Sub-processors

Purpose: Frontend hosting (this marketing site at dashops.io and the dashboard at app.dashops.io)

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Backend API hosting (the Node.js / Express server at octatude-dashboard-api.onrender.com)

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Primary database for account data, advertising data, activity logs, messages sent through our contact and sales forms, product update sign-ups, and ad platform access tokens (which we encrypt before storing). MongoDB also keeps automatic daily backup snapshots of the database

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Email delivery: account verification, password resets, invitations and account activation, the one reminder we send to someone who signed up but has not finished, email digests and scheduled client reports, the emails we may send to the main admin of a company during a free trial (a setup reminder, a feedback request and, when a trial is set to end, a message asking why), the messages you send through our contact and sales forms (delivered to our team) and the confirmations we send you, the notice our team gets when a new company starts its free trial (the name, email address and phone number of the person who signed up and the company details they gave), replies our team sends from our @dashops.io addresses, product update emails, including the confirmation we send when you subscribe, and the one email inviting people on our list to join our community

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Two roles. First, it is where your advertising data lives. DashOps reads your ad accounts, campaigns, audiences, performance data, Pages and lead forms through Meta's Marketing API on your behalf, and sends Meta the changes you make in DashOps: campaigns, ad sets and ads, the images and videos you upload, audiences and lead forms. If you upload a customer list to create an audience, our server hashes each value (such as email, phone and name) with SHA-256 before sending it to Meta. Second, it receives data about visitors to dashops.io: the Meta pixel records the pages you view, and when you submit a form on dashops.io, or the contact-sales form on the app's sign-up page, our server sends Meta the event with your email address hashed with SHA-256, your IP address, your browser user agent and the page address, and, for the forms on dashops.io, the Meta browser cookie ids when your browser has them. It also receives one event from the dashboard (app.dashops.io): when someone starts a free trial there, the Meta pixel loads and reports it with at most the plan and billing period chosen, the number of ad accounts on the plan, what the plan will cost when the trial ends and a random event id, together with the IP address, browser details, page address and Meta browser cookie ids

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Payment processing for paid subscriptions. You enter your card in Stripe's own card fields, so DashOps never sees the full card number. We give Stripe your company name, your main admin's email address and your subscription details, and Stripe keeps your invoices and payment records. Stripe's payment script is loaded on the pages of the app

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Website analytics and ad measurement on dashops.io, app.dashops.io and agencies' own domains for the app, and remarketing as described below. Google Analytics records the pages you visit, roughly where you are based on your IP address, and your device and browser, and the click id Google adds when you arrive from one of our Google ads. When you submit a form on dashops.io, our server also sends Google Analytics the event, which form it was, the page address and your Google Analytics browser id (not your email address). It also receives one event from the dashboard (app.dashops.io): when someone starts a free trial there, Google Analytics receives it with at most the plan and billing period chosen, the number of ad accounts on the plan, what the plan will cost when the trial ends and a random event id, together with the IP address, browser details, page address and Google's browser cookie ids, and passes it on to Google Ads so we can see which of our ads bring in trials. The Google Ads tag, on every page of dashops.io and app.dashops.io but not on agencies' own domains for the app, sets a Google Ads cookie (_gcl_au) and reports each visit to Google, which also uses its own advertising cookies, so that we can measure our ads and build remarketing lists of people who have visited those two sites, and Google can show our ads to them on other sites. Google Analytics is also linked to our Google Ads account with personalized advertising turned on, so lists of visitors that Google Analytics builds on dashops.io, app.dashops.io and agencies' own domains for the app can be shared with Google Ads and used to show our ads to those visitors on other sites (remarketing with Google Analytics)

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Heatmaps and session recordings on dashops.io only (not on the app). It records how visitors move, click and scroll on our marketing pages, using a Clarity cookie and the Google Analytics browser id and session id so visits can be matched to our analytics

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Live chat on dashops.io only (not in the app). When you visit, it sets its own cookies and receives your IP address, browser details, roughly where you are, the page you are on and the site you came from. If you write to us in the chat, it also receives what you type and any name or email address you give, and our team reads the conversation there to answer you

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Error monitoring for the API and the dashboard. When something crashes, Sentry receives the technical description of the fault, tagged with the account and user id so we can tell who it affected

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Off-site storage for the nightly database backup, which contains a copy of all account and advertising data. Sensitive fields such as advertising platform tokens stay encrypted inside the backup, and backups are deleted automatically after 30 days. It also hosts images uploaded to our blog, which your browser loads directly from Cloudflare when you read a post that uses one on dashops.io

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Our team's email. Messages you send through the contact or sales forms, emails you send to any @dashops.io address, and the notice we get when a new company starts its free trial are delivered to our team's Google Workspace mailboxes

Note: Where the provider publishes security certifications, they are on its own website, linked above.

Purpose: Email forwarding for our @dashops.io addresses to our team mailboxes

Note: Where the provider publishes security certifications, they are on its own website, linked above.