Data Processing Agreement

1.1 This DPA applies whenever we process personal data for you as your processor. That is visitor data our tag collects on your website or Shopify store, and the Google Ads data you connect. Annex 1 describes it.

1.2 It forms part of our Terms of Service (https://savemybudget.io/terms) ("Terms"). Accepting the Terms, installing our tag or using the service means you accept this DPA. No signature is needed.

1.3 It does not cover data we handle as controller: visitors to savemybudget.io, waitlist signups, people who email us, your SaveMyBudget account, and the store details Shopify shares with us at install. Our Privacy Policy (https://savemybudget.io/privacy) ("Privacy Policy") covers those.

2.1 "UK GDPR" means the UK General Data Protection Regulation, as it forms part of the law of England and Wales, Scotland and Northern Ireland. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended or replaced from time to time.

2.2 "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR.

2.3 "Your Personal Data" means the personal data described in Annex 1 that we process for you.

2.4 "sub-processor" means a third party we engage to process Your Personal Data for us.

3.1 For Your Personal Data, you are the controller and we are your processor.

3.2 If you are an ads manager acting for a client, you confirm you have your client's authority to give us instructions for their site. For that site, your client is the controller, and you give us instructions on their behalf.

3.3 On Shopify, the merchant is the controller of click data collected on their store and we are the merchant's processor, as Privacy Policy section 15 says.

4.1 Subject matter, duration, nature and purpose of the processing, and the types of personal data and data subjects, are set out in Annex 1.

4.2 We process Your Personal Data only to:

• detect and score invalid clicks on your Google Ads campaigns;
• help you block the sources of invalid clicks, where you have given that permission;
• prepare and file invalid-click claims with Google for you; and
• report findings and results back to you.

4.3 We never sell, rent or trade Your Personal Data. We do not use it for advertising, audience building, analytics products, retargeting, or training generalised or third-party models. The only use across customers is the pooled abuse signals in section 11, which serve only the purposes in section 4.2.

5.1 We process Your Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing, unless that law forbids it.

5.2 Your documented instructions are:

• the Terms and this DPA;
• the settings you choose in the app, such as which sites we monitor, whether we suggest or apply IP blocks, and whether you authorise claim filing (Terms section 5); and
• any other written instruction you give us that we agree to.

5.3 We will tell you promptly if, in our opinion, an instruction breaks Data Protection Law. We may then pause that processing until you confirm or change the instruction.

6.1 You are responsible for having a lawful basis for the processing and for telling your visitors about it. That includes a privacy notice on your site that covers our tag.

6.2 You decide whether our tag runs before a visitor gives consent, and whether you need consent under PECR for it. We can give you guidance on legitimate interest, or on running the tag behind your consent tool. The decision is yours.

6.3 You must not use the service to send us special category data or data about criminal offences. Our tag is not designed to collect them: it never reads page content or form values (Privacy Policy section 5).

7.1 Only authorised personnel who need access to run the service can access Your Personal Data. Each is bound by a duty of confidentiality, by contract or by law.

7.2 Support access. To investigate a question or problem you raise, or to check that detection is working correctly, a small number of authorised SaveMyBudget staff can open a read-only support view of one of your sites. Each access:

• is read-only: staff cannot change your settings, connect or disconnect services, or file anything on your behalf while viewing;
• is limited to one site;
• is time-limited, and ends automatically when it expires;
• must record a reason before it starts; and
• is logged.

Separately, named staff prepare and file the claims you authorise and check the service's operation. That access is limited to what the task needs and is logged.

8.1 We take appropriate technical and organisational measures to protect Your Personal Data, as Article 32 of the UK GDPR requires. Annex 2 describes them.

8.2 We may update these measures, but never in a way that lowers the overall protection of Your Personal Data.

9.1 You give us general authorisation to use the sub-processors listed in Annex 3.

9.2 We will tell you by email at least 30 days before we add or replace a sub-processor, and we will update Annex 3. You can object in writing within that time, on reasonable data-protection grounds. We will then work with you in good faith to find a solution. If we can't, you may stop using the affected part of the service, or end the service, before the change takes effect.

