Data Processing Addendum
Last updated: October 26, 2026
Version 1.1
This Data Processing Addendum (DPA) governs the personal data OwnersPal processes on your behalf when you use the Service. If you're a US-based small business, you most likely don't need a signed copy — but it's here if your customers, your legal team, or your insurer asks. The terms below mirror the IAPP standard processor DPA, adjusted for OwnersPal's subprocessor list at /subprocessors.
Changelog
Version 1.1 adds disclosures and, in Sections 2, 3 and 8, describes how third-party apps you authorize are handled; there is nothing to accept again. v1.1 — September 17, 2026. What changed since v1.0 (July 14, 2026): • Annex 1 — a processing record for advertising conversion measurement: what is sent to Meta and Google for your own ad accounts (an ad click identifier plus a SHA-256 hash of the email address or phone number given with a booking, never the address or number itself), the once-a-day frequency, the 30-day eligibility window (7 days for Meta) and the marketing-consent condition. (PR #2284, September 13, 2026.) • Section 2.7 of the downloadable DPA — opt-in diagnostic screenshots attached to problem reports, which may incidentally contain personal data visible on screen, with their retention limit and deletion path. (PR #2040, August 19, 2026.) • Section 2 — the description of what we process on your behalf now names importing the testimonials you publish on your own website, booking and reservation handling, order and quote intake, and waitlist management. (PR #2284, September 13, 2026.) • Section 10 — the deletion report shown when you delete your account yourself, and the summary emailed to the address on the account. (PR for the account deletion report, September 27, 2026.) • Section 2 — the categories of data now name the sale value you can record for a lead who became your customer. (PR for the lead value page, September 27, 2026.) • Section 10 — how long we keep the deletion audit record (3 years), and copies in our database backups (up to 7 days) and in our hosting and error-tracking logs (up to 90 days) after a deletion. (PR for the deletion retention periods, October 2, 2026.) • Section 2 — the description of what we process now names the records of the recommendations the Service makes to you, your decision on each and the results afterwards (counts and totals, kept for up to 36 months). (PR for the decision records, October 2, 2026.) • Sections 2, 3 and 8 (Sections 2.3, 3.2, 3.4 and 8.1 of the downloadable DPA) — third-party apps, such as an AI assistant, that you authorize through Settings → AI assistants. These sections add how those authorizations work: sharing data with those apps is added to the purposes of processing; the access you grant them and the permissions you select form part of your documented instructions; those apps act for you, not as subprocessors of VIVE AI, Inc., and any onward transfer, including outside the EEA, UK or Switzerland, happens under your own arrangement with the app's provider; and our transfer commitments in Section 8 are subject to Section 3. (PR for connected AI assistants, October 2, 2026.) • Section 10 — a deletion you start that cannot finish at that moment: we record the request, finish the deletion afterwards and email the report when it is finished. (PR for finishing interrupted account deletions, October 5, 2026.) • Section 2 — the categories of data now name the setup progress of your website, business email and Google listing, including your domain's DNS and email providers and the DNS records we read from public DNS. (PR for guided setup, October 16, 2026.) • Section 2 — for your business email setup, the categories of data now also name the email provider you chose, your domain's mail servers (MX records) read from public DNS and the public DNS values you copy from your email provider (the domain verification code, the DKIM public key, and Microsoft's mail server name and DKIM host names), never passwords; and the address at your own domain that you ask us to send a test email to, which we use only to send that email: your setup progress keeps only when the last test email was sent and whether you confirmed it arrived. (PR for the guided setup email step, October 18, 2026.) • Section 10 — an account whose sign-up was never finished (its user never confirmed being 18 or older and authorized to manage the business's marketing, and never accepted the Terms of Service, the Privacy Policy and this DPA) is deleted 30 days after it was created, or after the day we started asking for an older account, after one email 7 days before; an account with an active or trial paid plan is not deleted this way. (PR for the consent screen, October 20, 2026.) • Section 2 — for your Google listing setup, the categories of data now also name the listing's Google Place ID, with whether the listing shows your website and when we last compared them; the Google Place ID of a search result that turned out not to be your listing, with when we found that, so we don't look it up again for 29 days; whether you already had a Google listing or needed one; how you are verifying the listing with Google; and when you told us you had asked Google for a postcard. These Google Place IDs are the only things we keep from what Google returns when we check the listing. (PR for the guided setup Google listing step, October 23, 2026.) • Section 2 — if you connect your own Google Search Console during setup, the categories of data now also name the access tokens Google gives us for it, your website's address as we register it with Google, the verification code Google issues for that address (which your website shows in its page code) and your permission level for it; we use them only to verify your website, add it to your Search Console, submit its list of pages and check that you are still its owner, in line with the Google API Services User Data Policy, including its Limited Use requirements; we read none of your Search Console search data; and we delete them when you disconnect, within 