The three documents procurement always asks for, published instead of promised: who processes data on our behalf, what we keep and for how long, and how we tell you if something goes wrong. Written to be checked, not admired.
Last updated: 27 July 2026Reviewed with every engagement
01 · Sub-processors & tooling
Who touches data on our behalf.
The most important line in this section is what is not on the list: your campaign systems. Engagement workflows are built in your environment, under credentials you grant and can revoke — your ad platforms, CRM and warehouse never become our sub-processors, because the data never moves into ours.
Engagement-specific tooling (for example a scheduling layer like n8n or Make) is agreed per engagement in your guardrail config, runs in your accounts, and is listed in your engagement documentation — not here.
Netlify (US) — website hosting & form handling
Hosts this website and stores submissions from our site forms (readiness intake, guide unlock, proposal requests, template requests, builder applications): name, email, and the fields you submit. This is where website lead data lives.
Google (GTM & consent-gated analytics)
Tag management and analytics on this website only. Analytics and advertising storage are DENIED by default and activate only if you accept them in the cookie banner; ads data redaction is on. No engagement or client-campaign data flows here.
Anthropic (Claude)
The AI layer we use to build and run automations during engagements. Client inputs are processed to deliver the work, are not used by us to train models, and engagement context files live in your environment. Anthropic holds ISO/IEC 42001 certification for its AI management system.
Unsplash (image CDN)
Serves the photography on this website. No personal or client data is sent — it is a content delivery source only, listed for completeness.
We will notify active clients before adding a sub-processor that would touch their data, with the right to object. Questions about any entry: hello@campaignautomation.ai.
02 · Data flow, retention & deletion
What we hold, where it lives, when it goes.
Our architecture keeps this list short on purpose: the valuable data — campaign history, CRM records, logs, configs — lives in your systems from day one, so there is very little of yours for us to retain at all.
Website form submissions
Stored in Netlify Forms. Retained while relevant to an active conversation or consented mailing; deleted on request. If you opted into email, every message carries a one-click unsubscribe, and unsubscribing stops all marketing use.
On-device preferences
Your Readiness Score, guide-unlock state and cookie choices are stored in YOUR browser (localStorage) — they never leave your device, and clearing your browser storage removes them entirely.
Engagement working files
Audit analyses, build notes and deliverable drafts we hold during an engagement. Deliverables are handed over into your environment as the engagement closes; on exit we delete our working copies on request, and confirm in writing.
What we never do with any of it
No selling of data. No pooling across clients. No use of client data to train or fine-tune models. These are the same commitments made on the Trust page, and they apply to every row above.
Deletion requests: email hello@campaignautomation.ai from the address in question. We action them within 30 days and confirm when done.
03 · Incident notification
If something goes wrong, you hear it from us first.
An incident means any confirmed unauthorised access to, loss of, or misuse of data we hold for you, or a guardrail breach in a system we stood up that is still under our access.
When we notify
Without undue delay after confirming an incident that affects your data — our target is within 72 hours of confirmation. We do not wait for the full picture before the first notice.
What the first notice contains
What happened as we currently understand it, what data and systems are affected, what we have already done to contain it, what we recommend you do, and a named contact for follow-up.
What follows
Updates as the investigation develops, a written post-incident summary with root cause and corrective actions, and cooperation with your own notification obligations under GDPR, PIPEDA, Law 25 or your customer contracts.
Why your visibility does not depend on us
Because engagement systems run in your environment with every action logged in your audit trail, your own team can see what an automation did at any time — the log is yours by design, not a report we choose to send.
Your kill switch
You can revoke our access, pause any automation, or tighten any guardrail at any time, without notice and without breaking what has already been handed over.
These documents are orientation for your review, not a substitute for the signed DPA and security addenda that govern an engagement — send yours over and we will complete them in your format.