holyquack…com
Get started
Legal

Privacy Policy

Version 2026-10-19.2 · Agreements and acceptance record

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Baoks UG (haftungsbeschränkt), Kruppstraße 41, 72760 Reutlingen, Germany. Email: info@baoks.de. Further company details are in our Imprint.

2. Our role

This policy covers processing for which we are responsible ourselves: our website, contact requests, user accounts, contracts and billing, support, security, product analytics and contract records.

When we process personal data contained in a customer's Amazon Ads accounts, or content a customer submits to the service (for example chat messages to the AI assistant), we act as the customer's processor under our Data Processing Agreement. In that case the customer decides the purposes and is your contact for privacy requests. Sections 8 and 9 describe that processing for transparency.

3. Visiting our website

When you open our website or app, our hosting provider Vercel processes technical data your browser sends: IP address, date and time, requested page, referrer, browser, operating system and device information. We need this data to deliver the website, keep it secure and detect errors. Vercel stores it in short-term server logs. To protect sign-in and account recovery against abuse, our application stores a pseudonymized hash of the IP address for up to 24 hours. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of our website.

Cookies and local storage. We use cookies and browser storage only where this is strictly necessary to provide the service you request (§ 25(2) no. 2 TDDDG): sign-in and session cookies, a cookie for your dashboard preferences (such as filters and selected marketplace, stored for up to 180 days) a local-storage entry for your display theme and local-storage entries that remember your analytics and ad-measurement choices. We set advertising cookies only with your consent (see "Ad measurement with Meta" below); after that consent, a first-party cookie (hq-mkt-consent, up to 12 months) tells our server that it may send ad-measurement events.

Performance measurement in the app (only with your consent). Inside the signed-in app, and only after you agree to product analytics (see below), we use Vercel Speed Insights to measure loading performance (Core Web Vitals). It records the page visited, performance values, browser, device type, operating system and country. It sets no cookies and does not track you across websites. Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the access to your device. If you decline, the script is not loaded.

Page analytics in the app (only with your consent). Inside the signed-in app, and only after you choose "Ok" in our consent notice or switch on product analytics in your account settings, your browser sends usage events to PostHog through our own server: which app pages you open and leave, and when you view an AI proposal. Each event contains your pseudonymous user ID, the workspace ID and name, whether the workspace is one of our own internal workspaces, the page address and previous page address without query parameters and with IDs replaced by placeholders, and a timestamp. We set no cookies and store no analytics identifiers on your device. Browser, device, operating system, screen, language and time-zone details are removed before sending, and our server does not pass your IP address on to PostHog. Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the access to your device. If you decline, the analytics script is not loaded. You can withdraw your consent at any time with effect for the future in your account settings; this does not affect processing before the withdrawal.

Page analytics on our public pages (only with your consent). On our public pages, such as the home page, pricing and comparison pages, and only after you choose "Ok" in our consent notice, your browser sends page views to PostHog through our own server: which public pages you open and leave, and that you booked a demo (without your email address or the booking time). Each event contains a random ID that is kept only in memory and is not linked to a person or an account, the page address and the address of the previous page (which may be another website) without query parameters, the campaign tags of the link that brought you to us (utm_source, utm_medium, utm_campaign, utm_content and utm_term; they name the ad or newsletter, not you), and a timestamp. We set no cookies and store no analytics identifiers on your device. Browser, device, operating system, screen, language and time-zone details are removed before sending, and our server does not pass your IP address on to PostHog. Your choice is remembered in your browser and also applies to the app, so we do not ask twice. Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the access to your device. If you decline, the analytics script is not loaded. You can withdraw your consent at any time with effect for the future under "Privacy settings" at the bottom of each public page or in your account settings; this does not affect processing before the withdrawal.

