Product Disclosures

1. Overview

Adscod is committed to transparency and responsible data handling. This document discloses key aspects of how our platform operates, including data hosting, sub-processor usage, security, AI features, and compliance frameworks.

These disclosures apply to all users of the Adscod platform.

2. Data Hosting and Infrastructure

• Customer Data is hosted on secure cloud infrastructure with data centers in Europe (primary) and Africa (secondary/CDN).
• All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Redundant backups are performed daily with a retention period aligned to your subscription tier.
• Adscod utilizes infrastructure providers that maintain security practices in compliance with applicable data privacy laws, including the Data Protection and Privacy Act of Uganda, and relevant regional standards.

3. Sub-Processors

Adscod engages the following categories of sub-processors in the delivery of its services:

A detailed sub-processor list is available upon request by contacting dpo@adscod.com. Customers will be notified of material changes to sub-processors in accordance with the Data Processing Agreement.

4. Security Measures

• Role-based access control (RBAC) across all internal systems.
• Multi-factor authentication (MFA) for all administrative access.
• Regular vulnerability assessments and penetration testing.
• Incident response procedures with documented escalation paths.
• Employee security training conducted at onboarding and annually thereafter.
• Automated monitoring and alerting for anomalous activity.
• Automated fraud detection system with six check types: account age/follower ratio analysis, follower velocity monitoring, conversion anomaly detection, follower legitimacy scoring, click burst detection, and social follower inflation analysis.
• Escrow wallet operations secured with PIN verification (4–6 digits, bcrypt-hashed), atomic transactions, and immutable ledger entries.
• Payment webhook signature verification (HMAC) with replay-attack prevention (25-hour window) and idempotent payment processing.

5. Data Retention

• Customer Data is retained for the duration of the Subscription Term plus a grace period for data retrieval (30 days for Premium; immediate deletion for Pro/Lite).
• After the retention period, data is permanently and irreversibly deleted.
• Anonymized and aggregated data may be retained indefinitely for statistical, diagnostic, and platform improvement purposes.
• Financial records, including wallet ledger entries, escrow transactions, and platform revenue records, are retained as required by applicable financial regulation.
• Legal hold requests will be honored in accordance with applicable law.

6. AI and Machine Learning

• Adscod uses AI and machine learning to enhance the Platform, including influencer matching, campaign optimization, content recommendations, fraud detection (six automated check types with adaptive thresholds), creator scoring and level progression, and feed personalization.
• AI models are trained on aggregated and anonymized data. Individual Customer Data is not used to train AI models accessible to other customers.
• Customers may opt out of certain AI-powered features through their account settings.
• Adscod does not use AI for automated decision-making that has legal or similarly significant effects without human oversight.

7. Third-Party Integrations

• Adscod integrates with third-party social media platforms, analytics providers, and payment processors.
• Data shared with third-party integrations is governed by the respective third party's terms and privacy policies.
• Adscod is not responsible for the data practices of third-party services.
• Customers are advised to review the terms of any third-party service connected to their Adscod account.

8. Communication Services

• Adscod provides in-platform messaging for Brand–Influencer communication.
• Email notifications are sent for account, campaign, and billing events.
• Communication records may be retained for dispute resolution, compliance, and audit purposes.
• Adscod does not monitor the content of private messages except where required by law or to investigate reported violations.

9. Compliance

• Adscod complies with applicable data protection laws, including the Uganda Data Protection and Privacy Act, Kenya Data Protection Act, Nigerian Data Protection Act, and the African Union Malabo Convention.
• Adscod undergoes regular internal audits and third-party assessments to verify compliance.
• Data Processing Impact Assessments (DPIAs) are conducted for high-risk processing activities.