Sub-processors
This list is Annex IV of the Data Processing Agreement (DPA). Last updated: 2 November 2026.
Klarplan AG informs customers by email at least 30 days before adding or replacing a sub-processor. At the same time, it announces the change on this page with the date from which it applies (DPA A.8 para. 2).
Announced changes #
No changes are currently announced.
List of sub-processors #
Agreed list under Clause 7.7(a) (Option 2). As of 2 November 2026. The current version is available at https://rankscan.ai/subprocessors.
The duration of processing is at most the term of this Agreement. "Not specified" means: the provider's contract makes no statement on this. "Retention at the provider" states the periods at the provider; Klarplan AG's periods are set out in Annex II. "Restricted" denotes a restricted AI assistant under A.4 para. 6 or the service through which such an assistant is queried.
01 Amazon Web Services EMEA SARL #
38 avenue John F. Kennedy, L-1855 Luxembourg
| Activity | Database, application server and test environment (Lightsail), backups (S3), e-mail delivery (SES, Frankfurt) |
|---|---|
| Customer Data | all Customer Data |
| Place of processing | EU, Frankfurt (eu-central-1) |
| Retention at the provider | according to Klarplan AG's periods |
| Training with Customer Data | no |
| Transfer basis | Processing in the EU; AWS Data Processing Addendum with SCC 2021/914 and Swiss Addendum |
02 OpenAI Ireland Ltd. Not restricted #
1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland
| Activity | Strategy dialogue, suggestions, content briefs, e-mail drafts to cited sources, summaries, triage of support requests, AI visibility |
|---|---|
| Customer Data | Prompts; topics, keywords, region; positioning, brand terms, competitor names; text of up to 6 pages of the Customer's website (up to 3,000 characters each) with page title and headings (up to 1,000 characters); page title for meta description suggestions; for content briefs, excerpts from answers of the AI assistants (up to 800 characters each) and their search queries, URLs and titles of cited pages, path and page title of the selected page (up to 120 characters); for e-mail drafts, name, address and language of the website, URL and type of the cited source and whether the source grants placements for payment, with the detected word from a fixed list (for example "Sponsored"), without text of the source; in summaries, the content of the measures: keywords with positions, prompts, competitors, URLs and titles of cited pages, Search Console metrics per page (URL, clicks, impressions, click-through rate, position); subject and text of support requests with name and domain of the website, page URL and Plan, without screenshots and without the sender's account details (name, e-mail). Details that the sender writes into the text itself are included. |
| Place of processing | USA and other countries of OpenAI's sub-processors, without data residency in Europe |
| Retention at the provider | up to 30 days (abuse monitoring) |
| Training with Customer Data | no |
| Transfer basis | The contracting party for customers domiciled in Switzerland is OpenAI Ireland Ltd.; Ireland provides adequate protection under Annex 1 DPO. Data under EEA and Swiss law are processed by OpenAI Ireland Limited. OpenAI bases onward transfers outside the EEA and Switzerland, for example to OpenAI OpCo, LLC, on SCC 2021/914 (DPA of 1 January 2026, para. 4.1). The DPA does not provide for an adaptation of the SCC for Switzerland in this respect. OpenAI OpCo, LLC is not certified under the Data Privacy Framework. |
03 Google Cloud EMEA Limited Not restricted #
Velasco, Clanwilliam Place, Dublin 2, Ireland
| Activity | Gemini API (paid tier): AI visibility with Google Search, review of measures, review of own mentions |
|---|---|
| Customer Data | Prompts; excerpts from AI answers; business context (brand, domain, topics, keywords, region); name and domain of the website; text of the measure with the most frequent queries, impressions, clicks and position per page from Search Console; result of the measurement review with the page title from the last retrieval (up to 120 characters) |
| Place of processing | not specified |
| Retention at the provider | 55 days (abuse monitoring); with Google Search 30 days, cannot be disabled |
| Training with Customer Data | no |
| Transfer basis | Data Processing Addendum for Products Where Google is a Data Processor with SCC 2021/914; the DPA also covers data under the FADP. Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework. |
04 Groq UK Limited Not applicable #
3 Hammersmith Grove, London W6 0ND, United Kingdom
