Legal
Data Processing Addendum
Last updated 4 September 2026. Soft-launch draft for invite-only customers.
This Data Processing Addendum (“DPA”) supplements the Terms of Service when we process personal data on your behalf while providing serpcheck.
1. Roles
You are the controller of account-user emails and client contact data you enter. Diversified Tech Solutions / Trileaf is the processor for that personal data when operating the Service. You remain responsible for lawful collection and instructions.
2. Subject matter
We process: login emails, password hashes, optional branding assets, domain/keyword tracking data you submit, report recipients, alert preferences, and optional Google Search Console tokens if you connect GSC.
3. Sub-processors
- Infrastructure host for the serpcheck guest VM and related networking
- Transactional email relay used for password resets, invites, reports, and digests
- DataForSEO (and optional failover SERP vendors) for rank and keyword research APIs
- Google LLC, only if you connect Search Console OAuth
We will not add a material new sub-processor category without updating this page.
4. Security
Access is authenticated, sessions use HTTPS cookies, passwords are hashed, and tenant data is scoped by account in application logic. You should keep credentials confidential and use unique passwords.
5. Retention & deletion
Raw SERP snapshots expire on a rolling window (~90 days). Rank history and reports may be kept longer for comparisons. On written request to avery@diversifiedtechsolutions.com we will delete or anonymize account data within a reasonable period, except records we must keep for security, dispute, or legal obligations.
6. International transfers
Processing may occur in the United States. By using the Service you instruct us to process data as described here.