Exploding Topics

GDPR overview

GDPR compliance is asserted on the publisher's pages rather than on the tool's own domain: the Semrush security page states that its products adhere to GDPR requirements effective 25 May 2018. Measures cited include data minimisation, lawful processing, a sub-processor list kept available to customers, data processing addenda signed with customers and vendors, and rights-respecting marketing. International transfers from the EEA and the United Kingdom to the United States rely on standard contractual clauses approved by the European Commission. Rights are exercised by emailing support@explodingtopics.com or writing to Semrush Inc., 800 Boylston St, Suite 2475, Boston, Massachusetts 02199, US, and a complaint may be lodged with a supervisory authority. CCPA and LGPD are also monitored. No Article 27 EU representative and no data protection officer is named. The privacy policy is dated October 2024.

Who owns the data?

Semrush Inc. is named as the entity responsible for processing personal data under the privacy policy. Account data - name, address, phone, email, login credentials, billing, transaction and card details - is collected at sign-up or payment, while browsing stays anonymous by default: IP addresses are logged but not linked to personal data until the user signs in. Section 6 of the terms reserves all rights, title and interest in the website and services to Exploding Topics, its licensors or affiliates, so the platform and its trend data remain the publisher's property. Users retain rights of access, portable copy, rectification, deletion, objection, withdrawal of consent and opt-out from targeted advertising. The publisher states it does not sell, rent or lease personal data to third parties.

Reuse rights

The published documentation describes what the publisher does with the data rather than granting subscribers an explicit reuse licence. Personal data is processed to deliver the service and support, handle transactions and manage accounts; to send product news, events and promotions by email or push notification; and, on a legitimate-interest basis, to administer the site, manage the customer relationship, analyse preferences, interests and behaviour in order to identify insights, trends and correlations, and improve the service. Internal purposes cover data analysis, benchmarking, audits, research, surveys, fraud prevention and systems security. Data is shared with service providers (payment, fraud prevention, hosting, IT, email, support, analytics, marketing, investor relations), affiliated companies and social platforms (hashed email addresses for Facebook, LinkedIn and Google), and may pass to an acquirer in a corporate transfer or to authorities under a legal obligation. Selling, renting or otherwise providing personal data outside those cases is explicitly excluded. Because section 6 of the terms keeps ownership of the website and services with the publisher, no blanket right to redistribute exported trend data is granted to the end user.

Data retention & training

Hosting summary

According to the publisher's security page, service data is stored in physically secure data centres located in the United States, on Amazon Web Services. Those data centres are presented as holding the usual compliance certificates, with a pointer to the AWS compliance page. Data is encrypted with AES-256 at rest and TLS 1.2 or above in transit, and frequent encrypted backups are taken. Employee access goes through a VPN, and two-factor authentication is available on the product. PCI DSS Level 1 status is confirmed each year by an independent QSA audit, penetration tests are run annually, and a bug bounty programme is hosted on HackerOne. Transfers of personal data from the EEA and the United Kingdom to the United States rely on the standard contractual clauses approved by the European Commission. Two gaps are worth recording: no SOC 2 or ISO 27001 certification is mentioned anywhere, and no European data residency option is offered.