7 days (9 if Google could not be reached for more than a day) when the connection ends in another way, and with your account. (PR for the guided setup Search Console step, October 25, 2026.) • Section 2 (Sections 2.3, 2.4 and 2.5 of the downloadable DPA) — the optional phone assistant: answering your inbound phone calls is added to the purposes of processing (2.3), the people who call your phone assistant number to the data subjects (2.4), and the caller's phone number, the time, length and outcome of each call, call transcripts and summaries, and bookings and messages given by phone to the categories of data (2.5). These sections also name the subprocessors that handle the calls (Twilio, ElevenLabs and Google's Gemini, reached through ElevenLabs) and state the disclosure every caller the assistant answers hears first (that they have reached a virtual assistant and that the call may be recorded; if the assistant picks up but our service cannot confirm the call, it says the same without naming the business, tells the caller the line isn't available and ends the call, and on such a call Google's Gemini, reached through ElevenLabs, may read anything the caller says before the call ends, and we keep no transcript), that calls made while the assistant is off or cannot answer are handled by Twilio alone, with no AI, that Twilio keeps your transfer number in your phone assistant number's settings and that we ask Twilio to remove it when you change or clear it or delete your account, and keep asking until it is removed, that no call audio is recorded, what we remove from transcripts and summaries and the limits of that detection, that our call history is deleted automatically after 90 days (sooner when you delete the call, turn the phone assistant off or delete your account), that bookings and messages are kept like any other, that health details callers may mention (such as an allergy) are an exception to the rule against submitting special-category data, and that we ask ElevenLabs (which keeps a conversation for no more than 30 days) and Twilio to delete their copies of each call once it ends: normally right after the call, and within two days if we do not receive the call's end notice. For a call made while our service was down, we ask within about an hour of our service coming back; the log of a call made more than three days before then stays with Twilio under its own retention. (PR for the phone assistant, October 24, 2026.) • Section 2 — for your social media profiles setup (Facebook, Instagram and Threads), the categories of data now also name the social platforms you chose, the @name you picked for them, the @name from the link to each profile you already have, the profile text we drafted for you or that you edited or approved, how it was drafted, when you asked us for drafts, and what you told us you have done (the checks you made on your own public pages and the account-safety steps you ticked), never passwords, two-factor codes or recovery codes. (PR for the guided setup Social profiles step, October 25, 2026.) • Section 2 (Section 2.5 of the downloadable DPA) — for your social media profiles setup, the profile text we keep is now described as the text we drafted for you or that you edited or approved (not only the text you approved), together with how it was drafted and when you asked us for drafts. (PR for the guided setup social profile text, October 26, 2026.) • Section 2 (Section 2.5 of the downloadable DPA) — for your social media profiles setup, the categories of data now also name, for a Facebook Page or Instagram account you have connected, the result of checking that profile (which items matched what you set up, never the profile's contents); we delete these results when you disconnect that platform, when Meta asks us to delete its data, and with your account. (PR for the guided setup social profile check, October 26, 2026.) • Section 2 (Sections 2.3 and 2.5 of the downloadable DPA) — the phone assistant: the disclosure every caller the assistant answers hears first now says that they have reached an AI assistant and that the call may be recorded and shared with our service providers; the record of each call's length that we keep for billing now also notes, for a call the assistant answers, which version of the disclosure was used, the call's language and whether the disclosure was heard; and if a caller asks the assistant not to keep a record of the call, we store no transcript or summary of it. (PR for the AI assistant disclosure, October 25, 2026.) • Section 2 (Section 2.3 of the downloadable DPA) — the phone assistant: whenever Twilio rings your transfer number (other than for a call made while our service cannot be reached), whoever picks up must press 1 to take the call, and the call to your transfer number is not recorded and no AI hears it; and a call that came in while the assistant was already on as many calls as you allow at once, and that no one at your transfer number takes, is answered by the assistant only to take a message and is processed and kept like any other call it answers. (PR for call screening and the message fallback, October 25, 2026.) • Section 2 — automatic DNS setup (Domain Connect): where your domain is with a DNS provider for which we have switched it on (only after that provider accepts our record templates), we send your domain name to that provider's public Domain Connect service to ask whether it can add your website or email setup records and, if you choose automatic setup, send your browser to that provider's own approval page with a signed link naming the DNS records to add; the provider makes the changes only if you approve them there and acts for you, not as a subprocessor of VIVE AI, Inc.; and we store nothing from its responses. (PR for guided setup one-click DNS, October 26, 2026.) • Unchanged in v1.1: the sections covering privacy requests from visitors to your website, which already commit us to helping you answer them. v1.0 — July 14, 2026. The first version recorded against a server-side record of agreement.
