Data Processing Agreement
Last updated November 3, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between AdCreator and customers who use the Services to process personal data subject to data protection laws, including the GDPR, UK GDPR and CCPA. Enterprise customers may request a countersigned copy at legal@adcreator.app.
1. Roles of the parties
With respect to personal data included in customer content, the customer is the controller and AdCreator is the processor. AdCreator is an independent controller for account, billing and usage data it processes to run its business.
2. Scope and instructions
AdCreator processes customer personal data only on documented instructions from the customer, including as set out in the Terms and through the customer's use of the Services, unless required to do otherwise by law.
3. Confidentiality
AdCreator ensures that personnel authorized to process personal data are bound by confidentiality obligations.
4. Security measures
AdCreator implements appropriate technical and organizational measures, including encryption in transit, access controls, account isolation, logging, monitoring, backups and incident response procedures.
5. Sub-processors
The customer authorizes AdCreator to engage sub-processors to provide the Services, such as hosting, payment processing and email delivery providers. AdCreator imposes data protection obligations on sub-processors no less protective than this DPA and remains responsible for their performance. A current list is available on request.
6. Data subject requests
AdCreator will assist the customer, taking into account the nature of the processing, in responding to requests from data subjects to exercise their rights.
7. Personal data breaches
AdCreator will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data and provide information reasonably needed to meet the customer's obligations.
8. International transfers
Where personal data is transferred outside the EEA, UK or Switzerland, the parties rely on the Standard Contractual Clauses or another lawful transfer mechanism.
9. Audits
AdCreator will make available information reasonably necessary to demonstrate compliance with this DPA and allow for reasonable audits, no more than once per year, with reasonable notice and subject to confidentiality.
10. Deletion and return
On termination, AdCreator will delete or return customer personal data, at the customer's choice, unless retention is required by law.
11. Governing law and contact
This DPA is governed by the laws of the State of Delaware, USA, except where data protection law requires otherwise. Contact legal@adcreator.app with any questions.