| Activity | Evaluation of AI answers: brands, relevance, suitability of cited pages. Groq receives no AI visibility prompts; it evaluates answers. |
|---|---|
| Customer Data | Answer texts; business context (brand or website name, domain, topics, up to 60 keywords, region); names of brands and competitors; URL, title and up to 4,000 characters of text of third-party pages cited in an AI answer |
| Place of processing | USA (Google Cloud) |
| Retention at the provider | none by default; logs in the event of malfunction or abuse for up to 30 days |
| Training with Customer Data | no |
| Transfer basis | Groq Data Processing Addendum with SCC 2021/914 (Modules 2 and 3) and adaptation for Switzerland |
05 Anthropic Ireland, Limited Not restricted #
6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland
| Activity | AI visibility, only if selected by the Customer |
|---|---|
| Customer Data | Prompts |
| Place of processing | worldwide at the provider's discretion |
| Retention at the provider | 30 days; up to 2 years in the event of a violation of the usage policies |
| Training with Customer Data | no |
| Transfer basis | Anthropic Data Processing Addendum with SCC 2021/914 (Modules 2 and 3) and Swiss Addendum. Anthropic, PBC (USA) is not certified under the Data Privacy Framework. |
06 Perplexity AI, Inc. Restricted #
115 Sansome Street, Suite 900, San Francisco, CA 94104, USA
| Activity | AI visibility, only if selected by the Customer |
|---|---|
| Customer Data | Prompts |
| Place of processing | USA. Perplexity and all of its sub-processors are located in the USA. |
| Retention at the provider | Personal data in inputs until deletion by the customer, at the latest 30 days after the end of the service (DPA Annex 1). Separate rules may apply to individual services. |
| Training with Customer Data | no (DPA §5) |
| Transfer basis | Perplexity Data Processing Addendum (version of 13 August 2026) with SCC 2021/914 (Modules 2 and 3) for data under EU and UK law. The DPA does not cover data under the FADP. Perplexity AI, Inc. is not certified under the Data Privacy Framework. Klarplan AG has prepared a transfer impact assessment and reviews it at least annually. |
07 Cloro Incorporation Ltd. Restricted #
168 Triq San Kristofru, Valletta VLT 1467, Malta
| Activity | Querying Microsoft Copilot, only if selected by the Customer |
|---|---|
| Customer Data | Prompts, country code of the website |
| Place of processing | USA (application, database and backups at DigitalOcean) and Germany (query at Hetzner). The request to Copilot is sent from the website's country. Further sub-processors of cloro with purpose and location: https://cloro.dev/our-commitment-to-security/ (section "Subprocessors"). |
| Retention at the provider | Synchronous requests and results are not stored after the response; asynchronous jobs and results for about 24 hours; telemetry including the text of the prompts for 6 months; application logs 7 days; backups 7 to 14 days; deletion on request within 30 days. These periods are stated by cloro; they are not contractually guaranteed. |
| Training with Customer Data | no according to cloro, not contractually guaranteed; the Terms (§6.2) permit only aggregated, de-identified use. Microsoft may use the prompts to improve Copilot (A.4 para. 5). |
| Transfer basis | Disclosure to cloro (Malta): adequate protection under Art. 16(1) FADP and Annex 1 DPO; within the EU no transfer under Chapter V GDPR. Onward transfer to DigitalOcean, LLC (USA): DigitalOcean is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework. In addition, the cloro Data Protection Agreement with SCC 2021/914 (Module 2) applies; para. 6(a) places transfers from Switzerland under the SCC; the DPA contains no adaptation to the FADP and the FDPIC. For Better Stack (logs; Germany and USA) and Snapshooter (backups; USA), the contract between cloro and the service applies. Klarplan AG does not know this contract. cloro is liable for both under DPA §5(c). The onward transfer to Microsoft Copilot takes place on the Customer's instruction (A.4 para. 5; clause 8.8 of the cloro Data Protection Agreement). |
08 Google Cloud EMEA Limited: Google Workspace #
Velasco, Clanwilliam Place, Dublin 2, Ireland
| Activity | Mailbox hello@rankscan.ai: support, instructions, internal notification of support requests |
|---|---|
| Customer Data | Content of the Customer's e-mails; excerpts from support requests |
| Place of processing | not specified |
| Retention at the provider | according to Klarplan AG's periods |
| Training with Customer Data | not specified |
| Transfer basis | Google Cloud Data Processing Addendum, accepted for the rankscan.ai account |
09 DataForSEO OÜ #
Vesivärava tn 50-201, 10152 Tallinn, Estonia, registration number 14502291
