← Back

Privacy Policy

1. Controller

The controller responsible for data processing is:

Malte Hoffmann
Am Salzstadel 13
83022 Rosenheim, Germany
Email: info@getpacefy.com

For the budget and campaign data you upload to the Service, we act as a processor on your behalf within the meaning of Art. 28 GDPR; you remain the controller for that data.

2. What data we process, and the legal basis

  • Account data — when you register with your email address, we store that email address and authenticate you via a one-time code (OTP) sent to it. We do not use or store passwords. If you choose Sign in with Google, we receive your email address, name, and Google account identifier from Google (we never receive your Google password). Legal basis: Art. 6(1)(b) GDPR (performance of contract).
  • Budget & campaign data you upload (via CSV files you export from your advertising platforms) — processed solely to provide the pacing service. This data is yours; we process it only on your instruction. Legal basis: Art. 6(1)(b) GDPR.
  • Server logs & IP address — to operate and secure the Service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and security).
  • Billing data — payments are handled by Stripe; we receive limited subscription/billing status. Legal basis: Art. 6(1)(b) and, for invoices, Art. 6(1)(c) GDPR (legal retention obligations).
  • Transactional emails (account, alerts, system messages). Legal basis: Art. 6(1)(b) GDPR.

How spend data reaches Pacefy: Spend data is imported via CSV files that you export from your advertising platforms and upload to Pacefy. Supported sources include Google Ads, Microsoft Advertising (Bing), Meta, TikTok, Reddit, and LinkedIn. We do not connect to any of these platforms' advertising APIs and store no advertising-platform OAuth tokens. (This is separate from Sign in with Google, which we use only for authentication — see "Account data" above.)

3. Cookies

We use a single httpOnly cookie to maintain your authenticated session. It is strictly necessary for the Service to function. We set no tracking or advertising cookies, so no consent banner is required (§ 25(2) TDDDG).

4. Hosting and third-party services

We use the following providers:

  • Hetzner Online GmbH (Germany) — server hosting and data storage. Data is stored within the EU. (processor)
  • Cloudflare, Inc. (USA) — DNS and domain services. (processor)
  • Resend (USA) — transactional email delivery. (processor)
  • Stripe — payment processing. (processor)
  • Google (Google Ireland Limited / Google LLC, USA) — authentication when you choose Sign in with Google. Google acts as an independent controller for the sign-in. Privacy policy: policies.google.com/privacy

5. International data transfers

Hosting and primary data storage take place within the EU (Hetzner). Some providers (Cloudflare, Resend, Stripe, Google) may process data in the USA. Such transfers are safeguarded by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

6. Data retention

  • Account & uploaded data — retained while your account is active. On account closure or request, deleted within 30 days; backups are overwritten within 30 days.
  • Invoice / payment records — retained for the statutory period (up to 10 years, § 147 AO / § 257 HGB).
  • Server logs — retained for 90 days.

7. Your rights (GDPR)

You have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing. To exercise any of these rights, contact info@getpacefy.com.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

8. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email.

Last updated: June 2026