Controller

The controller is the entity listed in the Impressum.

Brief form

When you send a brief I store the fields you enter (company, country, service, goal, budget range, email) on a server in Frankfurt, Germany. The purpose is to prepare a quote. Legal basis: Art. 6(1)(b) GDPR. Data is kept for 12 months after the last contact.

If you accepted marketing cookies, the server also reports the sent brief to Meta (Conversions API) so I can measure which ads bring enquiries. It sends your email address as an irreversible SHA-256 hash, your IP address, browser user agent, Meta browser identifiers and the budget range as a value; it does not send your company, goal or country. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw in “Cookie settings”.

Processors

Email delivery: Resend. AI-assisted analysis of the brief: Anthropic (Claude API). Invoicing: Fakturownia sp. z o.o. (Warsaw). All three under data processing agreements.

Server logs

The server in Frankfurt, Germany keeps a technical log of page visits: the date and time, the page address with its parameters (for example campaign tags), the page you came from, browser information, the response code and a truncated IP address (the last part removed, so it does not point to a single device). It stores no cookies. Purpose: keeping the site secure and checking that traffic from ads reaches it. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. The logs are deleted after 14 days.

The brand search on the competitor ads report page stores the brand name you type, the country, the result and a truncated IP address (the last part removed). Purpose: protecting the search from abuse and statistics. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. I delete the truncated IP address after 30 days.

On the competitor ads report page I also measure how the page works: whether the search field was visible, whether someone clicked it and typed (not what), the choice made in the cookie banner, how far the page was scrolled, how long it was on screen and whether the order buttons were clicked. For this the page draws a random visit number that exists only in the open tab and adds the campaign tags from the address. Nothing is stored in your browser, and the server stores no IP address or browser information, so this data cannot be linked to you. Purpose: improving the page. The data is deleted after 90 days. If your browser sends the Global Privacy Control signal, the page measures nothing.

Cookies and analytics

A necessary cookie (hausof_consent) stores your cookie choice for 180 days. Everything else runs only after you consent in the cookie banner, and you can change your choice at any time via “Cookie settings” in the footer.

Analytics (with consent): Google Analytics 4, provided by Google Ireland Limited. It measures visits and conversions such as a sent brief or a click to book a call. IP addresses are not stored by Google Analytics 4 in the EU.
Marketing (with consent): Google Ads (Google Ireland Limited) and Meta Pixel (Meta Platforms Ireland Limited). They measure which ads bring enquiries and let me show ads to people who visited the site.

Without consent, Google tags run in a restricted mode that sets no analytics or advertising cookies. Legal basis: your consent, Art. 6(1)(a) GDPR. Google and Meta may process data in the United States; both are certified under the EU-U.S. Data Privacy Framework.

Free audit requests

When you ask for a free audit, I store the website address and email you enter, the Facebook or Instagram page address if you give one, the page you sent the form from, the language and, only if you accepted marketing cookies, the Google Ads click identifier (gclid) of the ad you came from. The data is kept on the server in Frankfurt, Germany. The purpose is preparing the audit and sending you the private link and access code. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by email to the address in the Impressum; I then delete your request at once.

The free Meta ads check works the same way: I store the store address, email and, if you give one, the Facebook or Instagram page, together with the page you sent the form from, the language and (only with marketing cookies) the gclid. The purpose is preparing the Meta ads check and sending it to you by email. The legal basis, storage and deletion are the same as for the free audit.

If you accepted marketing cookies, the server also reports the request to Meta (Conversions API) as a lead, with your email address as an irreversible SHA-256 hash, your IP address, browser user agent and Meta browser identifiers. I also upload it to Google Ads as a conversion of the ad click: the click identifier, the time of the request and your email address as a SHA-256 hash. Your website address is not sent to Google or Meta. Without marketing consent the server sends nothing to Google or Meta.

The request, the results of the automated review of your public website and the audit are deleted 6 months after the last change, unless we are in an ongoing conversation. The audit page itself expires after 30 days.

Outreach to companies

I sometimes write to companies whose websites I have reviewed. For that I use public business data: company name, website, country, business phone and the contact email published on the company’s website or business listing (Google Maps). I store it together with the results of an automated review of the public website (speed, tracking tags, structured data, public ads) on the server in Frankfurt, Germany. The purpose is offering my services to businesses. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

If there is no reply, the data is deleted 6 months after the last contact. If you reply “no” or ask me to stop, I delete it at once and keep only a pseudonymised hash of the domain and email address, so I don’t write again. You can object at any time by email to the address in the Impressum.

The private audit page sets one necessary cookie that remembers the access code for 7 days. Opens of the page are logged with a hashed IP address and the browser’s user-agent string.

Panel and the competitor ads report

When you open an account in the panel (hausof.tech/en/app/), I store your e-mail address, language, country, the date you accepted the terms and, if you give it, the date of your consent to marketing e-mails (news, offers and advertising best practices from hausof.tech) and the version of its wording. For each signed-in browser I store the sign-in date, the last activity and the user-agent string, so you can see and sign out your sessions. The panel sets one essential session cookie (hausof_app, 30 days) and one that lets the browser that asked for a link sign in without an extra click. I also store your orders: the advertisers’ pages you picked, the country, the price, the amount paid, the status and your cookie choices at the time of the order.

Purpose: running your account and making the report you ordered. Legal basis: the contract, Art. 6(1)(b) GDPR. Marketing e-mails go out only with your consent (Art. 6(1)(a) GDPR), which you can withdraw under “Account” in the panel. The data is stored on a server in Frankfurt, Germany, until you ask for the account to be deleted.

Payments are handled by Stripe (Stripe Payments Europe Limited, Ireland). You enter your company name, address, VAT number and card details directly in Stripe’s checkout. After the payment the server takes from Stripe what the invoice needs (company name, address, VAT number, e-mail address and amounts; never card details) and passes it to Fakturownia, which issues the invoice, sends it to Poland’s National e-Invoicing System (KSeF) run by the Ministry of Finance and e-mails it to you. Legal basis: the legal obligation to issue an invoice, Art. 6(1)(c) GDPR. Invoicing data is kept (by me, Stripe and Fakturownia) for as long as tax law requires.

If you accept marketing cookies, when you ask for a sign-in link and when you place an order I store the Google Ads click identifier (gclid, gbraid or wbraid) and Meta’s browser identifiers, and when you place an order also the browser’s user-agent string; with analytics cookies I also store the Google Analytics identifiers (client and session). For a signed-in browser I keep them for the length of the panel session (up to 30 days); with a link that is never used they go within a day. Once an order is paid the server reports the purchase: to Google Ads (the click identifier, the time, the order number, the net amount and your e-mail address as an irreversible SHA-256 hash), to Meta through the Conversions API (your e-mail address and account id as SHA-256 hashes, Meta’s browser identifiers, browser information, the time, the order number and the report page address, the net amount and the number of pages picked) and to Google Analytics (the Google Analytics identifiers, the time, the order number, the amount and the number of pages picked). Google Ads and Meta get this only with marketing consent, Google Analytics only with analytics consent. I delete what each recipient needed from the order as soon as its report has been sent, and at the latest 90 days after payment (or 30 days after an order that was never paid). The advertisers’ page names and the data you enter in Stripe’s checkout are never sent to Google or Meta. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw under “Cookie settings”.

To make the report I send Meta (Ad Library) and Anthropic (Claude API) only the advertisers’ page names and the texts of their public ads. None of your data goes there.

Your rights

You can request access, correction or deletion of your data by email to the address in the Impressum.

Privacy policy