Data Processing Addendum

Effective November 5, 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service between AdSnipe LLC ("AdSnipe", "Processor") and the client ("Client", "Controller"). It applies when AdSnipe processes personal information about the Client's customers, leads and contacts ("Client Personal Data") to provide the Services.

1. Roles

The Client decides why and how Client Personal Data is processed and is the controller (or "business" under the California Consumer Privacy Act). AdSnipe processes it only on the Client's behalf as a processor (or "service provider" / "contractor").

2. Instructions

AdSnipe processes Client Personal Data only to provide the Services under the Terms, according to the Client's documented instructions, including the settings the Client chooses in the portal and Slack. If we believe an instruction breaks the law, we will tell the Client.

3. Restrictions

AdSnipe will not:

• Sell or share Client Personal Data, or use it for cross-context behavioral advertising.
• Use, keep or disclose it for any purpose other than providing the Services, or outside our direct business relationship with the Client.
• Combine it with personal information from other sources, except as the Services need and the law allows.
• Use it to train AI models.

4. Confidentiality

Everyone at AdSnipe who can access Client Personal Data is bound by confidentiality and gets access only as needed for their role.

5. Security

AdSnipe keeps appropriate technical and organizational measures in place, including: access limited by role and by client workspace; encryption in transit; encrypted storage at our database provider; secrets kept out of code and logs; approval steps before messages are sent; audit logs; and regular review of who has access.

6. Subprocessors

The Client authorizes AdSnipe to use the subprocessors listed on our Subprocessors page. We bind each of them to data protection terms at least as protective as this DPA. We will give at least 30 days' notice before adding or replacing a subprocessor; the Client may object on reasonable data protection grounds, and if we cannot resolve the objection the Client may end the affected Services.

7. Assistance

AdSnipe will help the Client, at reasonable cost where significant effort is needed, to respond to requests from individuals exercising their privacy rights, and with security and data protection assessments the Client must carry out.

8. Security incidents

AdSnipe will notify the Client without undue delay, and in any case within 72 hours after confirming a security incident affecting Client Personal Data, with the information the Client reasonably needs to meet its own obligations. We will take reasonable steps to contain the incident and prevent a repeat.

9. Deletion and return

When the Services end, or on the Client's request, AdSnipe will delete Client Personal Data, or return it in a common format first if the Client asks within 30 days. Deletion happens within 90 days after the Services end, except where the law requires us to keep certain records. Backups are overwritten on their normal cycle.

10. Audits

On reasonable written request, no more than once a year, AdSnipe will provide information needed to show it meets this DPA, such as answers to a security questionnaire.

11. Location

Client Personal Data is processed in the United States.

12. Priority

If this DPA conflicts with the Terms on data protection, this DPA controls.

13. Contact

Email: support@adsnipe.ai