For business customers who need a written data-processing agreement (DPA) under Art. 28 GDPR, Helferlain provides a pre-filled agreement on request (see "How to sign").
Scope
Helferlain acts as processor for the following categories:
- OAuth tokens for the advertising and analytics accounts you connect
- Account and campaign data of those accounts needed to compute audits
- Audit findings, recommendations, and the action log we generate for you
- Inputs and account data sent to the AI provider for analysis when no customer AI key is stored (the provider is then our sub-processor)
Helferlain is not a processor of:
- Inference by an AI provider under your own key (BYOK) — your own contract with that provider governs it
Sub-processors
See /legal/sub-processors. We give 30 days' notice before adding a new sub-processor; you may object in writing.
Technical and organisational measures
- Database hosted in the EU (Neon, AWS eu-central-1, Frankfurt); web app and MCP gateway on Cloudflare's global network
- Tenant separation by application logic: every database query is restricted to the requesting workspace. Postgres row-level-security policies exist but are not effective in production, because the runtime database role bypasses them.
- OAuth tokens and customer AI keys encrypted at rest (AES-256-GCM envelope encryption with a key per workspace; master key stored as a Cloudflare secret)
- Transport encryption (HTTPS/TLS)
- Audit log of changes made to connected ad accounts
- Workspace deletion destroys the workspace key immediately; encrypted content becomes unrecoverable
- Notification of personal-data breaches without undue delay (Art. 33(2) GDPR)
How to sign
Email helferlainservice@gmail.com with your company details. We send back a pre-filled DPA within one business day.