How to use this page
Read it once. If your policies require a fully-executed instrument, download the Markdown, counter-sign, and email it to privacy@ownerspal.app. We'll counter-sign and return within five business days. Otherwise, your use of the Service constitutes acceptance.
Download DPA (Markdown)1. Scope and roles
When you use OwnersPal, you (the Customer) are the controller of any personal data you submit — your customers' reviews, the customer testimonials you publish on your own website, leads, contact lists, ad-account tokens, and the bookings or reservations, orders, quote requests, and waitlist signups your customers submit through your OwnersPal website. OwnersPal is the processor of that data. This DPA covers GDPR, UK GDPR, CCPA/CPRA, and other comparable privacy laws to the extent they apply to you. It does not cover data OwnersPal collects directly from you as a controller (billing email, login, product analytics) — that's covered in our published Privacy Policy.
2. Subject matter, duration, nature, and purpose
Subject matter: personal data you or your end users submit to the Service. Duration: as long as your subscription is active, plus any post-termination retention required for deletion or export. Nature and purpose: providing the Service — content generation, ad management, review monitoring, importing the testimonials you publish on your own website, lead capture, booking and reservation handling, order and quote intake, waitlist management, answering your inbound phone calls with the optional phone assistant (see below), listings, analytics, sharing Service data and derived statistics with third-party apps you authorize (see section 3), and any auxiliary processing strictly necessary to deliver those features. Data subjects: your customers and prospects, plus your own staff who use OwnersPal and the people who call your phone assistant number, if you have one. Categories of data: names, email addresses, phone numbers, postal addresses, lead-form free text, the sale value you record for a lead who became your customer, booking and appointment details (for example, requested time and party size), the phone number of a caller to your phone assistant number and the time, length and outcome of the call, a written transcript and summary of a call the phone assistant answers, messages left by phone, order and quote free text, public review content, customer testimonials published on your website (including the customer names and words as you published them), public listing metadata, the setup progress of your website, business email, Google listing and social media profiles (including your domain's DNS and email providers; the DNS records we read from public DNS, among them the mail servers, or MX records, your domain uses; the email provider you chose; the values you copy from your email provider and paste into OwnersPal — the domain verification code, the DKIM public key, and Microsoft's mail server name and DKIM host names — which are public DNS values and never passwords; and, for your Google listing, its Google Place ID, whether the listing shows your website and when we last compared them, the Google Place ID of a search result that turned out not to be your listing and when we found that (so we don't look it up again for 29 days), whether you already had a Google listing or needed one, how you are verifying the listing with Google (postcard, phone, email, video or instant) and when you told us you had asked Google for a postcard; these Google Place IDs are the only things we keep from what Google returns when we check the listing; and, for your social media profiles (Facebook, Instagram and Threads), the social platforms you chose, the @name you picked for them, the @name from the link to each profile you already have, the profile text we drafted for you or that you edited or approved, how it was drafted, when you asked us for drafts, and what you told us you have done (the checks you made on your own public pages and the account-safety steps you ticked), never passwords, two-factor codes or recovery codes; and, for a Facebook Page or Instagram account you have connected, the result of checking that profile (which items matched what you set up, never the profile's contents), which we delete when you disconnect that platform, when Meta asks us to delete its data, and with your account), the address at your own domain that you ask us to send a test email to (used only to send that email; your setup progress keeps only when the last test email was sent and whether you confirmed it arrived), and ad-platform access tokens you authorize. If you connect your own Google Search Console during setup, the categories of data also include the access tokens Google gives us for it, your website's address as we register it with Google, the verification code Google issues for that address (which your website shows in its page code so that Google can confirm you own it) and your permission level for the website in Search Console. We use these only to verify your website with Google, add it to your Search Console, submit its list of pages and check that you are still listed as its owner, in line with the Google API Services User Data Policy, including its Limited Use requirements: we use them for nothing else, don't transfer them except as needed to provide this, and don't sell them. We read none of your Search Console search data, and we delete these items when you disconnect Search Console, within 7 days (or 9 days if Google could not be reached for more than a day) when the connection ends in