In short: PrivacyAds is a platform that lets businesses measure the effect of their website and advertising, receive enquiries through forms and improve their website content with approval. The operator is responsible for the platform account, contract, security and support. For data created on our customers' websites, the respective customer is regularly the controller and PrivacyAds its processor.
1. Controller
Ausbildungszentrum für Selbstverteidigung und Kampfkunst SportUnion, ZVR number 1561748312, Erikaweg 4, 9241 Wernberg, Austria, represented by its chairman Raimund Pock. Email: infoSPAM-SCHUTZ-BITTE-ENTFERNEN@masvillach.at. Privacy contact for PrivacyAds: officeSPAM-SCHUTZ-BITTE-ENTFERNEN@pock.biz.
2. Data protection roles
We are the controller for the administration of PrivacyAds accounts, user permissions, contracts, billing, platform operation, abuse prevention, security logs and support.
Our customers (businesses and the agencies that look after them) generally determine the purposes and means of processing on their websites: the measurement of page views and enquiries, the forms including what visitors enter, and the content they change through PrivacyAds. In that respect we process data on their documented instructions as a processor. Visitors to a customer website should primarily contact the business whose website they visited; we support it in handling the request.
A form on a customer website may contain the business's own privacy notice. That notice governs the specific enquiry and supplements this platform information.
3. Categories of data processed
- Account and organisation: name, email address, password (as a hash only), second-factor details (authenticator app or passkey), business (tenant), roles and permissions, language, invitations.
- Billing: plan, subscription status, invoice and payment status, AI credits used. Full card details are processed by the payment provider and not stored by PrivacyAds.
- Measurement on customer websites: page views and visits, page viewed, referring website (host name only), campaign details from the address, device and browser details, and the number of confirmed enquiries per day, campaign and landing page.
- Forms: what visitors enter in the forms built by the customer, uploaded files and images, signatures, the status of a consent, an email address given for confirmation, and technical request and security data.
- Website connections: type of connection, credentials stored in encrypted form (such as a token or password), content of the connected website, proposed changes, approvals and the history of changes.
- Advertising and search data: identifiers of connected advertising accounts, campaign names, cost, clicks and impressions per day; search queries, pages, clicks, impressions and positions from the customer's search engine tools; access tokens stored in encrypted form.
- AI features: the task a user sets, the content needed for it (such as the text of a page, details from the business's knowledge base or search data) and the result.
- Usage and security: IP address, browser and device information, timestamps, sessions, audit, diagnostic and error data.
4. Purposes and legal bases
- Providing and administering the platform, performance of the contract and pre-contractual steps (Art. 6(1)(b) GDPR).
- Compliance with statutory retention, tax and record-keeping duties (Art. 6(1)(c) GDPR).
- IT security, fraud and abuse prevention, error analysis and needs-based improvement (Art. 6(1)(f) GDPR).
- Optional features or integrations on the basis of consent (Art. 6(1)(a) GDPR) or on the instructions of the customer responsible.
Where we act as a processor, the customer determines the specific legal basis.
5. Measurement on customer websites
Customers embed a PrivacyAds measurement script in their website. The script sets no cookies and stores nothing in the browser. It counts page views and visits and records where a visit came from: a campaign (details from the page address), a search engine, an AI assistant, a social network or another website. Only the host name of the referring website is evaluated, never its path or a search term. The script removes click identifiers of advertising networks from the address; PrivacyAds transmits no visitor data to the networks.
Technical details of a request (IP address, browser and device details) are processed to count views, tell visits apart and limit abuse. PrivacyAds does not build profiles of individual visitors across websites.
Clicks on phone numbers, email addresses and WhatsApp links are also counted, as are clicks on links the customer defines in its measurement plan. The type of click is recorded, not the number or address. The IP address is not stored for counting: a daily identifier per website is derived from it, which allows visits on the same day to be told apart; the next day it is a different one. The customer can limit the measurement to page views only; in that case this identifier is omitted as well, and browser details, page title and referring website are not evaluated.
PrivacyAds counts an enquiry only once the customer's website or a PrivacyAds form reports it as accepted. For this, counters per website, day, campaign and landing page are stored, not one row per enquiry.
6. Forms
Customers build their own forms in PrivacyAds and embed them in their website or link to them as a separate page. PrivacyAds processes what visitors enter, uploaded files and signatures on behalf of the customer: they are stored in encrypted form, shown in the customer's account to the people authorised for it, and delivered to the destinations chosen by the customer (email address or webhook). Every view of a submission is logged.
The customer determines how long submissions are kept (between 0 and 365 days; the default is 90 days). After that, content and files are deleted. If a form requires an email address to be confirmed, the visitor receives a code at that address; the address is used for this and for the submission. To protect against abuse, submissions are limited by number and origin.
7. Connections to websites, advertising accounts and search data
PrivacyAds provides configurable integrations. Data is only retrieved or transmitted when an authorised user sets up and uses the integration:
- The customer's website (WordPress, a repository on GitHub, SFTP, Framer, Webflow): PrivacyAds reads content and writes changes only after an approval in the customer's account or within an automatic mode the customer has switched on. Credentials are stored in encrypted form and never displayed again.
- Advertising accounts (Google Ads, Meta, TikTok): PrivacyAds retrieves campaigns and their cost in order to calculate the cost per enquiry. PrivacyAds creates no campaigns there, changes and deletes nothing, and transmits no visitor or customer data to the networks.
