Sub-processors
Third parties Adverdly engages to deliver the service, with purpose and data location for each.
Last updated: 2026-08-10
| Provider | Purpose | Data processed | Legal basis | Location | Added |
|---|---|---|---|---|---|
| Google (Gemini API, OAuth, Drive API) | AI analysis of ad creatives (image, video, text); sign-in identity; optional import of link-shared Drive and Sheets files | Uploaded creatives, on-creative copy, metrics provided by user, basic profile and email at sign-in | Contract performance (Art. 6(1)(b)) | Global (paid API tier; outputs not used for training) | 2026-02-26 |
| Anthropic (Claude API) | Narrative rewrite of Gemini output for PDF reports | Gemini analysis output only. No raw creatives. | Contract performance (Art. 6(1)(b)) | Global (commercial terms; outputs not used for training) | 2026-02-26 |
| Supabase | Authentication, Postgres database, object storage | Account details, analysis history, uploaded creatives, client profiles | Contract performance (Art. 6(1)(b)) | EU (Frankfurt) | 2026-01-10 |
| Vercel | Web hosting, edge functions, CDN | Request logs, page visits, server-rendered responses | Contract performance + legitimate interest (Art. 6(1)(b), 6(1)(f)) | Global (edge network; EU regions available) | 2026-01-10 |
| Lemon Squeezy | Payments, subscription management (Merchant of Record) | Billing email, payment tokens, subscription state, invoice records | Contract performance + legal obligation (Art. 6(1)(b), 6(1)(c)) | US / EU | 2026-02-26 |
| Sentry | Error monitoring and performance telemetry | Error stacks, request metadata. No creative content. | Legitimate interest (Art. 6(1)(f)): service reliability | EU (Frankfurt region) | 2026-02-26 |
| Upstash | Redis-based rate limiting | Hashed IPs and user IDs, request counters | Legitimate interest (Art. 6(1)(f)): abuse prevention | EU (Frankfurt) | 2026-02-26 |
Notifying customers of changes
When we add or replace a sub-processor that handles personal data, we update this page before that sub-processor begins processing, and record the date of the change. This page is the authoritative list, so review it periodically. If you process personal data through Adverdly and object to a change on reasonable data protection grounds, you have 30 days from the change appearing here to tell us, under Appendix A of the Terms.
Data Processing Agreement (DPA)
Our DPA is Appendix A of the Terms of Service. It meets the requirements of GDPR Article 28(3) and takes effect automatically when you accept the Terms, so there is nothing to request and nothing to sign: if you have an account, it is already in place. If your organisation needs a countersigned copy for its records, email hello@adverdly.com.
Related pages
See also: Privacy Policy • Terms of Service.