Data Processing Addendum

This Data Processing Addendum ("DPA") is between you and adcrew LLC, a Georgia limited liability company ("AdCrew") — the counterparty named in Terms of Service §1. It forms part of the AdCrew Terms of Service (section 11). It applies where you are the data controller and AdCrew is your data processor — that is, for the advertising data, audience data, and campaign data we handle on your behalf to operate the service (see Privacy Policy, section 2). For your account, billing, and support data, AdCrew is the controller and this DPA does not apply. If you operate agency workspaces for end clients, this DPA also applies workspace-by-workspace: the end client is the controller of its workspace data, you instruct us on its behalf, and we process as described in Privacy Policy section 2a and Schedule 2 to this DPA. Capitalized terms not defined here have the meaning in the Terms or the Privacy Policy.

1. Subject matter and duration

The subject matter is AdCrew's processing of personal data on your behalf in the course of operating the AdCrew service: planning, launching, and optimizing advertising campaigns in the ad accounts you connect, building and managing audiences, and running the analytics and audit functions the service needs. Processing lasts for as long as your account is active, plus the retention periods stated in Privacy Policy, section 8 (for example, the 15-day recovery window after cancellation, and billing records kept up to 7 years as tax law requires).

2. Nature and purpose of processing

We process your data only to operate the service, on your instructions, and never for our own purposes. In practice that means: reading campaign structures and performance metrics from the ad platforms you connect; storing your campaign configurations, audiences, creative assets, and audit records; executing campaign actions you approve; and providing security for the processor services. Instructions arrive through your use of the service (your dashboard, API calls, and approval queue); we follow them and flag anything that looks like a mistake. We may use advertising performance data to produce anonymized, aggregate service benchmarks only as described in Privacy Policy section 4a, only when at least five clients contribute, with no client identifiers, and we stop including an account prospectively after it opts out. A benchmark cell backed by fewer than five clients is suppressed and never published.

3. Categories of personal data

Categories of data subjects: your personnel and account users; your customers, prospects, website and app visitors, and audience members whose data you instruct us to process; individuals whose data appears in ad accounts you connect; and customers of a Shopify store you connect; and, for agency workspaces, your end clients and their authorized viewers.

• Advertising data: campaign structures, performance metrics, and spend from your connected ad platforms.
• Audience data: customer lists you upload or send via the API — emails and phone numbers are normalized and SHA-256 hashed on receipt; raw contact data is never kept in our database.
• Operational data: audit-log entries recording actions our agents take on your behalf.
• Technical data: IP addresses, device and browser identifiers, and usage logs collected for security and troubleshooting.
• Platform credentials and tokens: OAuth tokens, API keys, seat credentials, and connection identifiers for accounts you connect.
• CMS credentials: credentials you provide for an approved GEO publishing connection.
• GEO data: brand details, monitoring questions, AI-surface responses, scores, and recommendations.
• Signal Stack data: visitor and conversion events, click and device identifiers, and hashed customer identifiers from properties you designate.
• Shopify data: store profile information, hashed customer identifiers, order data, and store events from a store you connect.
• Six-offerings data (the offerings in Terms section 3e): your end customers' phone numbers, names, and email addresses; call records (caller number, time, duration, and outcome) from call tracking; text messages sent and received for missed-call text-back, AI booking, and review requests; consent and opt-out records; bookings; landing-page leads (name, email, phone, and message); and review data (reviewer name, star rating, and review text) — as described in Privacy Policy section 3d. Unlike audience data, these contact details are stored in usable form — some field-level encrypted, some in plain text, exactly as Privacy Policy section 3d describes — because texting, calling back, and replying cannot be done from a hash.
• Marketplace data (only when the marketplace is open): aggregated, de-identified audience products you buy from other clients through the marketplace, subject to the aggregation floor in Privacy Policy section 11 (at least 5 contributing clients and at least 1,000 individuals per cell, small cells suppressed, no row-level records). You must not attempt to re-identify any individual from a marketplace product, and marketplace products are licensed for your advertising use only (see Terms, section 3).
• Agency workspace data (where you operate workspaces for end clients): the categories above for each workspace, plus the per-workspace client price you declare and your branding assets, and viewer account data — as described in Privacy Policy section 2a.

We do not process PHI, and you must not upload PHI or GDPR special-category data to the service. Data that identifies a person as seeking or receiving health-related services may be 'consumer health data' under U.S. state laws (including Washington, Nevada, and Connecticut) even when it is not PHI; where you instruct us to process such data through the offerings in Privacy Policy section 3d, we process it only on your instructions, only for those offerings, and only where you have obtained the consents those laws require (see Privacy Policy section 3e and Terms, section 4).