9.3 Each sub-processor is bound by a written contract with data-protection obligations at least as protective as this DPA. We remain liable to you for our sub-processors' performance of those obligations.

10.1 Our database and application servers are in London, UK. Cloudflare handles each request at its nearest edge location, which can be outside the UK, and stores our raw archive in its EU jurisdiction, so it stays in the EU. Resend, our email provider, stores the emails we send and their delivery records in the United States.

10.2 Where a sub-processor requires a transfer outside the UK, we rely on UK adequacy regulations. These include the UK Extension to the EU-U.S. Data Privacy Framework, for US providers certified under it, such as Resend. Where none applies, we rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary measures.

11.1 You instruct us to use Your Personal Data, together with the same kind of data from our other customers, to detect invalid clicks for all customers. For example, when we score a click, we may take into account recent activity from the same source on other customers' sites.

11.2 What crosses customers is only the effect on a score. No other customer receives Your Personal Data.

11.3 Pooled abuse signals are used only to detect and block invalid clicks, never for anything section 4.3 rules out.

11.4 Abuse signals are not attributed to the customer whose traffic revealed them. No customer can see another customer's visitor data, sites or results.

11.5 Your business data never crosses customer boundaries. Campaign names, keywords, spend, conversions, claim outcomes and any other commercial information stay with you.

11.6 Pooled signals are kept as set out in section 14.

12.1 Data-subject requests. If a visitor contacts us about data collected on your site, we will pass the request to you without undue delay and will not answer it ourselves, unless you ask us to. We will give you reasonable help to respond, taking into account what we hold. We hold no names, emails or phone numbers for your visitors. We can search by an identifier we do hold, such as an IP address or Google's click ID, while that data is still retained.

12.2 Shopify requests. We answer Shopify's customer data and customer redaction requests with "no records held", because our tag never receives a Shopify customer ID, email or name.

12.3 DPIAs and the ICO. We will give you reasonable help with any data protection impact assessment, and any prior consultation with the Information Commissioner's Office, that relates to our service.

13.1 We will tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting Your Personal Data.

13.2 We will tell you, as far as we know at the time:

• what happened, and when;
• the categories and approximate number of data subjects and records affected;
• the likely consequences; and
• what we have done, or will do, to deal with it and limit its effects.

We will send more details as we learn them.

13.3 We will help you meet your own duties to notify the Information Commissioner's Office and data subjects. Our notice is not an admission of fault or liability.

14.1 While you use the service, we keep Your Personal Data as follows:

• Raw click data including IP address and user-agent: 90 days. This aligns with Google's 60-day claim window plus a buffer for adjudication.
• Per-device visit history on each site (a pseudonymous device key with daily counts of ad clicks and visits, but no IP address or page content), used to tell returning visitors from repeat clickers: 31 days.
• IP addresses in IP blocks you choose: kept while the block is active in your Google Ads account, and for 90 days after it ends.
• Google Ads click data we pull from your account (click ID, time, campaign, keyword, device): 13 months from the day of the click.
• Click IDs and lead references in feedback you or your AI assistant send us about clicks and leads: 12 months from when we received them.
• IP-block suggestions we have not applied, or that you dismissed: 90 days after the last flagged click, or 90 days after the suggestion last changed, whichever is sooner. A suggestion still being refreshed by new flagged clicks counts from its newest click. A block that is live in your Google Ads account stays.
• Addresses on your never-block list: kept while the site is active, and deleted if the site is erased.
• Clicks in a claim we have not yet confirmed: kept beyond 90 days only as the evidence fields the claim needs (Google's click ID, time, network, country and browser, but no IP address), and deleted at 120 days at the latest.
• IP addresses of the clicks in a claim we have confirmed: kept with the claim for filing with Google. If the claim is withdrawn before it is filed, they are deleted at once; if it is never filed, they are deleted 90 days after we confirmed it. Once it is filed, they are kept until 12 months after Google's decision, or 12 months after filing if Google has not decided by then. This is an exception to the 90 days for raw click data, because Google asks for IP addresses when it reviews invalid clicks.
• Evidence for a claim we have filed with Google (the file, the narrative and our correspondence about it) is kept with the claim. The IP addresses in that evidence are deleted on the clocks in the line above.
• Aggregates, detection outputs and threat signals: retained longer in pseudonymised form to keep detection effective.