another way, and with your account. If your domain is with a DNS provider for which we have switched on automatic setup through the Domain Connect standard (which we do for a provider only after it accepts our record templates), then while your website or email setup still has DNS records to add, we read your domain's public _domainconnect DNS record and send your domain name, and no other personal data, to that provider's public Domain Connect service to ask whether it can add those records. If you choose automatic setup, we send your browser to that provider's own approval page with a link, signed by VIVE AI, Inc., that names your domain, the DNS records to add (the same public DNS records the setup step shows you to copy by hand) and the OwnersPal page to return to; the provider makes the changes only if you approve them there. That provider acts for you and is not a subprocessor of VIVE AI, Inc.; we never receive your login at that provider, and we store nothing from the _domainconnect record or from the provider's responses. Apart from health details that callers to your phone assistant may mention (such as an allergy), handled as described below, don't submit special-category data (health, biometric, etc.) unless we've agreed to it in writing. The Service also produces aggregate site statistics for your published website — daily counters of page views and button taps with a coarse traffic source (a referring domain or "direct"). These counters use no cookies and no device identifiers, retain no IP addresses, are not linkable to any person, and are kept for 13 rolling months. If a user reporting a problem expressly opts in (via a consent prompt shown before any capture), we also process a diagnostic screenshot of the page they were viewing, which can incidentally include on-screen personal data; screenshots are stored in access-controlled storage, deleted automatically after at most 90 days (uploads never attached to a report, within about 24 hours), and deleted when the account is deleted. Advertising conversion measurement is described in Annex 1. The Service also keeps records of the recommendations it makes to you, your decision on each and the results afterwards, as counts and totals with no customer names, email addresses, phone numbers or review text; these records are kept for up to 36 months and deleted with your account. Phone assistant: if you turn it on, we answer inbound calls to your phone assistant number for you. Before anything else, every caller the assistant answers hears, in English, that they have reached an AI assistant and that the call may be recorded and shared with our service providers. Normally they hear: "Hi, you've reached the AI assistant for [your business name]. This call may be recorded and shared with our service providers." If the assistant picks up but our service cannot confirm the call, it says "Hi, you've reached an AI assistant. This call may be recorded and shared with our service providers.", tells the caller the line isn't available and ends the call. Google's Gemini, reached through ElevenLabs, may read anything the caller says before the call ends, and we keep no transcript of such a call. Any words you add to the greeting come after this disclosure; you cannot change or remove it. We do not record call audio. Twilio carries the call, ElevenLabs processes the caller's voice live, and Google's Gemini language model, reached through ElevenLabs, writes the replies; when the assistant transfers a call, Twilio connects it only to your transfer number. Calls to your phone assistant number while the assistant is off or cannot answer are handled by Twilio alone: Twilio connects the caller to your transfer number if you have set one, and otherwise, or if no one answers, plays a fixed voice message saying the line is unavailable. No AI listens to these calls, and neither ElevenLabs nor Google's Gemini receives them. Twilio also keeps your transfer number in your phone assistant number's settings so that it can still connect calls when our service cannot be reached; we ask Twilio to remove it from there when you change or clear it or delete your account, and keep retrying until it is removed (until then, a call made while our service cannot be reached may still be connected to the old number). Whenever Twilio rings your transfer number for a call the assistant does not answer or for a call it transfers (other than a call made while our service cannot be reached), whoever picks up first hears a fixed voice message from Twilio naming your business and asking them to press 1 to answer, and the caller is connected only once they press 1, within about 8 seconds; if no one picks up or no one presses 1, the call is treated as not answered (so a voicemail on that number does not pick it up), and the caller hears the fixed voice message saying the line is unavailable. The call to your transfer number is not recorded, and no AI hears it. One exception: if a call came in while the assistant was already on as many calls as you allow at once and no one at your transfer number takes it, the assistant answers it only to take a message. The caller first hears the opening disclosure and then that everyone is busy and that the assistant can take a message; the assistant can answer questions from your published information and take a message, but cannot book or transfer, and the call lasts at most about 3 minutes. Such a call is processed and kept like any other call the assistant answers, as described here, and does not count toward your limit of calls at once; if not enough minutes