nelo.Back to nelohq.com

Data Processing Addendum

Last updated: 14 October 2026

This Data Processing Addendum ("DPA") is part of the nelo Terms of Service. It applies when nelo handles personal information for a customer under a US state privacy law (such as the California Consumer Privacy Act), the GDPR, the UK GDPR or the Swiss FADP. It applies automatically; you don't need to sign anything. If you want a signed copy, email contact@nelohq.com.

1. Parties and roles

"Customer" is the business that buys from nelo. "nelo" is q2o, Inc., 2035 Sunset Lake Road, Suite B-2, Newark, DE 19702, USA.

  • Data we gather for previews. When we make a preview, we look at public information about a business (its website, Google and Facebook pages, public reviews and photos, and its ads in Meta's public Ad Library). nelo is the controller for that information, under the Privacy Policy, before and after the Customer buys. This DPA doesn't cover it.
  • Data the Customer sends us. For personal information in the material a Customer sends us, or asks us to use, (for example reviewer names and review text, photos that show people, staff names), the Customer is the controller and nelo is the processor (or "service provider"). This DPA covers that "Customer Data".
  • Data about the Customer as our client (contact details, payments, emails with us): nelo is the controller, under the Privacy Policy.

2. Details of processing

  • Subject matter and purpose: making the Customer's ads and posts and delivering them.
  • Duration: while the Customer buys from us, plus the deletion period in Section 9.
  • What we do with it: store it, edit it into ads and posts, and send the finished files to the Customer.
  • People concerned: the Customer's customers who wrote reviews; people shown in the Customer's photos; the Customer's staff.
  • Kinds of data: names (shown as first name and last initial), review text, ratings and dates, photos that may show people, business contact details.
  • Sensitive data: none intended. The Customer must not send it.

3. Customer's instructions

nelo processes Customer Data only on the Customer's documented instructions: the Terms, this DPA, and what the Customer asks for by email. nelo will tell the Customer if it believes an instruction breaks data-protection law. The Customer is responsible for having the right to use the Customer Data in ads, including consent from people shown in photos, and for answering requests from its own customers.

4. Confidentiality

Everyone at nelo who handles Customer Data is bound by confidentiality and sees only what they need.

5. Security

nelo applies the measures in Annex 2. It may update them, as long as overall security doesn't go down.

6. Sub-processors

The Customer allows nelo to use the sub-processors listed at nelohq.com/legal/subprocessors (also in Annex 3). nelo will email the Customer at least 14 days before adding or replacing one. The Customer may object on reasonable data-protection grounds within that time. If we can't resolve it, the Customer may stop and get a refund of any work it paid for but hasn't received. nelo stays responsible for its sub-processors and holds them to protections no weaker than this DPA.

7. Requests from people

If someone asks nelo about Customer Data and names the Customer, nelo will pass the request to the Customer without undue delay and help it respond. nelo won't answer the person directly, except to say the request was passed on, unless the law requires it. A request to remove a review from future pieces is always honored.

8. Help, breaches and audits

nelo will reasonably help the Customer with security, breach notices, impact assessments and questions from authorities. nelo will email the Customer without undue delay, and within 72 hours, after it learns of a breach affecting Customer Data, with the information it has. nelo will provide the information needed to show it meets this DPA, including its main providers' security reports where available. If that isn't enough, the Customer may audit once a year, at its own cost, with 30 days' notice, during business hours, under confidentiality.

9. Return and deletion

The Customer can ask for a copy of its Customer Data at any time; nelo sends it by email link. nelo keeps Customer Data while the Customer buys from us and up to 12 months after its last order, then deletes it, unless the law requires otherwise. The Customer can ask nelo to delete it sooner. Files already delivered to the Customer are the Customer's to keep.

10. International transfers

nelo and its sub-processors handle Customer Data mainly in the USA. Where Customer Data comes from the EEA, UK or Switzerland, the parties rely on the EU-US Data Privacy Framework where the recipient is certified. Otherwise they rely on the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor), incorporated by reference with these choices: Clause 7 included; Clause 9 option 2 (general authorization, 14 days); Clause 11 optional wording not included; Clause 13: the supervisory authority of the Customer's establishment; Clauses 17 and 18: Irish law and courts. For the UK, the UK International Data Transfer Addendum applies with the same choices. For Switzerland, the FDPIC is the authority. Section 2 and Annex 2 fill in the SCC annexes.

11. US state privacy laws

Where a US state privacy law applies, nelo acts as the Customer's "service provider" or "processor". nelo won't sell or share Customer Data. It won't keep, use or disclose it outside its business with the Customer, or for any purpose other than making and delivering the Customer's pieces. It won't combine it with other data except as the law allows. It will tell the Customer if it can no longer meet these duties. The Customer may take reasonable steps to stop and fix any unauthorized use.

12. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA wins. Where the SCCs apply, they win over this DPA.

Annex 1: Processing details

As set out in Section 2.

Annex 2: Security measures

Encrypted connections (TLS) for every transfer; data kept with providers that run audited security programs; access limited to the people who make the Customer's pieces; secret keys kept on the server, never in the browser; no customer accounts or passwords on our site; preview pages on hard-to-guess links, not listed anywhere; bought files open only after Stripe confirms payment; only first name and last initial shown for reviewers; reviewer photos never used; deletion on the schedule in Section 9; a breach process with notice within 72 hours; confidentiality duties for everyone at nelo.

Annex 3: Sub-processors

Vercel (website and preview page hosting, USA); Cloudflare R2 (storing preview videos and bought files, USA); Resend (sending email, USA); Google Workspace (email inbox and working files, USA); Stripe (payments, USA); Anthropic (AI help with public business details and ad words, USA); GitHub (site code, including the list of preview pages, USA). Current list: nelohq.com/legal/subprocessors.