14.2 Deleted data can stay in our database host's restore history for up to 7 days.

14.3 On termination or on request. When the service ends, or when you ask us in writing, we will delete Your Personal Data within 30 days. That includes your site's click data, detection results, visits, per-device visit history, feedback you sent us about clicks and leads, IP blocks that are no longer active, and the Google Ads click data we pulled. We also disconnect your Google Ads account. Four exceptions:

• copies in our raw archive expire on their own within the 90 days in section 14.1;
• evidence for a claim already filed with Google, including the IP addresses of its clicks, is kept as in section 14.1, in case Google revises its decision or you query a fee (Terms section 7.8). Claims not yet filed are deleted with their IP addresses;
• aggregates, detection outputs and threat signals already held in pseudonymised form are kept as in section 14.1; and
• an IP block still active in your Google Ads account keeps its address until the block is removed.

If you ask us to, and we still have access to your Google Ads account, we remove the IP blocks we applied before we disconnect.

14.4 Shopify. A shop redaction request, which Shopify sends 48 hours after you uninstall, deletes your store's click data, detection outputs and Ads reconciliation data on receipt, and anonymises the account record.

14.5 Return. Before deletion, you can export your claims and IP blocks from the app. We do not return raw click data.

14.6 We may keep Your Personal Data longer only where the law requires it. It then stays confidential and is used for nothing else.

15.1 We will make available the information you reasonably need to show compliance with Article 28 of the UK GDPR. Ask us through our contact form.

15.2 We will answer reasonable written questions about our processing first. If that is not enough, you, or an independent auditor bound by confidentiality, may audit our compliance with this DPA:

• at most once a year, unless a personal data breach or the Information Commissioner's Office requires otherwise;
• with at least 30 days' written notice;
• during business hours, without disrupting the service or seeing other customers' data; and
• at your own cost.

16.1 When you authorise claim filing (Terms section 5), you instruct us to send Google the evidence for each claim, through Google's own claim form, and to correspond with Google about it. That evidence includes each click's Google click ID, IP address, time, network, country and browser. Google receives that evidence as the party deciding your claim, not as our sub-processor.

16.2 The only change we make in your Google Ads account is a campaign-level IP exclusion, and only when you choose.

17.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in Terms section 12.

18.1 This DPA applies for as long as we process Your Personal Data, including after the service ends until deletion is complete.

18.2 If this DPA and the Terms conflict on personal data, this DPA wins.

18.3 We may update this DPA when the law or the service changes. The "last updated" date at the top shows the current version. We will notify you of material changes before they take effect.

19.1 This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Controller: you, the customer (for an ads manager, your client; on Shopify, the merchant).

Processor: IK Ventures Ltd, 843 Finchley Road, London, NW11 8NA. Contact: our contact form, "Privacy / data request".

Subject matter: finding invalid clicks on your Google Ads campaigns, using visitor data from our tag on your website and the Google Ads data you connect.

Duration: while you use the service, then until deletion under section 14.

Nature of the processing: collection by our tag; storage; enrichment (network and country lookup); matching against your Google Ads data; scoring; reporting in the app, by email and through AI assistants you connect (MCP); preparing and filing claims with Google; deletion.

Purpose:

• detect and score invalid clicks on your Google Ads campaigns;
• help you block the sources of invalid clicks, where you have given that permission;
• prepare and file invalid-click claims with Google for you; and
• report findings and results back to you.

