From Paris
128 rue La Boétie, 75008 Paris, France
This Data Processing Agreement ("DPA") forms part of the Howseen Terms of Service available at howseen.ai/terms (the "Terms") between Howseen and the customer who has accepted the Terms ("Customer"). It applies whenever Howseen processes Personal Data on behalf of Customer while providing the Service. In case of conflict between this DPA and the Terms, this DPA prevails as regards the processing of Personal Data.
Processor ("Howseen"): Howseen AI, a French company based in Paris, operated by Raphaël Aubry, SIREN 102456951, 128 rue La Boétie, 75008 Paris, France. Privacy contact: raphael@howseen.ai.
Controller ("Customer"): the legal entity or individual that has created a Howseen account and accepted the Terms, as identified in its account and billing details.
Where Customer itself acts as a processor on behalf of its own clients (for example an agency managing client brands), Howseen acts as Customer's sub-processor, and Customer warrants that its instructions are authorised by its client.
"GDPR" means Regulation (EU) 2016/679. "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings given in the GDPR. "Customer Personal Data" means Personal Data that Howseen processes on behalf of Customer under the Terms, as described in Annex 1. "Sub-processor" means any third party engaged by Howseen that processes Customer Personal Data. "SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914. "Service" has the meaning given in the Terms.
3.1 For Customer Personal Data, Customer is the Controller and Howseen is the Processor (or the sub-processor, as set out in Section 1).
3.2 This DPA does not cover Personal Data that Howseen processes as a Controller for its own purposes, such as account management, billing, security, support, service communications and legal compliance. That processing is described in the Howseen Privacy Policy (howseen.ai/privacy).
4.1 Subject matter: provision of the Service, a generative-engine-optimisation (GEO) platform that measures how AI assistants and search engines represent Customer's brand, and helps Customer create and publish content.
4.2 Duration: the term of the Terms, plus the period needed to delete Customer Personal Data under Section 12.
4.3 Nature and purpose: collection, storage, analysis, generation, publication (at Customer's request) and deletion of data, solely to provide the Service to Customer. Details are in Annex 1.
5.1 Howseen processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration and use of the Service (settings, connected accounts, tracked questions, content instructions, publication requests) are Customer's complete instructions at the date of this DPA. Further instructions must be in writing and consistent with the Service.
5.2 Howseen informs Customer without delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection law, and may suspend the affected processing until Customer confirms or changes the instruction.
5.3 Howseen does not sell Customer Personal Data, does not use it for advertising, and does not use it to train generalised AI or machine-learning models.
5.4 Customer is responsible for the lawfulness of the Personal Data it provides or asks Howseen to process, and does not submit special categories of data (Article 9 GDPR) or data relating to criminal convictions through the Service, which is not designed for them.
Howseen ensures that every person authorised to process Customer Personal Data is bound by an obligation of confidentiality and accesses it only as needed to operate, secure or support the Service.
7.1 Howseen implements the technical and organisational measures described in Annex 2, appropriate to the risk as required by Article 32 GDPR.
7.2 Howseen may update these measures over time, provided the overall level of protection is not reduced.
8.1 General authorisation. Customer gives Howseen a general written authorisation to engage Sub-processors within the categories listed in Annex 3. The current list of Sub-processors is provided to Customer on written request to raphael@howseen.ai.
8.2 Changes. Howseen notifies Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the account owner's address. Customer may object in writing, on reasonable data-protection grounds, within that period. The parties will then discuss in good faith; if no solution is found, Customer may terminate the affected Service and receive a pro rata refund of prepaid fees for the remaining period, as its sole remedy.
8.3 Emergency replacement. Where a Sub-processor must be replaced urgently to keep the Service secure or available, Howseen may do so immediately and notifies Customer as soon as possible; the objection right in 8.2 then applies from that notice.
8.4 Flow-down. Howseen imposes on each Sub-processor data-protection obligations offering at least the same level of protection as this DPA, and remains liable to Customer for the performance of its Sub-processors' obligations, as provided by Article 28(4) GDPR.
9.1 Howseen's primary database and application servers are located in the European Union (Frankfurt, Germany). Some Sub-processors, in particular providers of the AI models the Service queries, may process data outside the European Economic Area.
9.2 Any such transfer relies on a transfer mechanism under Chapter V GDPR: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the SCCs, together with any supplementary measures required.
10.1 Data Subject requests. Taking into account the nature of the processing, Howseen assists Customer by appropriate technical and organisational measures in responding to requests from Data Subjects (access, rectification, erasure, restriction, portability, objection). Most data can be viewed, edited or deleted by Customer directly in the Service. If Howseen receives a request directly, it forwards it to Customer without undue delay.
