# Data Processing Addendum > PaidHelm's Data Processing Addendum: roles, categories of data, sub-processors, security measures, international transfers and data-subject rights for customers subject to GDPR, UK GDPR, CCPA and LGPD. URL: https://paidhelm.com/dpa/ Last updated: 2026-11-01 This Data Processing Addendum ("DPA") forms part of the PaidHelm Terms of Service between A2 Digital Marketing Ltda. ("PaidHelm", "we") and the customer ("Customer", "you") and applies whenever PaidHelm processes personal data on your behalf. It is incorporated by reference into the Terms. Customers who require a signed copy may request one at support@paidhelm.com. 1. Roles For personal data contained in your Google Ads account that PaidHelm accesses when executing your instructions, you are the controller and PaidHelm is the processor. For your own account data (email, plan, billing status, usage counters) PaidHelm is an independent controller, as described in the Privacy Policy. 2. Subject matter and duration Processing consists of transmitting your instructions, issued through an AI assistant of your choice, to the Google Ads API and returning the results. Processing lasts for the duration of your account and ends when you disconnect your Google account, delete your PaidHelm account, or revoke access in Google. 3. Nature and purpose Retrieval of advertising reports, creation and modification of advertising campaigns and related objects, keyword research, and plan quota accounting, solely to provide the service you requested. 4. Categories of data and data subjects Customer account data: Google account email, encrypted OAuth refresh token, plan, billing identifiers from Paddle, task counters. Advertising data (transient): campaign, ad group, keyword, ad and performance data returned by the Google Ads API. This data is relayed to your AI assistant and is not stored by PaidHelm. Data subjects: you and your authorized users; incidentally, end users whose aggregated interactions appear in Google Ads reports. PaidHelm does not process customer-match lists or other personally identifiable audience data unless you explicitly instruct a tool to do so. 5. Instructions PaidHelm processes personal data only on your documented instructions, which are the tool calls issued by your AI assistant on your behalf, plus the Terms and this DPA. We will inform you if we believe an instruction infringes applicable data-protection law. 6. Confidentiality Personnel with access to personal data are bound by confidentiality obligations and receive access only as needed for support and operations. OAuth tokens are encrypted and are never displayed in administrative tools. 7. Security measures TLS 1.2+ for all traffic; HTTPS-only endpoints. Encryption of OAuth tokens at rest with keys stored in Cloudflare's secret store. Least-privilege OAuth scope (Google Ads only). Hosting on Cloudflare Workers, D1 and KV (SOC 2 Type II environment). Access logging of tool calls for 90 days; no storage of report contents. Campaigns created paused by default; destructive operations require explicit identifiers. 8. Sub-processors Sub-processorPurposeLocation Cloudflare, Inc.Hosting, database, key-value storage, TLSGlobal edge; data stored in the United States and EU regions Google LLC (Google Ads API)Executing your advertising instructionsUnited States and global Paddle.com Market Ltd.Merchant of record, payments, invoicing, taxUnited Kingdom, United States Resend, Inc.Transactional email (access and billing notices)United States We will give at least 14 days' notice by email before adding a sub-processor that processes Customer personal data. You may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected service and receive a pro-rata refund of prepaid fees. 9. International transfers Where personal data originating in the EEA, UK or Switzerland is transferred to countries without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum, which are incorporated by reference. For Brazilian data subjects, transfers comply with the LGPD (Lei 13.709/2018). 10. Assistance and data-subject rights Taking into account the nature of processing, PaidHelm will assist you in responding to data-subject requests and in meeting your obligations regarding security, breach notification and impact assessments. Requests reaching us directly from data subjects will be forwarded to you where we can identify the controller. 11. Personal data breach PaidHelm will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your data, providing the information reasonably available to help you meet your own notification duties. 12. Deletion and return Upon termination or on your request, PaidHelm deletes your encrypted token and account data within 30 days, except where retention is required by law (for example billing records). Because PaidHelm does not store advertising data, there is nothing further to return; your data remains in your Google Ads account. 13. Audit On written request no more than once per year, PaidHelm will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party audit reports of our hosting providers. 14. Liability and precedence Each party's liability under this DPA is subject to the limitations in the Terms. In case of conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. Last updated: 1 November 2026.