Data Processing Agreement

Version: 2026-11 · Last updated: October 2026

This Data Processing Agreement ("DPA") is part of the Terms of use between:

• the customer: the agency or company that uses Nuanso and sets up workspaces (the "Controller"); and
• Sam Van Nuffel, a sole proprietorship (eenmanszaak) trading as Nuanso, company number 0714.916.229, VAT BE0714916229, Brusselsepoortstraat 134, 9000 Gent, Belgium ("Nuanso", the "Processor").

It applies whenever Nuanso processes personal data on the Controller's behalf while providing Nuanso. It takes effect when the Controller accepts the Terms of use, without a separate signature. A Controller that wants a signed copy can ask for one at hello@nuanso.io. If this DPA and the Terms of use conflict on the protection of personal data, this DPA prevails.

1. Definitions

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Customer Data means the personal data in the Controller's workspaces that Nuanso processes for the Controller, as described in Annex I.

2. Roles and instructions

1. The Controller determines the purposes and means of processing Customer Data. Nuanso processes Customer Data only on the Controller's documented instructions, including for transfers outside the European Economic Area (EEA), unless EU or Member State law requires otherwise; in that case Nuanso informs the Controller before processing, unless that law forbids it.
2. The Terms of use, this DPA, and the Controller's use and configuration of Nuanso (connecting ad accounts, uploading documents, chatting with Nuno, approving changes, sharing reports, deleting data) are the Controller's complete instructions. Additional instructions must be agreed in writing.
3. Nuanso informs the Controller immediately if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law.
4. The Controller is responsible for having a lawful basis for the Customer Data it brings into Nuanso, for informing data subjects, and for the lawfulness of its instructions. Where the Controller is an agency, this includes the data of its own clients, and the Controller ensures it is authorised by those clients to use Nuanso for them.

3. Confidentiality

Nuanso ensures that every person it authorises to process Customer Data is bound by confidentiality, and accesses Customer Data only as needed to provide, support or secure the service, or as the law requires. At the date of this DPA, the only person with such access is Sam Van Nuffel.

4. Security

Nuanso implements the technical and organisational measures in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks for data subjects (Art. 32 GDPR). Nuanso may update these measures, provided the overall level of security is not reduced.

5. Subprocessors

1. The Controller gives Nuanso a general authorisation to engage subprocessors. The subprocessors at the date of this DPA are listed in Annex III; the current list is on Nuanso's subprocessors page.
2. Nuanso informs the Controller of any intended addition or replacement of a subprocessor at least 30 days in advance, by updating the subprocessors page and emailing the owner of each of the Controller's workspaces. The Controller may object on reasonable data protection grounds within that period, by email to hello@nuanso.io.
3. If the Controller objects, the parties will first try in good faith to find a solution. If they cannot, the Controller may terminate its subscription with effect from the date the new subprocessor starts, and Nuanso refunds the prepaid fees for the remainder of the subscription year.
4. Nuanso imposes on each subprocessor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains fully liable to the Controller for the performance of its subprocessors' obligations.
5. The ad platforms the Controller connects (Meta, Google Ads, LinkedIn) are not Nuanso's subprocessors: the Controller chooses and connects them, and they process data under their own terms with the Controller.

6. International transfers

Where a subprocessor processes Customer Data outside the EEA in a country without an adequacy decision of the European Commission, Nuanso ensures an appropriate safeguard under Chapter V GDPR: the subprocessor's certification under the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with supplementary measures where needed. Annex III states the safeguard for each subprocessor. The Controller can request a copy of these safeguards at hello@nuanso.io.

7. Assistance

1. Data subject requests. Taking into account the nature of the processing, Nuanso assists the Controller, by appropriate technical and organisational measures, in answering requests from data subjects exercising their rights. The Controller can itself view, correct, export ("Download my data") and delete most Customer Data in the app. If Nuanso receives a request directly from a data subject about Customer Data, it forwards it to the Controller without undue delay and does not answer it, unless the Controller authorises it to.
2. Other obligations. Nuanso assists the Controller with its obligations on security, personal data breaches, data protection impact assessments and prior consultation of a supervisory authority (Art. 32–36 GDPR), taking into account the nature of the processing and the information available to Nuanso.
3. Costs. Reasonable assistance is free. Where assistance for a single request takes more than two hours, Nuanso may charge its time at an hourly rate it communicates and the Controller accepts before the work starts.

