Documentation index: https://openadmanager.com/llms.txt # Data Processing Addendum | OpenAdManager > The data processing terms that apply when OpenAdManager processes personal data on your behalf: roles, security, subprocessors, deletion and breach notice. Canonical: https://openadmanager.com/dpa # Data Processing Addendum DPA v2 (13 Nov 2026) **On this page** - 1. Roles and scope - 2. Our duties as processor - 3. Security measures - 4. Subprocessors - 5. International transfers - 6. Return and deletion - 7. Audits - 8. Liability and order of precedence - 9. Contact This Data Processing Addendum ("DPA") forms part of the [Terms of Service](https://openadmanager.com/terms) between CloudWish LLC ("OpenAdManager", the "processor") and the customer ("you", the "controller") and applies where we process personal data on your behalf while providing the Service. ## 1. Roles and scope - For ad account data that includes personal data of your customers, leads or staff (for example lead form data or names in campaign content), you are the controller and we are the processor. - For events from your website that you send through the tracking add-on, you are the controller and we are the processor. - For account, billing, security and product data about you as our customer, we are an independent controller. The [Privacy Policy](https://openadmanager.com/privacy) covers that. - The subject, duration, nature and purpose of the processing are: running the Service for you (reading and, within the permissions you set, changing your ad accounts, and returning data to the AI tools you authorize), for as long as your account is active. Categories of data: the ad account data and account data described in the Privacy Policy. Categories of data subjects: your customers, leads, staff and users. ## 2. Our duties as processor - We process personal data only on your documented instructions, which are the Terms, this DPA and the settings and requests you make in the Service, unless the law requires otherwise (we will tell you first where the law allows). - We make sure people with access are bound by confidentiality. Staff access connected ad accounts only to run and support the service, as you agree when you connect each account; every staff action is logged and shown to you. Staff do not download lead or customer contact data from accounts that are not on a managed plan, and otherwise do not read your data unless it is needed for security or the law requires it. - We apply the security measures in section 3. - We use only the subprocessors on the [subprocessors page](https://openadmanager.com/subprocessors) and tell you before adding or replacing one (section 4). - We help you answer requests from data subjects and meet your own duties, to the extent the Service allows, for example through export and deletion tools. - We tell you without undue delay after we become aware of a personal data breach affecting your data, with the information we have, and keep you updated. Where feasible we do so within 72 hours. - When your account ends we delete your data as described in section 6. - We give you the information needed to show our compliance and allow reasonable audits (section 7). ## 3. Security measures - Encryption in transit (TLS) and at rest for access tokens and secrets; personal tokens stored only as hashes. - Per-customer isolation of data and per-customer encryption keys that are destroyed on deletion. - Role-based access, optional two-step sign-in for customers (required for our administrators), and a change log of every change. - Network isolation of the services that talk to ad platforms; secrets kept outside the application image. - Encrypted backups with a limited retention period, and tested restores. - Rate limits, abuse detection and kill switches that can stop changes per platform or per customer. ## 4. Subprocessors You give general authorization to the subprocessors listed on [openadmanager.com/subprocessors](https://openadmanager.com/subprocessors). We will update that page and notify account owners by email before a new subprocessor starts processing your personal data. You may object on reasonable data protection grounds; if we cannot resolve it, you may cancel the affected service. ## 5. International transfers Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses (and the UK addendum where relevant). Module Two (controller to processor) applies, with the details of this DPA and the [subprocessors page](https://openadmanager.com/subprocessors) serving as its annexes. ## 6. Return and deletion When your account ends, or on your request, we delete your data. A deletion job runs within 48 hours and destroys your per-customer encryption keys. Encrypted backups keep data for up to 21 days and are then overwritten. We may keep what the law requires, such as invoices. ## 7. Audits On reasonable written request, no more than once a year unless a breach requires otherwise, we provide the information needed to show compliance with this DPA, and allow an audit by you or a mutually agreed auditor, under confidentiality and at your cost. ## 8. Liability and order of precedence Liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies. ## 9. Contact Questions or requests under this DPA: [support@openadmanager.com](mailto:support@openadmanager.com). CloudWish LLC, 1509 Coffeen Ave Ste 1200, Sheridan, WY 82801, USA.