Language
Contact us

Legal

Data Processing Addendum

How AdOps processes Meta ad-account data on a customer's instructions — the roles, the categories of data, the sub-processors involved, and what happens at termination. This page is the current AdOps Data Processing Addendum, effective 1 August 2026 and last updated 1 August 2026. It is a plain-language draft that has not been reviewed by qualified counsel.

Effective Last updated

Template notice. This document is a plain-language draft describing how the AdOps platform processes data on a customer’s behalf. It has not been reviewed by qualified counsel, it is not legal advice, and it is not yet drafted against any specific regime such as Indonesia’s personal data protection law or the GDPR. A lawyer must review, complete and adapt it before it is signed or relied upon.

AdOps processes Meta ad-account data on a customer’s instructions. The customer decides which ad accounts AdOps may act on and writes the rules that decide what happens; AdOps runs those rules, records what happened, and holds the resulting data. This addendum sets out that relationship, the sub-processors involved, and what happens when the relationship ends.

Roles

The customer is the controller of the ad-account data and any personal data contained in it. AdOps is the processor and acts on the customer’s documented instructions.

Where the customer’s own end-customer data appears in a Google Sheet used by a custom metric, the customer remains the controller of that data too. AdOps reads only the columns the custom metric names.

What the processing consists of

ItemDescription
Subject matterAutomated management of Meta advertising campaigns according to rules the customer defines
DurationFor as long as the customer’s AdOps account exists, plus any period needed to settle billing
NatureReading advertising metrics from the Meta Graph API; writing status, budget, name and duplication changes back; storing rule definitions and execution records
PurposeDelivering the AdOps service to the customer
Types of dataAccount and contact details of the customer’s users; Meta profile metadata returned when a token is verified; ad-account identifiers, spend and metrics; rule definitions and execution records; billing records; any values the customer places in a linked Google Sheet
Data subjectsThe customer’s own staff and any individuals identifiable in the data the customer connects

The customer’s instructions

The customer instructs AdOps through the product itself. Three actions are the instruction:

  1. Connecting Meta and supplying an access token authorises AdOps to call the Meta Graph API on the customer’s behalf.
  2. Activating an ad account brings it into scope. Ad accounts discovered from Meta are stored inactive until the customer activates them.
  3. Setting a rule live instructs AdOps to evaluate it on the schedule it carries and to execute its actions when its conditions pass.

AdOps will not process the data for any other purpose. If AdOps believes an instruction conflicts with applicable law, it will say so rather than act on it.

Confidentiality

Access to customer data is limited to personnel who need it to operate and support the service, and those personnel are bound by confidentiality obligations.

Security measures

AdOps applies the following technical measures. This list describes what the platform does; it is a description, not a warranty.

  • Authentication with a bearer token that expires 24 hours after issue, verified on every request.
  • Passwords stored as hashes and subject to a composition requirement of upper case, lower case, a digit and a symbol.
  • Meta access tokens stored server-side and used only for the ad accounts the customer has activated.
  • Ad accounts stored inactive on discovery, so nothing is acted on without an explicit activation.
  • A separation between the dispatcher, which only reads from the Meta Graph API, and the worker, which performs writes.
  • An execution record for every campaign a rule touches, including the conditions that were true and the values that changed.
  • A deduplicated error log with normalised messages, in which timestamps, identifiers and IP addresses are masked.

No system is free of risk. This addendum makes no guarantee of security, and the measures above may change as the platform changes.

Sub-processors

The customer authorises the following sub-processors.

Sub-processorFunctionData involved
Meta PlatformsThe advertising platform being automatedAll ad-account reads and writes
GoogleReading spreadsheets referenced by custom metrics, through a service accountThe columns named by the custom metric
AnthropicGenerating rule drafts from a plain-language goal, when that feature is usedThe goal text the user types and the metric catalogue
DuitkuPayment processingInvoice and payment details
SMTP email providerTransactional email deliveryRecipient address, name and message content
Infrastructure providersHosting, container registries, the MongoDB database and the Redis queueAll platform data at rest and in transit

Some sub-processors operate outside Indonesia, so processing may take place abroad. AdOps will give notice of a new sub-processor by email before it begins processing, and a customer who objects on reasonable data-protection grounds may terminate the affected service.