8. Personal data breaches

1. Nuanso notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice goes by email to the owner of each affected workspace.
2. The notice describes, as far as is known at that time: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it and to mitigate its effects. Nuanso provides further information as it becomes available.
3. Nuanso takes reasonable steps to contain the breach and prevent it from happening again, and documents it.

9. Deletion and return

1. During the agreement, the Controller can export Customer Data with "Download my data" and delete workspaces, documents, conversations and ad account connections in the app.
2. When the Controller disconnects an ad account, Nuanso deletes the data synced from it. When a workspace is deleted, or the account that solely owns it is deleted (7 days after the deletion request), Nuanso deletes all Customer Data in that workspace from its live database.
3. When the agreement ends, the Controller can export its data before deleting its account. Nuanso deletes the remaining Customer Data when the account is deleted, and in any case within 90 days after the end of the agreement, unless the Controller asks for it to be deleted sooner.
4. Deleted data remains in database backups until they expire, at most 27 days, and is not restored into the live service except to recover from an incident.
5. Nuanso may keep Customer Data only where EU or Member State law requires it, and then only for that purpose.

10. Audits

1. Nuanso makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, including this DPA and its annexes, and answers reasonable written questions within 30 days.
2. If that information is not sufficient, the Controller may audit Nuanso's compliance with this DPA, itself or through an independent auditor bound by confidentiality, no more than once a year (unless a supervisory authority requires it or after a personal data breach), with at least 30 days' written notice, during business hours and without disrupting the service. Each party bears its own costs of the audit.

11. Liability and term

1. Each party's liability under this DPA is subject to the limits in the Terms of use, except where the GDPR or other applicable law does not allow those limits.
2. This DPA lasts as long as Nuanso processes Customer Data for the Controller.

12. Governing law

This DPA is governed by Belgian law. Any dispute falls under the exclusive jurisdiction of the courts of Ghent (Dutch-speaking division).

---

Annex I: Details of the processing

Subject matter and duration. Providing the Nuanso marketing analytics service, for as long as the Controller uses it, and until deletion as described in clause 9.

Nature and purpose. Collecting data from the ad platforms the Controller connects; storing, combining and displaying it; generating answers, reports and proposals with AI models; carrying out changes to ad accounts only after a user in the Controller's workspace approves each one in the app; checking automation settings (Oversight); sending the reports and emails the Controller sets up; sharing reports through links the Controller creates.

Categories of data subjects.

• The Controller's users of Nuanso (employees, contractors) and their colleagues who are members of a workspace.
• Where the Controller is an agency: its clients and their staff, as named in conversations, documents, meeting notes, reports and the business profile.
• People who made changes in the Controller's ad accounts, as recorded in the ad platforms' change history (for Google Ads, by email address).
• People who searched for or interacted with the Controller's ads, only to the extent their own words appear in search terms. Ad performance data is aggregated and does not identify people.
• People who appear in ad creatives (images, video) or in uploaded documents.
• Recipients of shared report links and of performance emails.

Categories of personal data.

• Identity and contact data: names, email addresses, roles; the ad platform user ids of the people who connected accounts.
• Content: chat messages, business documents (PDF, Markdown, text), meeting notes and transcripts, report contents, the business profile, Nuno's memory of the workspace.
• Ad account data: account, campaign, ad and keyword structure and settings; aggregated performance metrics and breakdowns (device, placement, location, age, gender); search terms; creatives (text, images, videos); change history.
• Usage data: AI usage records per workspace and user, report usage events.

Special categories. Nuanso is not designed for special categories of personal data (Art. 9 GDPR). The Controller must not upload them unless that is necessary and lawful. Ad data may reveal them indirectly (for example ads for a health service); the Controller is responsible for that use.

Frequency. Continuous: nightly syncs per platform, an hourly Oversight check, and on demand while users work.

Retention. As in clause 9 and the Privacy policy: conversations are deleted 30 days after their last activity; Meta performance data older than 365 days is deleted; other Customer Data is kept until the Controller deletes it, disconnects the ad account it came from, or deletes the workspace.

