Data Processing Addendum.

For data you provide about your business and its customers, you are the controller and Excess Quest LLC (operating RankNext, Delaware, 8 The Green, STE A, Dover, DE 19901) is the processor— we act on your instructions. For visitors to ranknext.io and users of our free tools, we are the controller ourselves; that’s covered by our Privacy Policy.

We process your data only to deliver the service you bought and only per your instructions (including these terms) — never for our own advertising, never sold, never used to train third-party AI models. Subject matter is your visibility work; duration is the life of your engagement plus the retention below.

We use vetted subprocessors to run the service: Vercel (hosting), Supabase (database, auth, and file storage, US region), Resend (email), Stripe (payments), and the AI engines we query for visibility checks (public business questions only, never your credentials). We stay responsible for their work. If we add or change a subprocessor that handles client data, we’ll update the list and notify active clients so you can object.

Access you share is encrypted at rest with AES-256-GCM, decrypted only server-side behind an admin allowlist while we’re actively working on your account — details on our Securitypage. Everyone with access is bound by confidentiality. If we become aware of a breach affecting your data, we’ll tell you without undue delay and share what we know as we learn it.

You keep control of your data and can export or delete it any time. If one of your customers asks to access or delete their information, we’ll help you respond promptly using the tools and access we hold. We’ll also give reasonable help with security reviews or records you need to meet your own obligations.

When your engagement ends, anything you own (your site, profile, and content) stays yours and we hand over access cleanly. We delete or return the client data we hold within 30 days of a written request, except the minimum we must keep for legal or billing reasons.

Data is processed in the United States. Material changes get a new date here and direct notice to active clients. This addendum is governed by the laws of the State of Delaware, alongside our Terms. Questions or a signed copy: [email protected].