Legal

Data Processing Addendum

Last updated: 23 July 2026

1. Purpose

This page summarizes the Data Processing Addendum ("DPA") terms Analytics Lens offers business customers under GDPR Article 28, for use where Analytics Lens processes personal data on a customer's behalf as a processor, and the customer is the controller of that data.

2. Roles

For data flowing from a connected source (Google Ads, GA4, Search Console, Shopify, Meta Ads) into a customer's own Google Sheet, the customer is the data controller and Analytics Lens acts as a data processor, processing data only on the customer's instructions (the report configuration they set up) and for no other purpose.

3. Subject matter & duration

Processing consists of reading the metrics/dimensions a customer selects from a connected source and writing them into that customer's Sheet, on the schedule the customer configures. Processing continues for as long as the connection remains active, and ends when the customer disconnects a source or uninstalls the add-on.

4. Sub-processors

Current sub-processors are limited to those needed to run the service itself — our hosting provider and, where applicable, Google Workspace Marketplace as the distribution channel. See the "Third-party services & sub-processors" section of our Privacy Policy for the current list; we'll notify business customers of material changes to it.

5. Security measures

Data in transit is encrypted (HTTPS/TLS). Analytics Lens does not persist connected-source data beyond the processing window needed to complete each scheduled sync — there is no long-term data store to secure, by design, which is itself a security measure: data that isn't retained can't be breached from our systems after the fact.

6. Data subject rights & deletion

Analytics Lens will assist the controller in responding to data subject requests (access, deletion, portability) relating to data processed on the controller's behalf. See our Data Deletion Instructions for the mechanics.

7. International transfers

Where processing involves a transfer outside the EU/EEA or UK, Analytics Lens relies on the sub-processors' own published safeguards (including Standard Contractual Clauses where applicable) as the transfer mechanism.

8. Requesting a signed copy

This page is a summary of the terms we offer, not itself a signed legal instrument. If your organization requires a countersigned DPA on file — common for Shopify Plus merchants, Google Workspace enterprise customers, and similar — email support@analyticslens.ai with your company name and we'll send the full agreement for signature.