Annex II: Technical and organisational measures

Encryption

• All traffic between browsers and Nuanso uses HTTPS (TLS). The app sends HSTS (one year, including subdomains).
• OAuth access and refresh tokens for ad platforms are encrypted with AES-256-GCM, with a new random IV for every write and a key held only in the hosting environment, both in the database and while an ad account is being connected. Tokens are never included in data exports or logs.
• Passwords are stored only as bcrypt hashes. Email-verification and password-reset links are stored only as SHA-256 hashes and expire after 24 hours and 1 hour respectively.
• The database is hosted by Railway in the EU (Amsterdam, the Netherlands); the app reaches it over Railway's private network.

Access control

• Every request is authenticated with a server-side session (HTTP-only, secure, SameSite cookie, 7-day lifetime, session id renewed at login). Resetting a password, changing a password, or requesting account deletion ends the other sessions.
• Access is granted per workspace: every request for workspace data checks that the user is a member of that workspace. The owner or admin role is needed to manage agency settings and client links; only an owner can delete a workspace.
• Ad platform connection flows use a one-time state value tied to the session, and re-check workspace membership on return.
• Changes to ad accounts are carried out only after a logged-in workspace member clicks "approve" on that specific proposal. The AI model has no way to approve or carry out a change itself. Approval re-checks the workspace's safeguards (pause switch, blocked hours, daily action limit, budget-change limit) and is recorded with the user and the time.
• Internal access. Nuanso has no admin screen to view workspace data. Access to the production hosting, database, code repository and service providers is limited to one person (Sam Van Nuffel), with two-factor authentication on every account that gives access to Customer Data.

Shared links

• Shared report links and client links use 128-bit random tokens. Shared report links expire after 90 days and can be revoked; client links can be turned off or replaced. These pages are served with noindex, no-referrer and no-store, and load no analytics or marketing tools.

Application security

• Rate limits on the API, sign-in, password reset, AI requests and public link pages; a daily cap on AI costs per workspace; one AI answer at a time per user.
• Request size limits, and strict checks on the type and size of uploaded files (PDF, Markdown and text documents; PNG, JPG and SVG logos).
• Security headers: Content-Security-Policy, frame-ancestors 'none', X-Frame-Options: DENY, X-Content-Type-Options: nosniff.
• The app loads no third-party scripts except Amplitude, and only after the user's analytics consent. Fonts are served from Nuanso's own servers.

Logging

• The request log records method, path, status and duration, not request bodies. Before anything is written to the log, credentials, tokens, cookies, secrets and database passwords are removed, and every value in a failed database query is replaced with [redacted]. Logs are kept for up to 90 days by the hosting provider.

Deletion and data minimisation

• Conversations are deleted automatically 30 days after their last activity; Meta performance data older than 365 days is deleted after each sync; used and expired one-time links are deleted after 7 days; per-request AI usage records after 13 months.
• Disconnecting an ad account deletes its synced data and revokes Nuanso's access at the platform once no other connection uses it. Deleting a workspace deletes all its data.
• Account deletion runs as recorded steps (workspaces, memberships, Stripe, Loops, Amplitude, the account); a failed step is retried the next night.
• No real customer data is used in Nuanso's source code, tests or examples.

Availability and backups

• Database backups are made daily (kept 6 days) and weekly (kept 27 days) by Railway.
• Background jobs that use the Google Ads quota are deferred when it runs low, so users' own requests keep working.

Organisational

• Confidentiality: only Sam Van Nuffel has access to Customer Data. Anyone given access in future must first sign a confidentiality undertaking, and this annex will be updated.
• Incidents: a suspected breach is investigated immediately; affected Controllers are notified within 48 hours as in clause 8; every incident is documented.
• Vendors: before a new subprocessor is used, Nuanso checks that it offers a data processing agreement with Article 28 GDPR terms and an appropriate safeguard for transfers outside the EEA.

Annex III: Subprocessors

At the date of this DPA. The current list is on the subprocessors page.

Nuanso also uses Firecrawl (SideGuide Technologies, Inc., US), Jina AI GmbH (Germany) and Google PageSpeed Insights to fetch and measure public web pages. They receive only the address of a public page, and no Customer Data.