits, generating findings and fixes, sending reports and alerts — and on your documented instructions, which are the Terms, this DPA and the settings you choose in the product.
  • SEOLZ is an independent controller for the account data we need to run the business itself (your login, billing relationship, security logs, product analytics you consent to), as described in the privacy policy.

2. Scope of processing

  • Website audit data — the publicly accessible pages of the sites you add, crawled the way a search engine sees them, and the findings, scores and history we derive. We do not log in to your sites or collect data about your customers; personal data appears here only incidentally (for example a name or email address published on a page).
  • Connected-account data — if you connect Google Search Console, Analytics or Tag Manager: aggregate search and traffic metrics and container configuration, via the scopes listed in the privacy policy.
  • Account and configuration data — names and email addresses of you and your users, report recipients you add, white-label branding, client labels and contact emails you enter for a site.
  • Duration — for as long as you use SEOLZ, then as described in §7.

You confirm you have the right to have the sites you add audited, and a lawful basis for any personal data you ask us to process (for example, report recipients).

3. Our obligations

  • Process personal data only on your documented instructions, and tell you if we believe an instruction breaks data protection law.
  • Ensure everyone at SEOLZ who can access personal data is bound by confidentiality.
  • Not sell personal data, and not use it for advertising.
  • Assist you, taking into account the nature of the processing, with data protection impact assessments and with consultations with supervisory authorities where they relate to SEOLZ.

4. Sub-processors

You authorise SEOLZ to use the following sub-processors, each bound by written data protection terms at least as protective as this DPA:

  • Amazon Web Services — hosting, databases and transactional email (SES). United States.
  • Stripe — subscription billing and payment processing. United States.
  • Google — sign-in and the Search Console / Analytics / Tag Manager APIs you connect. United States.
  • Anthropic, Perplexity, DataForSEO — AI and search-data processing used to generate fix guidance and AI-visibility checks. They receive finding and query metadata, not your customers' personal data.
  • Sentry — error monitoring (in the browser only when optional cookies are accepted).

We will update this list (and its “last updated” date) before a new sub-processor starts processing your personal data, and give notice in-app or by email for material changes. If you have a reasonable data-protection objection, tell us at privacy@seolz.com; if we can't address it, you may terminate the affected service. We remain responsible for our sub-processors' performance of their obligations.

5. Security measures

We maintain technical and organisational measures appropriate to the risk, including:

  • Encryption in transit (HTTPS/TLS) for the website, the app and our API.
  • Passwords stored only as salted bcrypt hashes; card data handled by Stripe and never stored by SEOLZ.
  • Access control: authenticated, per-member data scoping; non-enumerable site identifiers; scoped, revocable per-site tokens for agent (MCP) access; a separate, least-privilege administrator role.
  • Internal services authenticated with shared secrets and reachable over private networking; production access restricted to a small number of authorised personnel.
  • Encryption at rest where offered by our infrastructure providers, which we commit to use for stores holding personal data.
  • Error monitoring and logging to detect and investigate incidents.

We review these measures as the product evolves and will not materially reduce the overall level of protection during your subscription.

6. Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware of it. The notice will describe what happened, the data and people likely affected, likely consequences, and the steps we are taking — with further detail as it becomes available — so you can meet your own notification duties.

7. Data subject requests, retention & deletion

  • Self-service. Under Account → Your data you can download everything we hold about your account (“Download my data”) and permanently delete it (“Delete account”). You can edit or remove sites, report recipients and branding at any time.
  • Assistance. If a data subject contacts us directly about data we process for you, we will refer them to you, and we will help you answer access, correction, deletion and portability requests that you can't handle self-service.
  • Deletion. When you delete your account we immediately erase the personal data it holds — names, email addresses, password, preferences, notifications, email history, report recipients, connected-account tokens and the IP addresses we logged — cancel any subscription, and email you a confirmation. Removing a site deletes its Google connection tokens.
  • What we keep. Audit results about public websites are kept in de-identified form (no longer linked to you) and used only in aggregate, for example platform-wide benchmarks. Stripe retains billing records as required by law.

8. International transfers

SEOLZ and its sub-processors process data in the United States. Where personal data originating in the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) apply and are incorporated by reference, with you as data exporter and SEOLZ as data importer. We rely on equivalent safeguards with our sub-processors.

9. Audits & cooperation

On reasonable written request (no more than once a year, unless a supervisory authority requires it or after a personal data breach), we will make available the information necessary to demonstrate compliance with this DPA — for example written answers to a security questionnaire and documentation of the measures above. Where that information is not sufficient, we will cooperate with a reasonable audit by you or an independent auditor bound by confidentiality, at your cost, on mutually agreed timing and scope that doesn't compromise other customers' data or our security.

10. Term & contact

This DPA lasts as long as we process personal data for you. Questions, objections or audit requests: privacy@seolz.com. See also our Privacy & Cookie Policy and Terms of Service.