Assisting the customer

On written request, AdOps will help the customer respond to access, correction, deletion and portability requests from data subjects, and will provide the information the customer reasonably needs to complete a data protection impact assessment for the processing described here.

Most of this is self-service: rule definitions, execution records, custom metrics and invoices are all visible and exportable inside the product, and deleting a rule deletes its execution records.

Personal data breaches

If AdOps becomes aware of a personal data breach affecting customer data, it will notify the customer without undue delay at the email address on the account, with the facts known at the time, the likely consequences, and the steps taken or proposed.

Deletion and return

On termination, the customer may export the data available in the product. On written request to support@adops.id, AdOps will delete the customer’s account data, rule definitions, execution records, custom metrics and cached spreadsheet rows, retaining only what is required for billing and legal purposes.

Disconnecting Meta before termination is the fastest way to end AdOps’ access: it deletes the ad-account records stored for the account and clears the stored token.

Audit

On reasonable written notice and not more than once a year, AdOps will make available the information needed to demonstrate compliance with this addendum, and will respond to a reasonable security questionnaire. On-site audits are by agreement.

Precedence

Where this addendum conflicts with the Terms of Service on the processing of personal data, this addendum applies.

Requests under this addendum go to admin@adops.id.

Legal, procurement and data-protection questions go to admin@adops.id. Include your company name and, if the question is about a specific account, the ad account ID.

All legal documents admin@adops.id

Inside the product

What the screens actually look like

Nine screens from the working dashboard — the rule builder, the metric picker, the dayparting grid and the log that records what happened. Scroll the strip.

  • The AdOps Performance Dashboard showing a Purchase ROAS card at 2.380x and an Aggregated ROAS card at 2.088x, both badged Profitable, a Monthly Budget card at Rp 155jt, and a Spend Breakdown ranking the top five ad accounts against a budget utilisation bar at 45.5 per cent.
    Performance Dashboard. Two ROAS figures to three decimals, a budget meter, and spend ranked by ad account — over Today, Last 7 days, Last 30 days or This month.
  • The AdOps rule list showing twelve automation rules, each with an on/off toggle, the ad accounts it manages, and when it last triggered — some minutes ago, others on a dated timestamp.
    Rule List. Every rule, what it manages and when it last fired. The toggle is the only thing between draft and live.
  • The AdOps condition builder showing a task with time-of-day conditions across seven day tags, a nested AND group holding a lifetime spend condition under 400,000, and a second task with four stacked metric conditions.
    Conditions. Metric, period, operator, value — joined with AND or OR, and nestable, so a rule can say something a dropdown cannot.
  • The AdOps metric picker open over a condition row: a panel with Meta Ads and Custom metrics tabs, a search box, and a scrolling list of metrics with Spend selected.
    Metric picker. Forty-five Meta metrics and your own sheet columns in the same list, each carrying a reporting period and any of six operators.
  • The AdOps dayparting timetable: a grid of hours against the seven days of the week, with the daytime hours filled navy for every day and the night hours and weekend evenings left empty.
    Dayparting grid. Or draw the hours instead. Anything outside the shape you fill in simply does not run.
  • An AdOps execution log detail: one campaign, two action panels badged Not Executed, each listing the action parameters and every condition evaluated with its actual value, its expected value and a Pass or Fail badge.
    Rule Log detail. Why a rule did nothing is recorded as carefully as why it did something — actual against expected, condition by condition.
  • The AdOps activity log listing budget increases and campaign renames, each row naming the affected campaign by id, the rule that caused it and how long ago it happened.
    Activity Log. One row per change AdOps made in your account, naming the campaign and the rule responsible.
  • The AdOps ad account list: eighteen Meta ad accounts with on/off toggles, account ids, Active or Inactive badges and this month’s spend in rupiah.
    Ad Accounts. Accounts discovered from Meta arrive switched off. Nothing is read, and nothing is changed, until you turn one on.
  • The AdOps custom metric editor mapping a Google Spreadsheet: a spreadsheet id, a sheet name, a column to match campaigns on and a column holding the values.
    Custom metric. Point AdOps at a sheet, name the matching column and the value column, and your own number joins the metric list.

Every figure is rebuilt from the product’s own interface and filled with invented data — no customer name, ad account or spend figure appears anywhere on this site. See how a run works