are left, or the assistant cannot be reached for it, the caller hears the fixed voice message saying the line is unavailable, and your transfer number is not rung a second time. For a call the assistant answers, we keep the caller's phone number (unless withheld), the call's time, length and outcome, and a transcript and a summary; for any other call to your number, including one our service could not confirm, we keep at most the caller's phone number and the call's time, length and outcome. Before storing a transcript or summary, we automatically remove card, bank and government ID numbers and medical terms that we detect; detection can miss some, and medical terms are detected in English only. This call history is deleted automatically after 90 days, and sooner when you delete the call, turn the phone assistant off or delete your account. A booking or message the assistant takes, with the caller's spoken agreement to your booking terms for a booking, is delivered to you as an ordinary booking or inbox message; it is your data and is kept and deleted like any other booking or message, until you delete it or your account. It reaches you as the caller gave it, with only the card numbers we detect removed, so you can act on details such as an allergy; we use such details only to handle the call and to give you your call history and the caller's booking or message. We also keep a record of each call's length that holds no caller data, for billing; it is deleted with your account. For a call the assistant answers, other than one our service could not confirm, that record also notes which version of the opening disclosure was used, the call's language and whether the disclosure was heard, which we check against the call's transcript before anything is removed from it; the record of any other call notes no version and does not mark the disclosure as heard. If a caller asks the assistant not to keep a record of the call, the assistant is instructed to tell them it won't be kept and to note the request, and we then store no transcript or summary of the call; we still keep the caller's phone number and the call's time, length and outcome in your call history; any booking or message taken on the call and the call's billing record are kept as usual; and we ask ElevenLabs and Twilio to delete their copies as for every call. ElevenLabs works with the conversation before anything is removed from it. We ask ElevenLabs and Twilio to delete their copies of each call once it ends: normally right after the call, and within two days if we do not receive the call's end notice. For a call made while our service was down, we ask within about an hour of our service coming back; the log of a call made more than three days before then stays with Twilio under its own retention. If that notice never reaches us and we also could not link the call to its ElevenLabs conversation when it started, we cannot tell ElevenLabs which conversation to delete, so only ElevenLabs' own 30-day limit removes it. In any case ElevenLabs keeps a conversation for no more than 30 days. When you delete your account, we ask Twilio again for the calls still in your call history; Twilio may keep records that the law requires it to keep. The phone assistant takes no payments or orders, sends no text messages and makes no outbound calls of its own; it only connects a caller to your transfer number.
3. Customer instructions
OwnersPal processes personal data only on your documented instructions. The settings you configure in the OwnersPal dashboard — platform connections, audience definitions, approval rules, the access you grant third-party apps through Settings → AI assistants (including the permissions you select on the authorization screen), administrative actions — are your documented instructions for GDPR Article 28(3)(a). If we ever think one of those instructions is unlawful, we'll tell you promptly; we don't give legal advice. An app you authorize through Settings → AI assistants, such as an AI assistant, acts for you and is not a subprocessor of VIVE AI, Inc. We don't send your data to its provider on our own initiative: the app retrieves it under your authorization, and only within the permissions you selected. Any onward transfer, including outside the EEA, UK or Switzerland, happens under your own arrangement with that app's provider.
4. Subprocessors
The current list of OwnersPal subprocessors is the page at /subprocessors. It's the single source of truth — we update it whenever a vendor changes. We'll give you at least 30 days' notice before adding a new subprocessor; if you object in writing during that window and we can't reach agreement, you can terminate the affected part of the Service. OwnersPal remains responsible to you for everything our subprocessors do.
5. Security measures
OwnersPal maintains appropriate technical and organizational safeguards: TLS 1.2+ in transit and AES-256 at rest; least-privilege access with audit logging; quarterly access reviews; written confidentiality and privacy training for staff; dependency scanning and patch management; backup and disaster recovery suitable for a SaaS of this scale. The measures above are our commitments as of the date above and may evolve, but won't materially weaken.
6. Personal-data breach
If we confirm a personal-data breach that affects your data, we'll notify you without undue delay and within 72 hours. The notice will include what we know at that point: nature of the breach, categories and approximate count of affected records, likely consequences, and what we've done about it.
