How to get a signed copy
Need a signed DPA?
Email us with your company name and we'll countersign and return within 2 business days. No cost.
Request a signed DPA →Definitions
"Controller" means the Customer (the business subscribing to AdZhi) who determines the purposes and means of processing personal data.
"Processor" means AdZhi Ltd, which processes personal data on behalf of the Controller.
"Personal Data" means any information relating to an identified or identifiable natural person processed through the AdZhi service, which may include individuals appearing in or named within ad creative submitted for analysis.
"Services" means the acoustic analysis, transcription, and reporting features of the AdZhi platform.
Scope and purpose
AdZhi Ltd processes personal data solely to provide the Services described in the subscription agreement. Processing is limited to:
- Transcribing spoken content from video advertisements submitted by the Controller
- Analysing acoustic and linguistic features of that content
- Storing analysis results in the Controller's account
AdZhi does not process the personal data for any purpose other than providing the Services, except as required by law.
Nature of personal data processed
The personal data processed may include:
- Voice recordings of individuals appearing in submitted advertisements
- Transcripts of spoken content, which may include incidental personal details mentioned in the ad
- Facial presence data (detected, not identified - no facial recognition)
AdZhi does not process special category data, financial data, health data, or government identifiers as part of the Services.
Processor obligations
AdZhi Ltd agrees to:
- Process personal data only on documented instructions from the Controller
- Ensure that persons authorised to process the data are bound by confidentiality
- Implement appropriate technical and organisational security measures (see Section 6)
- Give the Controller at least 14 days' notice before engaging a new sub-processor, so any reasonable objection can be raised (the current sub-processors are listed in Section 5 below)
- Assist the Controller in responding to data subject requests within 5 business days
- Delete or return all personal data upon termination of the Services
- Make available all information necessary to demonstrate compliance with this agreement
Sub-processors
AdZhi currently uses the following sub-processors. The Controller consents to these sub-processors by accepting these terms. AdZhi will notify the Controller at least 14 days before engaging new sub-processors.
Transcription runs on AdZhi's own infrastructure by default. Where a hosted transcription provider (Groq or OpenAI) is configured for speed, the audio is processed by that provider to produce the transcript; the entries below marked "conditional" apply only when the relevant path is enabled.
| Processor | Purpose | Data processed | Location |
|---|---|---|---|
| Railway | Infrastructure hosting (app, worker, managed Postgres and Redis) | All application data, video files (temporary), database | US / EU |
| Anthropic | Linguistic analysis (Claude API) | Ad transcript + acoustic summaries: no audio, no video, no account or billing identifiers. A transcript is the words spoken in the ad and can contain incidental personal detail; per Anthropic’s API policy, it is not used to train their models. | US |
| Stripe | Payment processing | Billing information, card details (Stripe-direct, never touches AdZhi servers) | US / EU |
| Resend | Transactional and marketing email delivery | Email address, email content | US |
| Plausible Analytics | Website analytics | Cookieless page view counts, no personal data | EU |
| Groq (conditional) | Hosted transcription (fast path), when enabled | Audio file, transient — processed for transcription, not retained or used to train their models | US |
| OpenAI (conditional) | Hosted transcription and/or summary generation, when enabled | Audio file and/or transcript text, transient — not used to train their models | US |
| AssemblyAI (conditional) | Fallback transcription for complex audio | Audio file, transient — only used when local Whisper confidence is low | US |
Security measures
AdZhi implements the following technical and organisational measures:
- TLS encryption for all data in transit
- Encryption at rest for database storage
- bcrypt password hashing (cost factor 12)
- Role-based access control - all data scoped to authenticated user
- Per-account control over creative retention - access-controlled storage, with deletion on opt-out and on account deletion
- Signed session tokens with 60-minute expiry
- No application-level employee access to customer content; infrastructure access is restricted and logged
Data retention and deletion
Raw video and audio files are retained by default so the Controller can replay each creative within its report, stored access-controlled to the Controller's account and encrypted at rest. The Controller may disable retention at any time in Account → Privacy & data, which deletes retained files and deletes subsequent uploads immediately after analysis. Analysis results are retained for the life of the customer account. Upon account deletion, all personal data, including any retained creatives, is deleted within 30 days. The Controller may request deletion of specific analyses at any time via the dashboard or by contacting privacy@adzhi.co.uk.
Data transfers
Data is primarily processed in the US and EU. Where data is transferred outside the UK/EEA, AdZhi relies on Standard Contractual Clauses with sub-processors and/or the sub-processor's adequacy status. A list of transfer mechanisms is available on request.
Audit rights
The Controller may request evidence of compliance with this agreement by contacting privacy@adzhi.co.uk. For customers requiring formal audit rights, AdZhi will provide written responses to security questionnaires and, where reasonably required, allow third-party audit of relevant controls with 30 days' notice.
Liability
Each party's liability under this DPA is subject to the limitations set out in the main Terms of Service agreement.
Governing law
This agreement is governed by English law. Disputes are subject to the exclusive jurisdiction of the courts of England and Wales.
Ready to sign?
Email us with your company name, registered address, and the name of the authorised signatory. The countersigned copy you receive will carry AdZhi Ltd's registered details and signature.
Request signed DPA →