Effective 1 September 2026. This addendum applies when Larp processes personal data for an advertiser organization in providing the service.
Roles and instructions#
The organization is the controller or business and Larp is its processor or service provider for organization-submitted personal data. Larp processes that data only to provide, secure, support, and improve the contracted service, follow documented instructions, or comply with law.
Scope of processing#
Processing can include organization users, campaign contacts, briefs, public Reddit evidence, support records, and billing identifiers for the account term plus applicable retention periods. Advertiser data is organization-scoped. Campaign completions are reviewed by platform staff, not advertisers.
Security and confidentiality#
Larp limits access by role, requires confidentiality, protects data in transit, manages credentials and secrets, monitors systems, and maintains recovery practices proportionate to risk. We will notify the organization without undue delay after confirming a personal-data breach affecting its data.
Subprocessors and transfers#
Larp may use the providers listed on its Subprocessors page for hosting, payments, communications, authentication, and operations. We require appropriate data-protection obligations and remain responsible for their processing on our behalf. International transfers use an appropriate legal mechanism where required.
Assistance and deletion#
Taking account of the processing, Larp will reasonably assist with data-subject requests, impact assessments, and regulator inquiries. At termination, we delete or return covered data on request unless retention is required by law, security, dispute, or accounting obligations.
Audit information#
We will provide reasonable information demonstrating compliance. Any additional audit must be necessary, confidential, coordinated in advance, and avoid disrupting operations. Contact hello@larp.ad to execute or discuss this addendum.