4. Our obligations as processor

• We process personal data only on your documented instructions — including instructions implied by your use of the service — and will tell you promptly if an instruction appears to violate data-protection law.
• Confidentiality and access. The service is operated by automated systems; AdCrew does not use a workforce of employees to handle client data in the ordinary course. Human access to personal data we process for you is limited to authorized operator personnel acting for AdCrew, only where the task requires it, on a least-privilege basis through the per-client access controls in section 5. Every person with such access is bound by a duty of confidentiality that continues after their engagement ends, and significant actions on your data are recorded in the tamper-evident audit log described in section 5.
• We never sell your data, never share it with other clients, and never use it to train models for other clients.

4a. California and U.S. state privacy law terms

Where the California Consumer Privacy Act (as amended by the CPRA) or a similar U.S. state privacy law applies to personal information we process for you, we act as your service provider / contractor (CCPA) and processor (other state laws), and we agree that: (a) we receive and process the personal information only for the limited and specified business purposes of providing the service under the Terms and this DPA; (b) we will not sell or share the personal information, will not retain, use, or disclose it for any commercial purpose other than those business purposes or as otherwise permitted by law, and will not retain, use, or disclose it outside our direct business relationship with you; (c) we will not combine personal information we receive from or on behalf of you with personal information we receive from or on behalf of any other client or person, or from our own interactions with any individual — the anonymized benchmark program in Privacy Policy section 4a operates only on aggregate performance figures under that section's cohort and opt-out rules and never combines personal information; (d) we will comply with the CCPA and provide the same level of privacy protection it requires, and we certify that we understand the restrictions in this section and will comply with them; (e) we will notify you if we determine we can no longer meet our obligations under the CCPA; and (f) you may, on reasonable notice, take reasonable and appropriate steps to help ensure we use personal information consistently with your obligations, and, on notice, to stop and remediate any unauthorized use of personal information, and we will cooperate with your reasonable compliance monitoring.

5. Security measures

What we actually do to protect your data (not a wish list):

• Encryption: data encrypted at rest with per-client KMS keys; TLS everywhere in transit.
• Network isolation: paid plans run in their own private VPC. During the free trial, workloads run on shared infrastructure with dedicated per-client isolation (own compute tasks, encryption key, credential vault, and access role); the network fabric itself is shared. (Per-client VPC isolation is rolling out with production launch — see Privacy Policy, section 13, for the current state.)
• Tenant isolation: database access is filtered per-tenant at the application layer and by database-level row security (PostgreSQL RLS), which is enabled and forced by the database schema and covered by CI tests.
• Secrets: Platform credentials and tokens are stored as encrypted records in AdCrew's database, encrypted with the owning client's KMS key; they are never stored or logged in plaintext. Deployment and service secrets are held in AWS Secrets Manager.
• Account security: two-factor authentication (TOTP) enrollment is mandatory for every account — there is no opt-out.
• Auditability: a hash-chained, tamper-evident audit log records every significant action; VPC flow logs stream to a locked audit bucket.

No system is perfectly secure. Our incident-notification commitment is in section 8.

6. Sub-processors

We use the same small set of sub-processors as the Privacy Policy (section 5):

• Amazon Web Services (AWS) — hosting, storage, AI processing (Bedrock), and mobile push delivery (SNS).
• Stripe — payment processing.
• Amazon SES — transactional email.
• AWS End User Messaging — delivery of text messages for the missed-call text-back and review-request offerings. It receives the recipient phone number and the message text.
• Amazon Connect — call tracking for the missed-call text-back offering. It provides the call records (caller number, time, and outcome) that trigger a text-back.
• Cloudflare — email routing for our hello@getadcrew.com addresses, and Turnstile captcha verification on signup.
• Mobile push conduits (via Amazon SNS) — Apple Push Notification Service (iOS) and Firebase Cloud Messaging (Android) deliver push notifications; they receive the device token and the notification payload only (see Privacy Policy section 3).
• AI visibility recipients (GEO add-on only; not sub-processors of your client data — they receive only the monitoring question text described in Privacy Policy section 3a) — ChatGPT (OpenAI), Perplexity, Claude (Anthropic), Gemini and Google AI Overviews (Google), Microsoft Copilot. Monitoring sends only the question text to each surface's public chatbot; we never share your client, campaign, audience, or credential data with AI vendors. These services receive the monitoring question text only — they are not sub-processors of your client data.
• Google (Gmail) — hosting of our hello@getadcrew.com mailbox, which receives support messages and data-rights requests routed to it by Cloudflare (see Privacy Policy section 8). Google stores that mailbox content; it does not process your campaign, audience, or account data.
• Have I Been Pwned — the public breach database we check new passwords against (see Privacy Policy section 3). It receives only a short, non-reversible fragment of the password's fingerprint — never the password, your email address, or any account data.
• Shopify is not our subprocessor. When you connect a store, Shopify is the platform you hold your store account with and processes store data under its own terms as an independent controller, in the same way as the ad platforms below; the data we sync from it is described in Privacy Policy section 3c.