7. Data-subject requests
We'll help you respond to requests your customers make to exercise their rights — access, rectification, erasure, restriction, portability, objection. If we get a request directly that's about your data, we'll forward it to you and won't respond on your behalf unless we're legally required to. When a visitor to a website OwnersPal hosts for you uses its "Your privacy choices" form, OwnersPal delivers the request to you by email and in your OwnersPal inbox, and does not answer it on your behalf. OwnersPal keeps a record of each such request (its reference, type, optional message, a one-way fingerprint of the visitor's email address, and when it was received) for 24 months to help you respond and to document response times, then deletes the message and fingerprint. The visitor's name and email address stay in your inbox.
8. International transfers
Subject to what Section 3 says about apps you authorize through Settings → AI assistants, where personal data leaves the EEA, UK, or Switzerland in the course of providing the Service, OwnersPal uses a valid transfer mechanism — including the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK IDTA — incorporated here by reference. You're entering the relevant module(s) of those clauses with OwnersPal and authorizing OwnersPal to enter them with our subprocessors on your behalf.
9. Audit
We make available the information necessary to show we're meeting this DPA, including written responses to reasonable security questionnaires. If we obtain a SOC 2 / ISO 27001 report, sharing that under NDA satisfies your audit right under GDPR Art. 28(3)(h). Otherwise, you can audit on-site once per twelve months with 30 days' notice, at your expense, during normal business hours — without disrupting operations or accessing other customers' data.
10. Return and deletion of data
When your subscription ends, you choose — within 45 days — between (a) a machine-readable export of your personal data, or (b) deletion with a written certificate. If we're legally required to hold something longer, we keep it under the protections of this DPA. We may also keep salted-hash audit records strictly for abuse-prevention and legal defense (the May 2026 PII-hardening pass replaced plaintext email with HMAC-SHA256 hashes for the account-deletion audit trail) — those records aren't personal data of the deleted person. When you delete your account yourself in your settings, we show you a deletion report at that moment (by category: what was deleted, where it was stored, and what we or our subprocessors keep, why and until when, with a spreadsheet download) and email the same summary to the address on the account. If the deletion cannot finish at that moment, we record the request, finish the deletion afterwards and email the report when it is finished; that report covers what was deleted when the deletion finished. We keep no copy of the report. We keep that deletion audit record for 3 years after the deletion, then delete it. Copies of your personal data in our database backups are gone within 7 days of a deletion, as those backups expire, and mentions in our hosting and error-tracking logs within 90 days. Until the person using an account confirms they are 18 or older and authorized to manage marketing for the business, and accepts the Terms of Service, the Privacy Policy and this DPA, the account only shows the screen that asks for this. If that is not done, we delete the account and all personal data stored in it 30 days after it was created or, for an account created before we started asking, 30 days after the day we started. Seven days before, we send one email to the address on the account with the date and a link to finish, keep the date of that email with the account, and do not delete the account sooner than 7 days after it. An account with an active or trial paid plan, and accounts we operate ourselves, are never deleted this way; we contact the account holder instead.
11. Term
This DPA is effective on the date above and runs for the term of your subscription. Sections 6, 7, 9, 10, and anything else that should survive by its nature, do.
Annex 1. Processing record: advertising conversion measurement
Purpose: measuring ad conversions for your own Meta and Google Ads accounts, so you can see which of your campaigns led to a real booking. Personal data: a SHA-256 hash of the email address and phone number your customer gave with the booking, computed in memory at the moment of sending and never stored or logged by OwnersPal (the email address and phone number themselves are never sent); the ad click identifier from their visit (gclid for Google, fbclid for Meta); and the time the booking was made. No booking value is sent. Google receives the hashes only when your Google Ads account reports that it has accepted Google's customer data terms; otherwise it receives the click identifier alone. Data subjects: your customers who made a booking (confirmed or completed) on your OwnersPal website after clicking one of your ads. Recipients: Meta Platforms (Conversions API) and Google (Google Ads offline click conversions), each receiving the data for your own ad account. Frequency: once a day, by an automated job. Retention: none on OwnersPal's side for the hashed values. A booking is eligible to be sent only within 30 days of being made (7 days for Meta). OwnersPal keeps only an upload record (booking id, platform and status). Deleting the booking, including through an erasure request, removes it and its upload record, so it is never sent afterwards; disconnecting your ad account stops all uploads. Condition: the visitor accepted marketing cookies on your website and their browser sent no Global Privacy Control signal. Bookings without a click identifier captured under that consent are never sent.
Questions, audit responses, or a signed copy: