Depends on use: Not every service named here receives data automatically. Several providers are used only when a customer selects, connects and uses the feature concerned.
Security principles
- TLS-encrypted transmission; credentials for connected websites and accounts and the content of form submissions are stored in encrypted form.
- Passwords are stored as a hash only; accounts with administrative rights need a second factor (authenticator app or passkey).
- Role- and permission-based access; each customer's data is separated from the others in the database.
- Separate development, test and production environments.
- Logging of security-relevant events, update, backup and recovery procedures.
- Data minimisation and purpose limitation: the measurement works without cookies, and for connected accounts PrivacyAds requests only the permissions a feature needs.
- Procedures for detecting, assessing and handling security incidents.
Providers PrivacyAds uses
| Category | Provider | Purpose and use |
|---|---|---|
| Infrastructure & storage | Hetzner Online, Germany | Servers, database and object storage for files from forms at the Nuremberg location; encrypted database backups at the Helsinki location (Finland). |
| Network & protection | Cloudflare | Name resolution, delivery, protection against attacks; these legal pages are delivered from there as well. |
| Payment | Stripe | Subscriptions, invoices and payment status. The payment itself takes place on Stripe's pages. |
| Resend | Platform emails: sign-in and invitations, confirmation of enquiries, notifications. | |
| AI | Anthropic | Proposals and evaluations by the agents, drafting forms and pages, visibility samples; only when a user starts a run or puts it on a schedule. |
| AI | OpenAI | Samples of how an AI assistant answers questions about a business; the question is transmitted, no visitor data. |
| Search data | DataForSEO | Search volume and rankings for search terms; search terms and the name of the website are transmitted, no visitor data. |
| Error analysis | Sentry, EU region | Technical error diagnosis of the platform; before sending, error reports are cleared of content such as cookies, addresses and keys. |
Providers a customer connects itself
| Category | Provider | Purpose and use |
|---|---|---|
| Search engine tools | Google (Search Console), Microsoft (Bing Webmaster Tools) | Retrieval of search queries, pages, clicks, impressions and positions of the customer's website. |
| Advertising accounts | Google Ads, Meta, TikTok | Retrieval of campaigns and their cost, clicks and impressions; read-only. |
| The customer's website | WordPress, GitHub, SFTP access, Framer, Webflow | Reading content and publishing approved changes on the connected website. |
| Forms and bookings | MASPro (same operator) | Counting confirmed enquiries and bookings from MASPro, without content; reading the names and addresses of forms released there. |
Depending on product, contracting party and region, a provider may itself be a controller or a processor. Details follow from its documentation, the customer's configuration and the specific order. Material changes to this overview are published here.
Responsible use
Customers should set up only the connections required, review permissions regularly, avoid special categories of personal data in forms or protect them specially, and remove connections that are no longer needed.
Security contact
Confidential reports: officeSPAM-SCHUTZ-BITTE-ENTFERNEN@pock.biz. Please also note the vulnerability disclosure policy.