The list in this section is the current Annex III sub-processor list for the Standard Contractual Clauses where they apply (see section 11).

The advertising platforms you connect — including OpenAI for ChatGPT Ads — are not sub-processors under this agreement: each acts as an independent data controller under your own agreements with that platform (see Privacy Policy, section 5).

We will notify you at least 14 days before adding or replacing a sub-processor that handles client data, by email to the address on your account and by updating the lists in this section and Privacy Policy section 5, and a new or replacement sub-processor will not process client data until that 14-day period has expired. You may object on reasonable data-protection grounds; if we cannot accommodate the objection, you may terminate the affected services, and section 9 will apply to the terminated services.

7. Assistance with data-subject rights

When someone exercises a right over their data (access, correction, deletion, portability, restriction, objection), we help you respond: self-service export and deletion tools are in your account page, and we handle requests you forward to us without undue delay. Where the law requires erasure, we erase — with the one documented exception of the tamper-evident security audit logs, which are append-only by design and are deleted from live systems at permanent account teardown (see Privacy Policy, section 8). If a data subject contacts us directly about personal data we process for you, we will promptly forward the request to you, identify it as a direct request, and not respond substantively except to direct the person to you, unless you instruct us otherwise or the law requires us to respond. We will also assist you, taking into account the nature of the processing and the information available to us, with data protection impact assessments and prior consultations with supervisory authorities, where the law requires them. We will forward a direct request to you within 3 business days and tell the requester we have done so. Our assistance is timed so you can meet the deadline that applies to the request: 30 days for access, correction, deletion, portability, restriction, and objection requests; 45 days for sale/share opt-out and authorized-agent requests; and 60 days for appeals — the same clocks the rights queue in Privacy Policy section 11 applies, with the shorter deadline used where more than one regime could apply. Where a request concerns an agency workspace and the agency operating it does not instruct us within the applicable legal period, we will act on the end client's or data subject's verified instruction directly and notify the agency. On your instruction we will also delete an individual end customer's records (for example, a single caller's records under Privacy Policy section 3d) from our live systems and confirm when it is done.

8. Breach notification

If we become aware of a personal data breach or other security incident affecting personal data we process for you, we will notify you without undue delay and in any event within 72 hours after we first become aware of it. Our clock runs from discovery — when we first know, or reasonably should know, that an incident occurred — not from confirmation of its full scope, and we will not delay the first notice while scoping continues. The notice will describe, as known at the time, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, the containment and remediation measures taken or proposed, and a contact point. Information not yet known will be provided in phases without undue further delay. We will cooperate with the notifications you must make to authorities and data subjects, and preserve the audit-log and other evidence described in section 10. Where the affected data is in an agency workspace and the agency is unreachable, has been terminated, or is reasonably believed compromised, we may notify the affected end client directly.

9. Deletion and return on termination

When your account is permanently closed: billable resources are suspended, a 15-day recovery window runs, and then your environment is destroyed — provisioned infrastructure torn down, encryption keys scheduled for deletion (cryptographic shredding), and data wiped. On your written request before the window ends, we will return your data in the JSON export format from your account page; the return does not change the teardown above, and after the window closes the data is deleted as described in this section. On request after teardown we will confirm in writing that deletion has been completed, subject to the billing-record retention in Privacy Policy, section 8. Billing records are retained up to 7 years as required by tax law.

What deletion means here is the split described in Privacy Policy section 8: operational data is wiped at teardown; for retained financial records only the shells — amounts, dates, and statuses — are kept for up to 7 years, with their content destroyed; terms-acceptance records are kept for 7 years after teardown as contract evidence and rights-request records for 3 years after resolution; security audit logs are deleted from live systems at teardown, with immutable compliance-archive copies kept for up to 7 years from teardown; and encrypted backup copies expire automatically — database snapshots within 14 days and the separately vaulted copy within 30 days — after which no copy remains. A written deletion confirmation under this section covers live systems at teardown and states the backup-expiry schedule in the previous sentence. The return under this section is the JSON export described in Privacy Policy section 11, with that section's scope: platform credentials, tokens, and secrets are never returned — they are deleted — and the six-offerings records in Privacy Policy section 3d are not part of the export; they remain available to you in the product until teardown and are then deleted as above. You may also erase your account at any time through the self-service deletion in Privacy Policy section 11, which applies the same split immediately rather than at the end of a cancellation lifecycle.

