This Data Processing Agreement (“DPA”) governs the data processing relationship between Nudgeo (the “Data Processor”) and the customer using the Service (the “Data Controller”). This DPA is incorporated by reference into the Nudgeo Terms of Service.
Notice of revision. This DPA was revised on the effective date shown above. The revision corrects the subprocessor list and what is sent to them, and removes descriptions of features the Service does not provide. Section 11 sets out when the revision applies to accounts created before that date.
1. Definitions
- Personal Data: Information as defined in GDPR Article 4(1) and the Personal Information Protection Act (개인정보 보호법).
- Processing: Any operation performed on Personal Data, including collection, storage, use, transmission, and deletion.
- Subprocessor: A third party engaged by the Data Processor to carry out part of the Processing.
2. Scope of Processing
The Data Processor processes Personal Data solely on the Data Controller's instructions and only for the following purposes:
- Delivering the Nudgeo Service (measurement, analysis, dashboard).
- Fulfilling legal obligations.
- Any other purpose to which the Data Controller has explicitly consented.
3. Security Measures
The Data Processor implements the following technical and organizational security measures:
- Encryption: AES-256 at rest; TLS 1.3 in transit.
- Access control: Role-Based Access Control (RBAC) and Multi-Factor Authentication.
- Audit logs: Retained for 90 days with anomalous access alerting.
- Network isolation: VPC, private subnets, SSRF protection.
- Certifications: AWS Foundational Technical Review passed.
4. Subprocessor List
The Data Processor uses the following subprocessors. The Data Controller will be notified before any new subprocessor is added.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Infrastructure hosting, database, transactional email (Amazon SES, Amazon Cognito) | ap-northeast-2 (Seoul) |
| OpenAI | Measurement: tracked prompt text | US |
| Anthropic | Measurement: tracked prompt text | US |
| Google (Gemini API) | Measurement: tracked prompt text | US |
| Perplexity | Measurement: tracked prompt text | US |
| OpenRouter, Inc. | Measurement: tracked prompt text, relayed to the providers hosting the other AI models | US (model providers may be elsewhere) |
| SerpApi, LLC | Measurement: brand-name Google searches for Google AI Overviews | US |
Payment providers are not listed. Card subscriptions are sold by Polar Software, Inc. as merchant of record, and AWS Marketplace purchases are billed by AWS Marketplace; each processes billing data under its own terms as an independent controller, not on the Data Controller's instructions. The Privacy Policy describes what they receive.
5. International Data Transfers
Raw Personal Data retained by the Data Processor is stored exclusively in AWS ap-northeast-2 (Seoul). For measurement purposes, the text of tracked prompts (with no user identifiers) is transmitted to AI providers (OpenAI, Anthropic, Google, Perplexity, OpenRouter), and brand-name search queries to SerpApi. By agreeing to this DPA, the Data Controller authorizes these transfers.
6. Data Subject Rights Assistance
The Data Processor will provide reasonable assistance to the Data Controller in responding to data subject rights requests (access, correction, deletion, restriction of processing). Requests will be processed within 30 days.
7. Incident Notification
In the event of a Personal Data breach, the Data Processor will notify the Data Controller within 72 hours of becoming aware. The notification will include the scope of the breach, its impact, remediation actions taken, and measures to prevent recurrence.
8. Audit Rights
Enterprise plan customers may request an audit of the Data Processor's security and processing procedures up to once per year. Audit scope and scheduling are subject to prior agreement.
9. Data Return and Deletion on Termination
Upon termination of the Service, the Data Processor will permanently delete all raw probe data and Personal Data within 30 days. A certificate of deletion will be issued upon the Data Controller's request.
10. Liability
The Data Processor's liability for damages suffered by the Data Controller due to a breach of this DPA or applicable law is governed by the liability provisions in the Nudgeo Terms of Service.
11. Application of This Revision
This revision applies from its effective date to accounts created on or after that date. For accounts created before the effective date, it applies 30 days after Nudgeo notifies the account owner by email, and the previous version of this DPA applies until then.
To request a signed copy of this DPA or an additional security checklist, contact security@nudgeo.com.