EU Data Act

The EU Data Act (Regulation (EU) 2023/2854) requires providers of data processing services to publish certain information for their customers in the European Union. This page gives that information for Opteo. Opteo's Master Services Agreement refers to it.

Where our infrastructure is

Opteo is provided by Opteo Ltd, a company registered in England and Wales (company number 08590289). The Opteo platform runs in London, United Kingdom: our application servers are hosted by OVHcloud, and our databases and storage by Amazon Web Services (AWS). The Opteo website and the app's front end are served by Netlify (United States). Our platform infrastructure, where customer data is processed and stored, is subject to the law of the United Kingdom.

Some of our sub-processors process data in other countries, including the United States and the European Union. Our Sub-processor List gives the location of each one; you can request it from support@opteo.com.

Protecting data from unlawful government access

Most of the data our customers hold in Opteo is stored in the United Kingdom, outside the EU. Data held in the EU is limited to what our EU-based sub-processors hold, as shown in our Sub-processor List. We protect all customer data, wherever it is held, as follows.

• Technical. Data is encrypted in transit (TLS) and at rest (AES-256). Access follows the principle of least privilege, and multi-factor authentication is required for privileged access.
• Organisational. We disclose customer data to a government authority only where the law requires it, and we tell the customer first unless the law forbids it.
• Contractual. Our sub-processors are assessed for security and data-protection adequacy before we engage them, and are bound by data-protection terms.

Switching and exporting your data

If you are a customer in the EU, you can ask to switch to another provider, to move your data to your own infrastructure, or to have your data erased. Email support@opteo.com to start. Customers with a Master Services Agreement will find the process and timings in its Schedule 2.

Data register

Format: a SQL file in MySQL format, plus any files you uploaded, in their original format.
Standard: SQL (ISO/IEC 9075), in the MySQL dialect.
Structure: each export includes the table definitions for the data it contains.

• Account and user details: your users, their roles and the contact details entered.
• Settings and configuration: connected ad accounts, account groups, alert and budget settings, targets, and campaign experiments.
• Activity history: the improvements and issues Opteo raised, and the log of changes pushed through Opteo.
• Reports: the reports and exports created in Opteo.
• AI chat: conversations and saved prompts.
• Imported ad-account data: the copy Opteo holds of data from your connected ad platforms, and ad data you upload, such as search-term files.
• Ad drafts: ads you drafted in Opteo, and the ad suggestions Opteo made, with your comments.
• Digital assets: any files you or your users upload to Opteo, in their original format.
• Anything else: any other data you or your users enter into, upload to or create in Opteo.

Not exported

• Opteo's source code, algorithms, scoring and recommendation logic, AI system prompts and model configuration, and data specific to how Opteo runs internally, such as system logs, caches and error records, which are trade secrets.
• Opteo's own business records about your account (such as billing, sales and support), reference data that isn't specific to you, and third-party data we license, which aren't your data.
• Access tokens, passwords, API keys and other credentials, including the keys behind shareable report, scorecard and alert links, which we withhold for security.

Known limitations

The export contains your data and the results Opteo produced for you, but not the logic behind them: another service can't reproduce Opteo's recommendations or scores from it. Data imported from ad platforms is a copy of data the platforms still hold.

Charges

• We don't charge for switching or for exporting your data, including data egress charges.
• Your standard fees are set out in your Order Form or, for self-serve plans, on our pricing page.
• If you end a fixed-term contract early, including by switching, the fees for the rest of the term remain payable, unless we are in material breach or you end it because you object to a new sub-processor (see our Data Processing Agreement).
• Work you ask for beyond our switching obligations, such as an export in another format, is quoted and agreed with you in advance.

Latest update: 30 September 2026