Data Processing Agreement.
When your business puts personal data into Adverizeo, such as a customer named in a brief, a client’s ad report or your teammates’ emails, you are the controller and we are your processor.
Last updated
You decide, we help you deliver.
You, the controller
- Choose the lawful basis for the personal data you put in
- Tell the people concerned, and get consent where it’s needed
- Answer their requests to access or delete their data
- Run a data protection impact assessment if your use needs one
How we help
- Every user can export or delete their own account data without asking us
- Deleting a client removes its uploaded reports and metrics at once
- We give you the information you need to show compliance, as Article 28 requires
- We help with impact assessments by describing how Adverizeo handles the data
The data, and whose it is.
| Data | Whose data |
|---|---|
| Team and account data | Your users and invited teammates: names, emails, roles |
| Content and briefs | Anyone you name in briefs, brand knowledge or generated copy |
| Uploaded files | People shown in product photos or named in files |
| Client reports | Your clients, through the ad-performance exports you upload |
| Technical logs | Your users: IP address, browser and device |
How long: Kept until you delete it or close the account. Deleting a client removes its reports at once; technical logs are deleted after 90 days.
What protects your data today.
Encrypted in transit
Every connection to Adverizeo uses TLS (HTTPS).
Platform tokens encrypted
Access tokens for connected ad platforms are encrypted with AES-256-GCM before they are stored.
Passwords hashed
Stored only as argon2 hashes, and checked against known breached passwords at sign-up.
EU hosting
App and database in the Netherlands; uploaded files in Frankfurt, Germany.
Access control
On the Agency plan, team roles (Owner, Admin, Editor, Reviewer, Viewer) set what each teammate can do. Sign-in attempts are rate-limited.
Not yet
We don’t hold SOC 2 or ISO 27001 certification yet.
DPA questions.
Does any of our data leave the EU?
Some does. Your account data and content are stored in the EU, but the AI providers, payments and email run outside the EU, mainly in the United States, under Standard Contractual Clauses or the EU–US Data Privacy Framework. The Subprocessors page lists the safeguard for each one.
Can our clients’ data feed industry benchmarks?
Uploaded client reports join industry benchmarks only if you opt that client in; it’s off by default for every client. Separately, Adverizeo compares ad-performance statistics across accounts to learn which ad traits tend to work. That uses numbers and ad traits, not names, and no single business can carry a result.
What happens to our data if we cancel?
Nothing is deleted when you cancel a plan; your data stays until you close the account.
Need a DPA for your account?
Send the request with your company’s legal name and we’ll prepare a DPA for you to sign.