Data Processing Agreement

under Art. 28 GDPR · Version: 24 September 2026 · part of the Terms of Service

This agreement applies between you as the customer (controller) and Aurex Global LLC (processor) to all personal data we process on your behalf when providing aurexus.io. It forms part of the Terms of Service and runs for as long as they do.

1. Subject matter, nature and purpose

We process the data only to provide the features you have booked: retrieval, storage, analysis and display, export and forwarding at your request, and deletion.

• Types of data: ad account, campaign and metrics data from Meta; lead data (name, email address, phone number, form answers, origin); order data from your store (order ID, amounts, UTM parameters, without customer names or addresses); content in the Creative Center (uploads, descriptions, creatives)
• Data subjects: people who fill in your lead forms; buyers in your store (indirectly identifiable via the order ID); people in images you upload; your users and team members as far as they appear in logs

2. Instructions

We process the data only on your documented instructions. Instructions are the Terms of Service, this agreement and your settings and actions in the app (such as a CRM forwarding, an export or generating a creative). If we consider an instruction unlawful, we tell you. We inform you in advance of processing required by law, as far as the law permits.

3. Confidentiality

Everyone at our end with access to the data is bound to confidentiality. We access customer data only as far as needed for operations, support or fixing errors; administrative interventions are logged.

4. Technical and organisational measures

• Encryption: transmission over HTTPS only; access tokens, store credentials and secrets for CRM forwarding stored encrypted (Fernet/AES)
• Access control: passwords only as a hash (bcrypt), sign-in code by email, rate-limited sign-in attempts, one active session per user
• Authorisation: strict separation of customer accounts; roles (owner, editor, viewer) and separate permissions for leads and the Creative Center; files only through checked endpoints, no public directories
• Traceability: log of all changes to ad accounts and all administrative interventions
• Transfer: CRM forwarding signed (HMAC), protection against calls to internal addresses; reference images for the image provider only via addresses valid for 15 minutes
• Availability: daily backups kept for 14 days, restore tested; continuous monitoring of operations with alerting
• Data minimisation: no customer names or addresses from stores; no lead contact details to AI providers

We may develop these measures further as long as the level of protection does not decrease.

5. Sub-processors

You approve the following sub-processors:

• DigitalOcean, LLC — hosting and backups, data centre in Frankfurt am Main, Germany
• Plus Five Five, Inc. (“Resend”), USA — sending emails, such as task notifications with metrics
• Anthropic PBC, OpenRouter, Inc. and Google LLC, USA — AI Copilot (no lead contact details)
• PoYo AI (poyo.ai) — image generation in the Creative Center, only for the description and the reference images you select for a creative. The provider does not publish a registered seat; Standard Contractual Clauses are not in place with it. Therefore do not transmit personal data through the Creative Center.

We announce new or changed sub-processors at least four weeks in advance by email or in the app. You may object for an important data protection reason; if no solution is found, you may terminate the contract with effect from the change.

6. Third countries

Aurex Global LLC is based in the USA. Transfers to us are governed by the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module 2 — controller to processor), which are agreed with this agreement; for sub-processors in the USA, Module 3 where the provider offers it. The data is stored on servers in a data centre in Frankfurt am Main, Germany.

7. Assistance

We assist you through the app's features (export, deletion) and, on request, in responding to data subject requests, with data protection impact assessments and with notifying breaches. Data subject requests that reach us are forwarded to you.

8. Personal data breaches

We notify you of a personal data breach affecting your data without undue delay, at the latest within 48 hours of becoming aware of it, with the information available to us.

9. Deletion and return

After the contract ends, we delete the data within 30 days unless a statutory retention obligation applies. Before that, you can download leads and analyses using the export features. Data remains in backups for at most 14 days.

10. Evidence and audits

On request we provide the information needed to demonstrate compliance with these obligations. On-site audits are possible after reasonable notice and during normal business hours, at most once a year unless there is a specific reason.

11. Final provisions

In case of conflict, this agreement takes precedence over the Terms of Service as far as the protection of personal data is concerned. Otherwise the Terms of Service apply, including the liability provisions.