Data Handling

Customers determine which accounts and information they authorize us to process. We act as their processor or service provider, or as a subprocessor where the customer acts for an underlying client. We separately act as controller for our own account, website, and billing administration.

Connections are limited to supported accounts and features that customers authorize. Connection screens identify the requested permissions and purpose. Access covers relevant account, advertising, and measurement data, along with content and associated metadata authorized for the enabled feature, as described in our Privacy Policy.

We perform write actions only under an authorized instruction, approved automation setting, or agreed services scope. A technical permission alone does not authorize every available action. Customers must obtain underlying client permissions and provide required notices before connecting an account.

We process Customer Data to provide, maintain, secure, and support the customer's Service and execute authorized instructions. Professional-services access is limited to the engagement's authorized scope. Necessary account and payment records support billing; connected account contents are not made available for unrelated collection purposes.

We do not sell Customer Data, share it for cross-context behavioral advertising, use one customer's Connected System Data to serve another customer, or use Customer Data to train generalized AI models or authorize providers to do so. De-identified operational telemetry may improve reliability and performance, but may not be used to bypass these restrictions.

Access is limited to authorized personnel and contracted providers with a need to know and appropriate confidentiality and data-protection obligations. AI or other processing providers used for an enabled feature may process relevant content only for that feature under applicable restrictions, not for their independent purposes.

Applicable platform-specific requirements, including Google Limited Use where applicable, govern access and use as described in our Privacy Policy and DPA.

Subprocessor identities, purposes, locations, and applicable change notices are available through our Subprocessor Information page. Stripe handles payments and may act as an independent controller for its payment and compliance functions.

We maintain the measures described in the DPA, including encryption, access controls, logging, and incident-response procedures. Controls are designed to separate customer data and limit unauthorized access; no system is guaranteed to prevent every incident.

We notify customers of personal-data breaches without undue delay as required by the DPA and applicable law. Notification is not an admission of liability. Customers are responsible for their credentials, invited users, and configurations of systems they control.

Customers may revoke a connection through the Service or the connected provider. Revocation stops future access but does not itself erase previously retained data. Deletion requests can be sent to support@theadspend.com.

When the relevant processing ends, we return or delete Customer Personal Data under the DPA, subject to permitted legal retention and routine backup expiration. A customer may request return of available data within 30 days after termination. Retained data remains protected and is not used for new purposes.

International transfers are governed by the International Data Transfer Annex where applicable. Other disclosures and transfers remain subject to the Privacy Policy and DPA.

Contact support@theadspend.com with questions or to request available security documentation.