Legal
Subprocessors
The list
| Subprocessor | What it does | What it can see | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure: the servers and managed database the service runs on. | Everything the service stores, as the infrastructure it sits on. Data at rest is encrypted. | Finland (primary), Germany (secondary), EU |
| Anthropic PBC | Language-model requests: the chat that answers questions about an account, and the drafts of client updates. | Snapshots of ad-account metrics only: campaign names, budgets, spend, results and the other figures visible on your own screen. No personal data of end consumers, because the service does not hold any. No access tokens, no login credentials, no ability to call the ad platforms. | United States. Transfer safeguards: [to confirm: Standard Contractual Clauses (Commission Decision 2021/914), and the EU-US Data Privacy Framework where the receiving entity is certified] |
| [email provider, to be chosen] | Transactional email: sign-in links, notifications, weekly report delivery. | Names and email addresses of your team, and the content of the messages we send them. | [to be confirmed, EU preferred] |
| [backup storage, to be chosen] | Off-site storage of encrypted database backups. | Encrypted backup files only. The provider does not hold the decryption key. | [to be confirmed, EU] |
The two unnamed entries are placeholders for providers that have not been chosen yet. They will be named on this page, with a date, before they process anything.
Things on this page that are not subprocessors
Fonts, and everything else the browser loads
This website loads nothing from a third party. The two typefaces, Inter and JetBrains Mono, are served from adspenta.com itself under the SIL Open Font License 1.1. There is no font CDN, no analytics, no tag manager, no embedded video and no chat widget, so opening a page here tells nobody but us that you did. The cookie position is set out in the privacy policy.
Meta and Google
Meta and Google are not subprocessors. They are the platforms whose ad accounts you connect and control; we read from and write to them on your instruction, under your authorisation. Data flows to them because you told us to change something there.
How this list changes
Before a new subprocessor starts processing anything, it is added here with the date it was added, and customers on an active plan are told by email. If you object to a new subprocessor, tell us within 30 days and we will discuss it; if we cannot resolve it, you can terminate without penalty for the remainder of the period you have paid for.
Data Processing Agreement
A Data Processing Agreement is available for agencies whose clients ask for one, covering this list, the security measures on the security page, and the deletion commitments on the data deletion page. Request it at hello@adspenta.com and we will send the current version.
The DPA will be published for download here once the operating entity, [Legal entity name] of [Registered address], is registered and can sign it.
Change history
| Date | Change |
|---|---|
| [date] | List first published: Hetzner Online GmbH, Anthropic PBC. |