Data processing terms

Parties and scope

The authorizing business is the controller; Computer Love is the processor for data imported on its instructions. These terms apply during service use and required deletion. Our controller role for account administration/security is described in the privacy policy.

Instructions

Instructions consist of selecting accounts, requesting or scheduling reports/AI analysis, supplying authorized materials, reviewing and confirming Meta ad edits, and requesting disconnection or deletion. We process data only on documented instructions, including transfers, unless legally required otherwise. We inform the customer of legal requirements where permitted and if an instruction appears to infringe applicable data-protection law.

Data covered

Processing involves retrieving, storing, organizing, displaying and deleting selected reports and creatives, and sending user-confirmed text and image edits to the selected Meta ad account. Data can include account-owner/employee identifiers, names in campaign metadata and people appearing in advertisements. Routine analytics reports are aggregate. Do not upload sensitive personal data, customer lists or private correspondence in the pilot.

Security and confidentiality

Measures include authenticated workspace access, ownership checks, HTTPS, encrypted credentials, restricted infrastructure access and error monitoring. Access is limited to authorized service operations and support. We provide information needed to assess the processing and cooperate with reasonable audits or inspections while protecting other customers’ data.

Providers and transfers

The customer authorizes service providers for the selected features: Cloudflare for network delivery/security, Anthropic for AI analysis when used, and Resend for configured service email delivery. Google and Meta receive authentication/API requests under their platform terms. We remain responsible for our subprocessors’ applicable processing obligations. Before adding or replacing a subprocessor, we inform affected customers and allow reasonable data-protection objections.

Transfers outside the EEA require a valid transfer mechanism and applicable safeguards. Contact [email protected] for provider and transfer information.

Assistance and incidents

Taking the nature of processing into account, we assist with data-subject requests, security obligations, breach response, impact assessments and supervisory-authority consultation. We notify the customer without undue delay after becoming aware of a personal-data breach affecting their data, providing available information and updates.

Return and deletion

At the customer’s choice, we delete or return processed data when service use ends and delete copies unless law requires retention. Arrange a reporting export before deletion by contacting us. Complete deletion and backup handling follow the deletion process. We make available information demonstrating these obligations.