Data processing agreement

1. Who this applies to

This agreement is between you, the customer named in your AuditRoger account (“you”), and Roger Tech LLC, 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, USA (“we”, “us”). It applies whenever we process personal data for you through AuditRoger, under the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, or another law with the same kind of rules (“data protection law”).

For that personal data you are the controller, or a processor acting for your own client, and we are your processor (or your sub-processor). Personal data we process for our own purposes, such as your account details and billing, is covered by our privacy policy instead.

If this agreement and the terms of service disagree about personal data, this agreement wins; if the Standard Contractual Clauses in section 5 disagree with either, the clauses win.

2. The processing (Annex I)

• Subject matter and purpose: providing AuditRoger to you: audits of the ad and analytics accounts you connect or the reports you upload, client performance reports and the leads they count, scheduled report emails, alerts, team seats and Roger AI.
• Duration: while you use AuditRoger, and until the personal data is deleted under section 3.8.
• Nature: collecting, storing, organising, analysing, displaying, sending by email and deleting.
• Categories of data subjects: your clients and their customers or prospects (leads); the people who receive reports you send; your team members; people whose LinkedIn profile PDF you upload; and the people who make changes in an ad account you connect.
• Types of personal data: names, email addresses, phone numbers, the answers and notes attached to a lead, and the date and source of an enquiry; for team members and report recipients, name and email address; for an uploaded LinkedIn profile, what the profile shows; for people who change an ad account, the email address the platform reports, which we replace with a label such as “Editor 1” and don’t store.
• Special categories: none are needed. Don’t put special category data (such as health, beliefs or ethnicity) into AuditRoger.

3. What we do as your processor

1. Your instructions. We process the personal data only on your documented instructions, which are these terms, the settings you choose and the features you use, including for transfers outside your country, unless the law requires otherwise; if it does, we tell you first unless the law forbids that. We tell you if we think an instruction breaks data protection law.
2. Confidentiality. Everyone we allow to process the personal data is bound to keep it confidential.
3. Security. We keep the technical and organisational measures in Annex II (section 7) in place, and update them as risks and technology change, without lowering the protection they give.
4. Sub-processors. You give us general authorisation to use the sub-processors in Annex III (section 8). Each is bound in writing to data protection terms that protect the personal data at least as well as this agreement, and we remain responsible to you for them.
5. Changing sub-processors. We tell you at least 30 days before adding or replacing one, by email and on this page. If you object on reasonable data protection grounds, tell us within that time; if we can’t address the objection, you may end the affected service and we refund any prepaid fees for the time you can no longer use it.
6. Helping you with requests. Taking into account what the processing involves, we help you answer requests from people exercising their rights, and help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a regulator. If a person contacts us directly about data we process for you, we pass the request to you.
7. Breaches. We tell you without undue delay after we become aware of a personal data breach affecting your personal data, with what we know about its nature, likely consequences and the measures taken, and keep you informed as we learn more.
8. Deletion at the end. You can delete reports, leads and other data in AuditRoger at any time. When your account is deleted, we delete the personal data we process for you within 30 days, unless the law requires us to keep it. Copies in our providers’ backups are removed as those backups expire.
9. Showing compliance. We make available the information you reasonably need to show that this agreement is kept, and allow audits, including inspections, by you or an auditor you appoint. We ask that an audit is announced at least 30 days ahead, is done no more than once a year unless a regulator requires it or after a breach, starts with the documents and answers we can provide, and is at your cost.
10. Requests from public authorities. We handle them as section 5 of our privacy policy says: only when the law requires it, after checking the request is lawful, challenging it if it isn’t, disclosing the minimum and telling you first unless the law forbids it.

4. What you do

• You make sure you have a lawful basis for the personal data you put into AuditRoger, and give the people it concerns any notice the law requires.
• You make sure your instructions comply with data protection law.
• You keep your account’s sign-in details secure and decide who on your team can see what.

5. International transfers

We are in the United States, and the personal data may be processed there and wherever our sub-processors operate. Where data protection law requires a safeguard for a transfer from the EU, the EEA, the UK or Switzerland to a country without an adequacy decision:

• EU and EEA: the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 apply and are made part of this agreement by reference, with you as data exporter and us as data importer: Module Two where you are a controller, Module Three where you are a processor. Clause 7 (the docking clause) applies; under Clause 9(a), Option 2 (general written authorisation, with the notice in section 3.5) applies; the optional wording in Clause 11 doesn’t apply; under Clause 13, the supervisory authority is the one competent for you; under Clauses 17 and 18, the clauses are governed by the law of Ireland and disputes go to the courts of Ireland. Annexes I, II and III of the clauses are completed by sections 2, 7 and 8 of this agreement.
• UK: the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies and is made part of this agreement, completed with the details in this agreement. Either of us may end it as its section 19 allows.
• Switzerland: the clauses apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR include the Swiss Federal Act on Data Protection, and the competent authority is the Commissioner where that Act applies.

6. Liability and term

Each of us is liable under this agreement as the terms of service say, except where data protection law or the Standard Contractual Clauses don’t allow a limit. This agreement lasts as long as we process personal data for you.

7. Security measures (Annex II)

• Encryption: every connection to the website, the service and its database is encrypted. Access tokens for connected accounts, and the names, contact details and notes of leads, are encrypted before they are stored. Passwords and API keys are kept only as hashes.
• Access: each customer’s data is kept apart from every other customer’s, and only you and the team members you invite can see it; team members see lead names and contact details masked. Our own staff use named accounts, never shared logins, with two-factor authentication on our hosting, database, payment and code accounts, and see an account’s name, plan, audit dates, scores and errors only to support you and fix problems.
• Sign-in protection: passwords of at least 8 characters, rate limits per address, and a temporary lock on an email address after repeated failed sign-ins.
• Sharing: share links are signed, expire and can be revoked; client report links leave out lead names and contact details.
• Minimisation: connections ask for read-only access wherever the platform offers it, and we keep only the fields an audit needs. The people who change an ad account are replaced with labels.
• Logs: access tokens, codes and other secrets are kept out of our logs, and email addresses in them are reduced to a fingerprint.
• Incidents: a written incident response plan, reviewed every six months, covering containment, investigation, notification and records.
• Deletion: reports can be deleted at any time, accounts are deleted on request, and data that platforms limit is deleted on their schedule (section 7 of our privacy policy).

8. Sub-processors (Annex III)

• Supabase, Inc. (USA): the database and sign-in. Data is stored in the United Kingdom (London).
• Railway (USA): runs the AuditRoger service and its cache. Servers in the Netherlands.
• Vercel, Inc. (USA): hosts the website, including shared report pages.
• Resend (USA): sends AuditRoger’s emails, including reports you schedule and team invitations.
• Anthropic, PBC (USA): writes the AI analysis on paid plans. The names and contact details of leads are never sent to it, and it doesn’t train its models on what it receives (section 5 of our privacy policy).

Stripe processes payments for us as an independent controller under its own terms; it doesn’t receive the personal data this agreement covers.

9. Contact

Questions about this agreement, or a copy signed for your records: hello@auditroger.com.