Data subjects: visitors to your website or Shopify store where our tag is installed, including people who arrive from your Google Ads campaigns.

Personal data (Privacy Policy section 4(b), with browser-setting signals added to the fingerprint). When you install our JavaScript tag on your landing pages, we record the following for each ad click:

• The Google click identifier attached to the visit (gclid, gbraid or wbraid).
• The IP address and user-agent string of the request, recorded server-side.
• A device fingerprint derived from canvas, WebGL, font, screen and browser-setting signals (such as time zone and language).
• Browser automation markers indicating headless browsers or scripted drivers.
• Interaction metadata: counts and timings of mouse movements, scrolls, touches, clicks and keydown events, plus dwell time on the page.

We also process click, campaign and cost data pulled from your Google Ads account so we can reconcile it against our own data.

Derived and related data:

• page address and referrer, with personal details stripped from them when they arrive;
• country, region, city and network operator (ASN), and connection details observed by our edge;
• on Shopify, the shopper's consent state, as Shopify reports it;
• visits to the same site that did not come from an ad;
• per-device visit history, as described in section 14.1; and
• our detection results for each click.

Special category data: none intended.

Retention: section 14.

Collection and minimisation

• The tag never reads page content, form values, which keys are pressed, passwords or payment details. It does not change what your page shows or does, and it stores nothing on the visitor's device.
• Page addresses and referrers are cleaned when data arrives. From query strings we keep only ad click IDs, campaign (UTM) parameters and ad-platform tracking parameters, plus the names (not values) of other parameters, and we remove email addresses and IP addresses from the values we keep. Path segments containing digits or email addresses are masked. The original request is kept in our raw archive for up to 90 days as evidence.
• Our audit log never holds visitor IP addresses.
• Retention limits (section 14) are applied by scheduled deletion jobs and by our storage provider's expiry rules.

Encryption

• Data is encrypted in transit between visitors' browsers, your browser, our services and our providers.
• Our hosting providers encrypt stored data.
• The access tokens for your Google Ads account are stored encrypted, with the key held separately from the database.

Access control and separation

• Each customer's data is kept within its own boundary. Every request is checked against the signed-in user's access to that site, and automated tests check this separation.
• AI assistants (MCP) reach only the sites the signed-in user can see. They get no detection internals, and usage is limited.
• Admin access is limited to a small number of named staff, with verified sign-in.
• Support access is read-only, limited to one site, time-limited, needs a recorded reason and is logged (section 7.2).

Accounts and sign-in

• Sign-in links and invitations are single-use and expire quickly, and we store only a hash of them. Session cookies are signed, HttpOnly and sent only over HTTPS, and requests that change data must come from our own site.

Logging and monitoring

• Admin and support actions are written to an append-only audit log.
• Internal alerts never contain visitor IP addresses or click IDs, and application logs are sanitised.

Your Google Ads account

• We read reporting data. The only change we make is a campaign-level IP exclusion, and only when you choose.

Development and operations

• Credentials are kept in our providers' secret stores, never in code, and code is scanned for leaked secrets.
• Every change is reviewed, including an automated security review, and tested before release.
• Dependencies are reviewed, and new ones need an explicit decision.
• Our services fail safe rather than fail open.

Resilience

• Our database host lets us restore data to any point in the last 7 days.
• Our edge provider protects the service against denial-of-service attacks.

Personnel

• Everyone with access is bound by confidentiality, and access is removed when no longer needed.

MaxMind and Resend receive none of your visitors' data. They are listed because Privacy Policy section 9 lists them.

Recipients that are not our sub-processors

• Google receives the evidence for each claim you authorise us to file, as the party deciding the claim (section 16).
• Shopify delivers our tag on your store through the theme app embed, as part of your own Shopify store, under Shopify's own terms and privacy policy.
• AI assistants you connect (MCP) receive the data you or your assistant ask for, under your own agreement with that assistant's provider.
• Professional advisers and authorities, where we are legally required to disclose.