Semrush procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ “European Data Protection Law” means the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national legislation implementing the GDPR and, if applicable, the UK data Protection Act 2018 and the UK GDPR.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ If your request relates to the European Data Protection Law, please contact:” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Privacy . By using the Services, you authorize us to obtain, process, store, use and transmit your personal data in accordance with our Privacy Policy, located at https://www.semrush.com/company/legal/privacy-policy/ , which forms an integral part of this Agreement. If you elect to use Third-Party Services (through API or otherwise), or tools within the Services that give Semrush access to personal data contained within your User Content, you agree that you are the data controller of any such personal data, and the Data Processing Agreement, located at https://www.semrush.com/company/legal/dpa/ (the “ DPA ”) will apply to Semrush’s processing of such personal data on your behalf. Any capitalized terms not otherwise defined in the DPA shall have the same meaning as in this Agreement. In the event of a conflict between this Agreement and the DPA, the DPA will control. You acknowledge that the Services have not been designed to process or manage sensitive information, and you agree not to use the Services to collect, manage or process sensitive information. We will not have, and we specifically disclaim, any liability that may result from your use of the Services to collect, process or manage sensitive information. “Sensitive information” includes, without limitation: (a) protected health information (as defined under HIPAA); (b) nonpublic personal information (as defined under the Gramm-Leach-Bliley Act); or (c) special categories of data or sensitive personal information (as defined under Applicable Data Protection Laws).” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where we transfer your personal data as described above, we will take steps to ensure that your personal data receives adequate security protection where it is processed and your rights continue to be protected pursuant to the applicable data protection law, including through the use of Standard Contractual Clauses approved by the European Commission. In some cases, transfers of your personal data to us is necessary to perform the agreement we have entered into, or are about to enter into, with you. If you would like to receive more information on the safeguards that we implement as described above, please contact us as indicated below.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ SEMrush Inc. is based in the United States and other members of our group are based in countries outside the EEA or the UK (please read the Affiliates section above for more information). If you are accessing our websites and the Services from the EEA, the UK or other regions with laws governing data collection and use, please note that in connection with our business and for administrative, management and legal purposes, we may transfer your personal data from the country where you reside to SEMrush Inc. in the United States and to other members of our group in the jurisdictions in which our affiliates are established and to our service providers in the United States. These countries may have data protection laws less stringent than or otherwise different from the laws in effect in the country in which you are located.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ After the integration we will be able to store in our database in the encrypted way the following information related only to outreach emails sent by you via tool interface:” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ machine-readable, readily usable format.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain your personal data for as long as reasonably necessary to provide the Services and fulfil the transactions you have requested, complying with our legal obligations or for other legitimate business purposes, such as maintaining business and financial records, resolving disputes, maintaining security, detecting and preventing fraud and abuse, and enforcing our agreements. After the applicable retention period has elapsed, your personal data will be anonymized or deleted.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ De-Registration . You may delete your Account at any time by sending a request through the form located at https://www.semrush.com/kb/support/ . If you delete your Account, Semrush may delete all your data and information stored on Semrush servers and Semrush will bear no responsibility for the deletion or loss of such data or information. Even if you delete your Account, you agree to pay all Fees incurred prior to de-registration until paid in full.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ If you ask us to delete your data or to be removed from our marketing lists and we are required to fulfill your request, to keep basic data to identify you and prevent further unwanted processing.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ You can revoke your permission and access to your Mailbox account at any time by clicking the “bin” icon next to the mailbox mention inside the tool. You can delete all your previous emails available due to the integration by deleting the project in the tool during the revocation process, or sending us the relevant request. As soon as you revoke the access, we will remove your Mailbox token which allowed us to carry out the functions mentioned above and stop monitoring your emails immediately.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Effect of Termination . Upon expiration or termination of this Agreement, including by your cancellation, or if you de-register your Account, all rights of the Customer with respect to the use of the Services shall terminate immediately. Customer acknowledges and agrees that Semrush may erase all Customer data and information stored on Semrush servers within reasonable period of time (not less than thirty (30) days) following expiration or termination of the Agreement or de-registration of your Account, provided that Semrush may retain copies of such data and information to the extent required by law, for archival purposes or as created by automatic computer backup and archived as part of normal computerized archiving systems, maintaining necessary technical and organizational measures.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ https://maps.google.com/help/terms_maps/ ; and Google Privacy Policy at https://www.google.com/policies/privacy/ . In addition to normal procedure for deleting stored data, you can revoke access to your data via the” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Deletion of personal data that we no longer need to provide the Services or for other lawful purposes.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Third-Party Services and Linked Websites . The Services may be used to interface with certain third-party services and applications (“ Third-Party Services ”). Third-Party Services are governed by the terms made available by the provider of such Third-Party Service. Semrush may also provide tools through the Services that enable you to exchange information, including User Content (as defined in the Content Policy), between the Services and Third-Party Services. By using one of these tools, you hereby authorize Semrush to transfer that information to the applicable Third-Party Service(s). Semrush is not responsible for monitoring any transaction between you and any such Third-Party Services. You are responsible for reviewing the terms of use and privacy policy of any Third-Party Services before sharing any User Content or information with such Third-Party Services. Once sharing occurs, Semrush has no control over the information that has been shared, and Semrush will not be able to remove such information from third-party servers. Semrush disclaims all liability for any data security or privacy breaches that may occur once information is shared with Third-Party Services. The Services may also contain links to third-party websites (“ Linked Websites ”). Semrush is not responsible for the content or practices of Linked Websites and disclaims any liability related to your use of Linked Websites.