| Activity | Retrieval of search results (SERP), keyword metrics and search visibility |
|---|---|
| Customer Data | Keywords, domains, URLs, language and country settings (personal data only insofar as search results contain them) |
| Place of processing | EU (Estonia, Germany at Hetzner) and USA (Google Cloud, Microsoft Azure) |
| Retention at the provider | Job data temporarily cached after retrieval; logs according to the provider's periods |
| Training with Customer Data | no |
| Transfer basis | Disclosure to DataForSEO OÜ (Estonia): adequate protection under Art. 16(1) FADP and Annex 1 DPO; within the EU no transfer under Chapter V GDPR. Onward transfer to sub-processors in the USA: DataForSEO Data Processing Agreement (part of the Privacy Policy) with Standard Contractual Clauses (SCC). |
10 Cloudflare, Inc. #
101 Townsend Street, San Francisco, CA 94107, USA
| Activity | Reverse proxy, DDoS protection and web application firewall for the application, reporting API, MCP server and test environment; server access (Zero Trust) |
|---|---|
| Customer Data | all data in the traffic with the application, reporting API, MCP server and test environment, including users' IP addresses and browser data. The TLS connection terminates at Cloudflare (Annex III). |
| Place of processing | worldwide, in the Cloudflare data centre closest to the user; also outside the EEA and Switzerland (DPA para. 6.1) |
| Retention at the provider | not specified; the DPA limits processing to the term of the contract with Cloudflare or until it is no longer necessary for the service (Annex 1) |
| Training with Customer Data | not specified; the DPA limits processing to the provision of the service (para. 3.1(a)) |
| Transfer basis | Cloudflare Data Processing Addendum (version 6.4 of 3 April 2026), part of the Self-Serve Subscription Agreement. Cloudflare, Inc. is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework. If the certification lapses, the SCC 2021/914 (Modules 2 and 3) with the adaptation for Switzerland apply under DPA para. 6.2. |
Default selection of AI assistants. Without a selection of its own by the Customer, the prompts of a new website are sent to OpenAI and Gemini. Anthropic, Perplexity and cloro receive prompts only if the Customer selects them. Restricted AI assistants (A.4 para. 6) are never part of the default selection.
Services without Processing on Behalf #
RankScan uses the following services. They are not sub-processors.
| Service | Classification | Reasoning |
|---|---|---|
| Google LLC: Search Console API | independent controller; data source of the Customer | The Customer connects its Search Console. Google provides data from its own search under the Google APIs Terms with controller-to-controller terms. RankScan sends only the credentials and page URLs. |
| Google LLC: Chrome UX Report API | service without personal data | RankScan sends only page URLs and receives aggregated loading times. |
| Google LLC: Favicon service (S2) | service without personal data in the specific use | RankScan queries the service only if a website does not provide a favicon itself. The server sends only the domain name, no IP address or browser data of users. |
| Wikimedia Foundation, Inc.: Wikidata | service without personal data in the specific use | RankScan sends only the domain of the website as the search term. |
| Serper (Serper.dev) | service without personal data in the specific use | RankScan sends Serper exclusively topic-related search terms (keywords) and the country and language code, without domain, account, user or IP data of the Customer, in order to retrieve public Google search results. The entry of personal data in keywords is excluded under Annex II, Section 4 para. 5. |
| Third-party websites | no recipient | RankScan retrieves public pages, including favicons of competitors, and sends only the request. |
| Google Tag Manager, Google Analytics 4, Google Ads, OpenAI pixel in the application | area of responsibility of Klarplan AG; only with consent | Measurement of registration and subscription in accordance with the Privacy Policy. |
| Stripe, Mautic (self-hosted) | area of responsibility of Klarplan AG | Billing and own e-mails. |
| Microsoft (Copilot) | recipient on the Customer's instruction (A.4 para. 5); independent controller without a contract with Klarplan AG | cloro submits the prompts to the consumer interface of Microsoft Copilot, only if selected by the Customer. Microsoft processes them under its own terms and may use them to improve Copilot. |
| Services connected by the Customer, for example Looker Studio or an MCP client | recipient on the Customer's instruction | The Customer connects them itself. They are not sub-processors of Klarplan AG. |