- Search data (Google Search Console, Bing Webmaster Tools): PrivacyAds reads search queries, pages, clicks, impressions and positions of the customer's website.
- MASPro (club and course administration by the same operator): if a customer connects its MASPro account to a domain, MASPro reports confirmed enquiries and bookings to PrivacyAds as counters. An identifier against double counting and the origin of the visit are transmitted, no names, contact details or answers. PrivacyAds reads from MASPro the names and addresses of the forms the customer has expressly released there. Such forms are delivered by MASPro; entries go directly there.
The customer is responsible for its selection, configuration, legal basis and for informing the data subjects.
8. Google API Services and Google user data
When an authorised user establishes a Google connection, PrivacyAds uses the following scopes, depending on the feature expressly chosen:
- Google Search Console (
webmasters.readonly): for the website selected by the user, PrivacyAds reads search queries, pages, clicks, impressions and average positions in order to evaluate them in the customer's account. The scope permits reading only. - Google Ads (
adwords): the Google Ads API offers only this scope for retrieving cost; technically it also permits managing campaigns. PrivacyAds uses it exclusively for reading and retrieves campaign names, cost, clicks and impressions per day for the advertising account connected by the user. PrivacyAds creates, changes and deletes nothing in Google Ads and uploads no conversions or customer data. - Storage: the identifier of the connected account, technical connection data and encrypted refresh tokens are stored for as long as the connection exists. Retrieved cost and search data are stored in the customer's account for as long as the contract exists or until the customer deletes them.
- Transfer and disclosure: within PrivacyAds the data is accessible to the authorised users of the connected customer. If a user starts an AI-assisted evaluation of the search data or puts it on a schedule, search queries and the associated figures are transmitted to the AI provider used for it, exclusively to provide this feature. Google user data is not sold, not used for advertising by PrivacyAds, not passed on to data brokers and not used to train general AI models. Any other disclosure takes place only to necessary technical service providers, on the user's documented instruction or where required by law.
- Revocation and deletion: the connection can be removed in PrivacyAds and additionally revoked in the Google Account. On removal, PrivacyAds deletes the stored token and the cost and search data retrieved through this connection; further access ends. Evaluations already created may contain extracts of it; their deletion can be requested using the procedures described under Deletion & rights.
Google Limited Use: PrivacyAds' use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. Meta and TikTok
When a user connects an advertising account at Meta (Facebook, Instagram), PrivacyAds uses an access token with the permission ads_read. With it PrivacyAds retrieves the campaigns of the connected advertising account and their cost, clicks and impressions. PrivacyAds reads no profiles, posts, messages or audiences and changes nothing in the advertising account. The same applies to TikTok with access for retrieving reports.
Access tokens are stored in encrypted form. The connection can be removed in PrivacyAds and revoked with the respective provider. On removal, PrivacyAds deletes the token and the campaign and cost data retrieved from this advertising account; details are given under Deletion & rights.
10. AI features
PrivacyAds contains features that use a language model: proposals for changes to content, evaluations of search data, drafting forms and pages from a description, and samples of how AI assistants answer questions about a business. A run starts only when a user starts it or puts it on a schedule. The task and the content needed for it are transmitted. What visitors enter in forms is not transmitted to AI providers. Proposals are published only after an approval, unless the customer expressly switches on an automatic mode for a type of change.
11. Recipients and processors
We use hosting, storage, payment, email, AI, monitoring and integration providers. Depending on the features used, these include Hetzner, Cloudflare, Stripe, Resend, Anthropic, OpenAI, Sentry, DataForSEO and the providers a customer connects itself (Google, Meta, TikTok, Microsoft, GitHub, Framer, Webflow, MASPro). The current overview with purpose and condition of use is available under Security & subprocessors. Authorities or advisers receive data only where there is a legal basis or for legal defence.
12. Transfers to third countries
The platform is operated in the European Union. Some providers may process data outside the European Economic Area. Where no adequacy decision applies, we base transfers in particular on the EU Commission's standard contractual clauses and examine additional safeguards. The specific processing depends on the provider's region, product and configuration.
13. Retention
We store personal data only for as long as it is needed for the respective purpose, the customer relationship, legitimate security and evidence interests or statutory duties. Statutory invoicing and accounting records are regularly kept for seven years. Submissions from forms follow the period set by the customer. Operational data follows the contract, configuration and deletion request; a customer can export its data and initiate the deletion of its business in the account. Security logs, backups and event data are overwritten or deleted according to graduated technical periods; deleted data may remain in backups until the regular overwrite and is not restored for other purposes.
14. Security
We use risk-based technical and organisational measures, including TLS transport encryption, encryption of credentials and form content, a second factor for accounts with administrative rights, role-based access, separation of each customer's data in the database, separate environments, logging, updates, backups and incident-handling procedures. No system is absolutely secure; security reports can be submitted in accordance with our vulnerability disclosure policy.
15. Rights of data subjects
Data subjects have – where the statutory requirements are met – rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent for the future. There is also a right to lodge a complaint with the Austrian Data Protection Authority. If the request concerns a customer website, it should first be addressed to the respective business. Details can be found under Deletion & rights.
16. Contact and changes
Privacy requests: officeSPAM-SCHUTZ-BITTE-ENTFERNEN@pock.biz. We update this policy when material changes occur and mark the current version. Where changes require renewed consent, it is obtained separately.