Effective date: June 5, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between NextEO, part of MediaSavior L.L.C. ("NextEO," "we") and the customer ("Customer," "you") for the use of nexteo.ai and app.nexteo.ai (the "Service"). It applies where NextEO processes Personal Data on your behalf and reflects the requirements of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and similar data protection laws.

1. Roles of the Parties

For Personal Data you submit to the Service, you are the controller and NextEO is the processor. NextEO processes such Personal Data only on your documented instructions, including as set out in this DPA and the agreement, and as needed to provide and secure the Service.

2. Subject Matter and Duration

The subject matter is the provision of the Service. Processing continues for the term of the agreement and for the limited period afterward described in Section 6.

3. Nature and Purpose of Processing

NextEO processes Personal Data to operate AI search visibility analysis, monitoring, reporting, billing, and related features you request. Categories of data subjects may include your team members and the contacts associated with the websites you analyze. Categories of Personal Data may include account details (name, email), authentication data, usage data, and any data contained in the websites and content you submit for analysis.

4. Our Obligations

Process Personal Data only on your documented instructions.
Ensure personnel authorized to process Personal Data are bound by confidentiality.
Implement appropriate technical and organizational security measures (Section 7).
Assist you, taking into account the nature of processing, with data subject requests and with your obligations under Articles 32 to 36 GDPR.
Make available information reasonably necessary to demonstrate compliance.

5. Subprocessors

You authorize NextEO to engage subprocessors to provide the Service. NextEO imposes data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for their performance. Our current subprocessors include:

Render: Application hosting and compute: the API, background workers, and cron.
Neon: Managed PostgreSQL database: your account, websites, scores, and connected-account data are stored here.
Upstash: Managed Redis for background job queues, rate limiting, and usage counters.
Stripe: Payment processing and subscription billing (card details are entered on Stripe and never reach our servers).
Resend: Transactional and lifecycle email delivery.
Sentry: Error monitoring (with secrets and personal data redacted).
OpenAI: AI visibility testing, the EO assistant (ChatGPT), and the ChatGPT Ads integration.
Anthropic: AI visibility testing (Claude).
Google: AI visibility testing (Gemini), the Search Console and Analytics connections you choose to enable, business-listing and review lookups for reputation (Google Places), and optional Google sign-in.
Perplexity: AI visibility testing (Perplexity).
xAI: AI visibility testing (Grok).
SerpAPI: Search-result and review-listing lookups for reputation monitoring (optional features).
Google Analytics, Meta, LinkedIn, Apollo, OpenAI (Ads pixel): marketing-site analytics and advertising (consent-gated, load only after cookie acceptance)

We will give you a way to be notified of new subprocessors and an opportunity to object on reasonable data protection grounds. Contact us at the address below to request the current list or to subscribe to updates.

6. Return and Deletion

On termination of the agreement, NextEO will, at your choice, delete or return Personal Data and delete existing copies within a commercially reasonable period, unless retention is required by law.

7. Security

NextEO maintains technical and organizational measures appropriate to the risk, including encryption in transit, access controls, authentication, least-privilege practices, and monitoring. Details are available on request.

8. International Transfers

Where Personal Data is transferred outside the EEA, the UK, or Switzerland, such transfers are made under an appropriate transfer mechanism, such as the EU Standard Contractual Clauses, where required.

9. Personal Data Breach

NextEO will notify you without undue delay after becoming aware of a Personal Data breach affecting your Personal Data and will provide information reasonably available to help you meet your notification obligations.

Contact

NextEO, part of MediaSavior L.L.C.
nexteo@mediasavior.com