10. Audit rights

You can verify our processing any time from inside the product: the tamper-evident audit log records every significant action taken on your behalf, and your data export shows what we hold. We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA — the audit log and export above, our retention and purge records for your account, the sub-processor list in section 6, and the security measures in section 5. For deeper assurance, you (or an independent auditor you appoint who is bound by confidentiality) may audit our compliance once in any 12-month period — and additionally after a security incident affecting your data or where the law requires — on reasonable written notice (ordinarily at least 15 business days), conducted remotely and by document exchange at a mutually agreed time. An audit will not include access to other clients' data, to the underlying cloud facilities (which are operated by our sub-processors), or to information whose disclosure would weaken the security of the service; where raw material cannot be shared for those reasons, we will provide a summary or redacted version that answers the same question.

11. International transfers

Data is hosted in AWS regions in the United States — primarily Ohio (us-east-2); Creative Studio image generation is processed in Oregon (us-west-2). We do not currently accept customers located in the EEA or UK, and no transfer is currently made under the Standard Contractual Clauses. Where the law requires transfer safeguards (EEA, UK, and similar), transfers will proceed only under the European Commission's Standard Contractual Clauses, Module Two (controller to processor), and, for UK transfers, the UK International Data Transfer Addendum to those Clauses (or equivalent approved mechanisms), with the completed annexes executed before the first such transfer. AdCrew is offered to U.S. customers only at this time (see Terms, section 3), and the clauses named above are the transfer mechanism we will apply under our Data Processing Agreement before onboarding any customer located in the EEA or UK; the completed SCC annexes and our transfer assessment are available to such customers on request at hello@getadcrew.com before signup. If you are located in the EEA or UK, please contact us before creating an account.

12. Liability and precedence

The liability cap and disclaimers in Terms, section 8, apply to claims under this DPA. Order of precedence. If a signed agreement between you and AdCrew conflicts with this DPA, the signed agreement controls for its subject matter (see Terms, section 11). Subject to that: on any data-protection point, this DPA — including Schedule 2 — controls over the Terms, the Agency Addendum, and the Privacy Policy; for agency workspaces, Schedule 2 controls over the body of this DPA on workspace data-protection points; and the Agency Addendum controls over the Terms on agency commercial matters (see Addendum, section 10) but does not reduce any protection in this DPA. The Privacy Policy is our transparency notice: if it states a data-protection commitment more protective of personal data than this DPA on the same point, the more protective commitment applies until the Privacy Policy is corrected under its section 14 change process. Notices under this DPA follow Terms, section 11; severability follows Terms, section 11; and this DPA is amended only through the change process in Terms, section 12 — your recorded acceptance of a new DPA version is the amendment.

13. Contact

Data-protection questions: hello@getadcrew.com. Postal address: adcrew LLC, 8735 Dunwoody Place Ste N, Atlanta, GA 30350. Phone: (678) 383-0278.

Schedule 2 — Agency workspaces

(1) Roles. For personal data in an agency workspace: the end client is the controller of its business, advertising, audience, and customer data; the agency acts as the end client's processor/agent and, in appointing AdCrew, engages AdCrew as a sub-processor for that data. Where the agency uploads or generates data of its own (its staff and viewer credentials it administers, its declared client prices, its branding assets), the agency is controller and AdCrew is its processor. AdCrew is controller only of: agency and viewer account-security data (credentials, MFA, session and audit logs) and agency billing data, as described in Privacy Policy section 2.

(2) Instructions. AdCrew follows the agency's instructions for workspace data, because the agency acts for the end client. If an end client instructs AdCrew directly and the instruction conflicts with the agency's, AdCrew will pause the disputed processing where feasible, notify both parties, and follow the end client's instruction for its own data unless the agency produces the end client's written authorization to the contrary within 5 business days.

(3) Rights requests. If a data subject or end client contacts AdCrew directly, AdCrew forwards the request to the agency within 3 business days and tells the requester it has done so and when. If the agency does not instruct AdCrew within the time the applicable law allows the requester to be answered, AdCrew will act on the requester's verified instruction directly and notify the agency.

(4) Breach notice. AdCrew notifies the agency without undue delay under DPA section 8; if the agency is unreachable, terminated, or reasonably believed compromised, AdCrew may notify the affected end client(s) directly.

(5) Viewers. Viewer account data is processed as described in Privacy section 2a; viewer grant/revoke events are audit-logged and available to the agency and, on request, to the end client for its own workspace.

(6) Benchmarks. Workspace data contributes to anonymized service benchmarks only under the same rule as direct clients (Privacy section 4a; minimum five contributing accounts, no identifiers), counting each workspace as one account; an agency may opt out per workspace, and opting out is the agency's duty to offer its end clients.

(7) Applications. Data of agency applicants who are declined, blocked, or withdrawn is deleted within 12 months of the decision unless the applicant becomes a client or the law requires retention.