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ features, such as the Facebook or LinkedIn button. You are the only person who decides if you would like to press this button and share your personal data with the respective third-party operators of widgets or social media. These widgets and features collect your IP address, the information about the page you are visiting during your use of the Services and may set a cookie to enable the feature to function properly. Widgets and social media features are either hosted by a third party or hosted directly within our Services. Your interactions with these features are governed by the privacy policy of the company providing it and we recommend that you read them prior to sharing your data with such third parties.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Google Analytics. The Services use Google Analytics, a web analytics service of Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). The use includes the "Universal Analytics" operating mode. This facilitates the assignment of data, sessions and interactions across several devices to a pseudonymous user ID and thus the analysis of a user's activities across devices.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Our authorized resellers or distributors, for example, if you purchase access to the Services through one of these partners. The personal data we may receive includes business contact information, including mailing addresses, job titles, email addresses, and phone numbers.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Legal Requirements . We may share your personal data so that we can comply with a legal obligation to which we are subject, protect and defend the rights or property of Semrush, act in urgent circumstances to protect your personal safety or that of the public, or protect Semrush against legal liability. For example, where we are obliged to share your personal data with regulatory bodies which govern our work and services; government departments such as law enforcement, courts orders; financial institutions; external auditors; etc.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service Providers . We may engage other companies and people to perform tasks on our behalf - meaning they are helping us provide our Services. In particular, we use third party providers of payment processing, fraud prevention, and risk assessment, hosting and other information technology services, email communication and customer support services, analytics and data providers, marketing, advertising and investor relations. Following our instructions, these parties may process your personal data in the course of providing the relevant services to us. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Other third parties, such as email campaigns, marketing partners, publicly-available sources and data providers. The personal data we may receive includes company information, location information, demographic information, and business contact information, including mailing addresses, job titles, email addresses, and phone numbers. We may use this information to enhance the information that we already maintain about you and to improve the accuracy of our records, in addition to other purposes described in this Privacy Policy.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Affiliates . We may disclose your data to our affiliates for administrative purposes; to help provide our Services (such as providing engineering services), and related customer support or to conduct sales and marketing activities on our behalf. For example, if you request information about a company or a service from a Semrush company, then we may pass your personal data relevant to such request onto another Semrush company to enable them to appropriately respond to your request.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share your Personal Information collected during the course of your usage of online stores we make available, with providers of hosting, payment and delivery services. For example, we use the service Shopify to power our online store https://merch.semrush.com and ShipBob for the delivery of goods.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ share your personal data such as name, last name and email address with our authorized resellers distributors,” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ If we have not entered into a contract with you, to operate and administer our websites, to provide you with content you access and request (e.g., to download content from our websites), and to respond to your requests for our Services (including sharing your personal data with our resellers as necessary to respond to your request for the Services in an efficient manner and facilitate the sale of our Services, as described in the ‘ How We Share Your Personal Data ’ section below);” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To (a) comply with legal obligations and legal process; (b) respond to requests from public and government authorities, including public and government authorities outside your country of residence; (c) enforce our Terms of Service; (d) protect our operations; (e) protect our rights, privacy, safety of property, and/or that of you or others; and (f) allow us to pursue available remedies or limit the damages that we may sustain.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Notwithstanding anything herein to the contrary, we will use the data received via Mailbox integration only to provide you with the features mentioned above in order to enhance your email experience for productivity purposes and for monitoring purposes. We may also transfer data received via Mailbox integration as necessary to comply with applicable law or as a part of a merger, acquisition, or sale of assets with notice to users. All other transfers or sales of the user data received via Mailbox integration are prohibited.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Social networking websites . Where permissible according to applicable law or with your consent where required by law, we may use certain limited personal data about you, such as your email address, to hash it and to share it with social network websites, such as Facebook, LinkedIn or Google, to generate leads, drive traffic to our websites or otherwise promote our products or Services. The social network websites with which we may share your personal data are not controlled or supervised by us. Therefore, any questions regarding how your social network websites service provider processes your personal data should be directed to such provider.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Semrush will not sell, rent, lease or otherwise provide your personal data to others, except in order to provide you with the products and services you request and as further described below, or with your permission or as required by applicable law.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Business Transfers . If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of our assets, or transition of a service to another provider, your personal data and other information may be transferred to a successor or affiliate as part of that transaction.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Subcontracting . Semrush may, at its expense, subcontract the provision of any portion of the Services, provided, however, that Semrush will not be relieved of any of its obligations under this Agreement by such subcontracting.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ "Affiliates“ means entities in our group who are listed in this Privacy Policy (please read the Affiliates section).” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ API YouTube. Semrush uses YouTube API Services. If you are using our Services, by agreeing to our Privacy Policy you hereby also certify that you have read and agree to YouTube’s General Terms of Service ( https://www.youtube.com/t/terms ) and Google’s” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ price of each product purchased;” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ discount amount (if any);” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Visitors and Customers . You can visit the Website in a visitor (non-registered) capacity; provided, to use the Services, you must register as either a paid or unpaid user. As an unpaid user, you will have access only to certain limited functionality within the Services that Semrush elects to make available on an unpaid trial or free basis (“ Unpaid Services ”). As a paid user you will have access to certain additional features as specified in your subscription (“ Paid Services ”).” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.