Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Lapse Labs LLC ("Lapse") when Lapse processes Customer Personal Data that is subject to Data Protection Laws. To get a copy signed for your records, email support@trylapse.io with your company's legal name and address.

Definitions

"Data Protection Laws" means the EU and UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended ("CCPA"), and other privacy laws that apply to the processing. "Customer Personal Data" means personal data Lapse processes for Customer in providing the service. "Controller", "processor", "personal data breach", "business" and "service provider" have the meanings those laws give them.

Roles

Customer is the controller (or a business under the CCPA) and Lapse is its processor (and service provider). The subject matter, duration, nature and purpose of the processing, and the types of data and people involved, are set out in Annex 1.

Instructions

Lapse processes Customer Personal Data only on Customer's documented instructions, including about transfers, unless the law requires otherwise, in which case Lapse tells Customer first unless the law forbids it. The Terms, this DPA and Customer's use of the product's settings are Customer's instructions. Lapse tells Customer if it believes an instruction breaks Data Protection Laws.

Confidentiality

Everyone Lapse authorizes to process Customer Personal Data is bound by confidentiality obligations.

Security

Lapse keeps appropriate technical and organizational measures to protect Customer Personal Data, as GDPR Article 32 requires. Annex 2 summarizes them and our Security page describes them in detail.

Subprocessors

Customer authorizes Lapse to use the subprocessors listed on our Subprocessors page. Lapse will give Customers who ask for it at least 15 days' notice by email before adding or replacing one. Customer may object on reasonable data protection grounds; if we can't resolve the objection, Customer may end the affected service and receive a pro-rata refund of prepaid fees for it. Lapse binds each subprocessor to data protection terms no less protective than this DPA and remains responsible for its performance.

Helping Customer

Taking into account the nature of the processing, Lapse helps Customer answer requests from people exercising their rights, and with security, breach notification, data protection impact assessments and prior consultation under GDPR Articles 32 to 36. Lapse forwards to Customer any request it receives directly about Customer Personal Data.

Personal data breaches

Lapse notifies Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes what happened, the data and people likely affected, the likely consequences and the steps taken, and Lapse adds details as it learns them.

Deletion and return

When the service ends, or when Customer deletes its organization, Lapse deletes Customer Personal Data within 30 days, unless the law requires keeping it. Before that, Customer can ask us by email for a copy of its licenses and findings. Copies in our providers' backups expire on their normal schedule and are not used meanwhile.

Audits

Lapse makes available the information needed to show it meets GDPR Article 28, and answers reasonable written security questionnaires. Where that isn't enough, Customer may audit Lapse, or have an independent auditor bound by confidentiality do so, once a year with 30 days' notice, at Customer's cost, during business hours and without access to other customers' data.

International transfers

Customer Personal Data is stored and processed in the United States. For personal data from the EEA, Switzerland or the UK, the parties agree to the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum, which are incorporated by reference, with Annexes 1 and 2 of this DPA completing their annexes.

CCPA service-provider terms

Lapse processes Customer Personal Data only for the limited business purpose of providing the service described in the Terms. Lapse will not: sell or share it (as the CCPA defines those words); retain, use or disclose it for any other purpose, including outside the direct business relationship with Customer; or combine it with personal data from other sources except as the CCPA allows. Lapse gives it the same level of privacy protection the CCPA requires, will tell Customer if it can no longer meet these obligations, and lets Customer take reasonable steps to stop and fix unauthorized use. Lapse certifies that it understands and will comply with these restrictions.

General

The limits of liability in the Terms apply to this DPA. If this DPA and the Terms conflict about personal data, this DPA wins; if the Standard Contractual Clauses conflict with this DPA, the Clauses win. This DPA lasts as long as Lapse processes Customer Personal Data.

Annex 1: Details of processing

• Subject matter and purpose: checking Customer's live Meta ads against the creator usage licenses Customer records, showing the results, sending alerts and, only if Customer turns it on, pausing matched ads.
• Duration: the term of the Terms, plus the deletion period above.
• Nature: collection from Meta, storage, comparison, display, alerting by email and Slack, and deletion.
• People: Customer's users; creators and their representatives named in Customer's licenses; people whose names appear in ad names or ad text.
• Data: names, business email addresses, creator handles and optional creator emails, license terms, Meta ad IDs, names, status, text, links and creative identifiers; Business portfolio, Page and Instagram account names if Customer turns those setup shortcuts on; Slack webhook URLs; Stripe customer and subscription IDs; request logs (IP address, time). No special-category data is intended.
• Lapse's contact: Lapse Labs LLC, 28 Geary St Ste 650-1966, San Francisco, CA 94108, support@trylapse.io

Annex 2: Security measures

• Encryption in transit (HTTPS) and of Meta access tokens and Slack webhooks at rest (AES-256-GCM).
• Read-only Meta access by default; the permission to pause ads is requested only when Customer turns auto-pause on.
• All customer-data access in app code is scoped to one organization; code that spans organizations is kept in one small module (sign-in, scheduled jobs, billing updates, account deletion, health checks).
• Secrets are redacted from logs; every pause and undo is logged.
• Sign-in by single-use email links (plus a temporary reviewer login for Meta's app review); no passwords stored.