10.2 Other assistance. Howseen provides reasonable assistance to Customer with data protection impact assessments, prior consultations with supervisory authorities and security obligations (Articles 32 to 36 GDPR), taking into account the information available to Howseen.
11.1 Howseen notifies Customer without undue delay, and at the latest within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, by email to the account owner's address.
11.2 The notification includes, as far as then known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first is provided in phases without undue delay.
11.3 Howseen takes reasonable steps to contain the breach and mitigate its effects, and documents it. Notification of a breach is not an acknowledgement of fault or liability.
12.1 On written request made before the end of the Service, Howseen provides Customer with a copy of its Customer Personal Data in a commonly used format.
12.2 After the end of the Service, Howseen deletes Customer Personal Data: (a) on Customer's written request, within 30 days of that request; and (b) in any case, within 90 days after the end of the subscription. Copies held in encrypted backups are erased as those backups expire under the normal rotation cycle.
12.3 Howseen may keep data where Union or Member State law requires it (for example invoices under French accounting rules), in which case it keeps the data confidential and processes it only for that purpose.
12.4 Content that Customer has published on its own website or platforms through the Service remains under Customer's control.
13.1 Howseen makes available to Customer, on request, the information necessary to demonstrate compliance with Article 28 GDPR, including written answers to a reasonable security questionnaire (once per year, unless a breach or a supervisory authority justifies more).
13.2 If that information is not sufficient, Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, with at least 30 days' notice, during business hours, without disrupting the Service or accessing other customers' data, at Customer's expense. Audits of Sub-processors are carried out through the reports and certifications those Sub-processors make available.
Each party's liability under this DPA is subject to the limitations of liability set out in the Terms, except where such limitation is prohibited by applicable law.
15.1 This DPA is incorporated into the Terms by reference. Customer accepts it by accepting the Terms (creating an account or using the Service); no separate signature is required. A countersigned copy is available on request at raphael@howseen.ai.
15.2 This DPA remains in force as long as Howseen processes Customer Personal Data.
15.3 Howseen may update this DPA to reflect changes in law or in the Service. Material changes are notified by email at least 30 days before they take effect, except changes required by law or by a supervisory authority.
This DPA is governed by French law. Disputes are subject to the courts designated in the Terms.
| Categories of Data Subjects | Customer's users (account owner and team members); persons whose data appears in content Customer provides or asks Howseen to analyse or write; visitors to the blog hosted by Howseen for Customer, where applicable; persons in the data of accounts Customer connects, to the extent such data is personal. |
| Categories of Personal Data | Team members' contact details, role and access scope; author details chosen by Customer for articles; brand and website information (domain, brand, offer, competitors, public pages, Customer's instructions and comments); tracked questions and AI answers; generated and published content; connection data for the platforms Customer connects; search and analytics metrics from connected accounts; technical logs (hosted-blog access logs, API usage logs). |
| Special categories | None intended (Section 5.4). |
| Frequency | Continuous, for the duration of the subscription. |
| Nature of processing | Hosting, storage, querying AI engines with tracked questions, reading public web pages, text analysis and generation, publication to Customer's connected platforms at Customer's request, reporting, deletion. |
| Purpose | Providing the Service to Customer under the Terms. |
| Retention | For the duration of the subscription, then deletion under Section 12. |
| Category | Purpose | Location |
|---|---|---|
| Cloud hosting and database | Hosting of the application and database | European Union (Frankfurt, Germany) |
| AI model providers | Querying the AI engines tracked by the Service; analysis and content writing | European Union and United States, under SCCs or an adequacy decision |
| Search and AI-answer data providers | Collecting AI and search engine answers for tracked questions | European Union; SCCs apply to any processing outside the EEA |
| Web content retrieval | Reading the public pages of Customer's website | European Union |
| Transactional email | Sending service emails (invitations, reports, notifications) | European Union |
| Backup storage | Storage of encrypted backups | Under SCCs or an adequacy decision |
The current list of Sub-processors is provided to Customer on written request to raphael@howseen.ai. Changes are notified in accordance with Section 8.
Platforms that Customer chooses to connect (such as Google Search Console, Google Analytics, Bing Webmaster Tools or Customer's CMS or e-commerce platform) are services Customer contracts with directly; Howseen accesses them only on Customer's instruction and they are not Howseen's Sub-processors.
Howseen AI · 128 rue La Boétie, 75008 Paris, France · raphael@howseen.ai · Terms of Service · Privacy Policy
From Paris
128 rue La Boétie, 75008 Paris, France