Skip to content
StowStack

Data Processing Agreement

Last updated: March 1, 2026

1. Scope and Purpose

This Data Processing Agreement ("DPA") applies to the processing of personal data by StorageAds ("Processor") on behalf of the self-storage facility operator ("Controller") in connection with StorageAds marketing and attribution services.

StorageAds processes tenant data solely for the purpose of providing advertising attribution, campaign performance reporting, and related marketing services as described in the Terms of Service.

2. Data Processed

Categories of personal data processed may include:

  • Tenant names and contact information (from storEDGE reservation data)
  • Move-in and move-out dates
  • Unit type and rental rate
  • Advertising interaction data (ad clicks, landing page visits, conversion events)
  • Device and browser identifiers for attribution
  • IP addresses (anonymized for analytics)

3. Processing Obligations

StorageAds shall:

  • Process personal data only on documented instructions from the Controller
  • Ensure persons authorized to process data have committed to confidentiality
  • Implement appropriate technical and organizational security measures
  • Not engage sub-processors without prior written authorization
  • Assist the Controller in responding to data subject requests
  • Delete or return all personal data upon termination of services

4. Sub-Processors

StorageAds uses the following sub-processors:

  • Vercel:Application hosting (United States)
  • Neon:Database hosting (United States)
  • Upstash:Caching and rate limiting (United States)
  • Resend:Transactional email delivery (United States)
  • Stripe:Payment processing (United States)
  • Meta Platforms:Advertising delivery via Conversions API
  • Google:Advertising delivery via Google Ads API

5. Data Security

StorageAds implements industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest, access controls, audit logging, and regular security reviews. Database access is restricted to authorized personnel with role-based permissions.

6. Data Subject Rights

StorageAds will assist the Controller in fulfilling data subject requests including access, rectification, erasure, restriction, and portability. Data deletion requests can be submitted through the StorageAds dashboard or via email to blake@storageads.com.

7. Data Retention

Attribution data is retained for the duration of the service agreement plus 90 days. Upon termination, all personal data is deleted within 30 days unless retention is required by law. Anonymized aggregate data may be retained indefinitely for analytics.

8. Breach Notification

StorageAds will notify the Controller of any personal data breach without undue delay, and in any event within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, categories of data affected, and remedial measures taken.

9. Contact

For questions about this DPA or to exercise data rights, contact: blake@storageads.com

Theme