Ad measurement with Meta (only with your consent). On our public pages, and only after you choose "Ok" in our consent notice or switch on "Ad measurement (Meta)" in the privacy settings, we load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel sets cookies (_fbp, _fbc, up to 90 days) and sends Meta the pages you open, your IP address, browser details and, if you came from a Meta ad, its click ID. When you book a demo, create an account or start a subscription, our server also sends this event to Meta through the Meta Conversions API, together with your email address and user ID in hashed (SHA-256) form, your IP address, browser details, the Meta cookie values and, for subscriptions, the net amount. For subscriptions we use the choice you had made when you started checkout; to send the purchase event later, we store the Meta cookie values, IP address and browser details with the checkout session at our payment provider Stripe. We use this to measure whether our ads lead to demos, signups and purchases, and to show our ads to people who are likely to be interested. We and Meta are joint controllers for collecting and transmitting this data (Art. 26 GDPR, Meta Controller Addendum); Meta alone is responsible for its further processing. Meta may transfer data to the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the access to your device. If you decline, the pixel is not loaded and our server sends nothing to Meta. You can withdraw your consent at any time with effect for the future under "Privacy settings" at the bottom of each public page; this also deletes the Meta cookies on our domain and does not affect processing before the withdrawal. Meta's privacy policy: facebook.com/privacy/policy.

4. Contact form and email

If you contact us by form or email, we process your name, email address, company and message to answer you. Form messages are delivered to our mailbox through our email provider IONOS SE (Germany). Legal basis: Art. 6(1)(b) GDPR where your request concerns a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete requests once they are resolved, unless statutory retention obligations apply.

Booking a demo. Our website footer shows free times for a demo call. To show them, our server requests the free times from Cal.com, Inc. (USA) and passes on only your browser's time zone; your browser does not connect to Cal.com. When you book, our server sends the email address you enter, a name derived from it, your time zone and the time you chose to Cal.com, which creates the appointment and emails you the invitation, so we can hold and prepare the call. If you instead open our booking page on cal.com, Cal.com also receives your IP address and browser details and may store cookies or similar data that the booking needs. Legal basis: Art. 6(1)(b) GDPR (steps you request before a contract) or Art. 6(1)(f) GDPR (our interest in answering demo requests), and § 25(2) no. 2 TDDDG for storage strictly needed for the booking you requested.

5. User accounts

For your account we process your name, email address, password (stored only as a hash), workspace memberships and roles, and sign-in metadata such as the time. For security, our authentication provider Supabase also logs the IP address of each sign-in in its authentication logs. Our database and authentication provider Supabase stores this data in the EU (Ireland). Account emails such as confirmations and password resets are sent through IONOS SE (Germany).

If you sign in with Google, Google Ireland Limited confirms your identity and shares your name, email address and profile picture with us. Google processes your sign-in as an independent controller under its own privacy policy.

Legal basis: Art. 6(1)(b) GDPR where you are personally our contracting party. Where you use the service for your employer or a customer of ours, Art. 6(1)(f) GDPR applies. Our legitimate interest is providing and administering the business relationship. You need an account to use the service.

Product analytics. To improve the service and to understand how customers start using it, our servers send usage events to PostHog. These are:

  • sign-ups and sign-ins, with the method (password, email confirmation or Google);
  • steps of connecting an Amazon account: started, connected (with the number of profiles) or failed (with a reason category);
  • subscription events: trial started, subscription started, plan changed or canceled, with the plan, billing interval, number of brands, the net amount in euros after discounts and without VAT, the months active and whether it started as a trial;
  • actions in the app, for example that a bid change was submitted, a bidding goal was set, an AI proposal was approved or rejected, or onboarding was completed.

Each event contains a pseudonymous user ID where a user triggered the event, the workspace ID and name, whether the workspace is one of our own internal workspaces, the event type, the counts or amounts listed above and a timestamp. It contains no names, email addresses, IP addresses or payment card details, and no Amazon Data such as keywords, search terms, ASINs or campaign names. We do not set cookies or store identifiers on your device for this purpose. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is understanding which features are used and where new customers stop, so we can improve the service. You can object at any time at info@baoks.de.

Sign-up source. If you open our sign-up page through a link with campaign tags (utm_source, utm_medium and utm_campaign, for example from a newsletter or an ad), we store these three tags with your account and send them with the sign-up event. This shows us which campaigns bring new customers. The tags describe the link, not you. We do not store other link parameters, such as click IDs (for example fbclid or gclid). Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is measuring which marketing channels work. We delete the tags together with your account.

Sign-in and activity records. To run and secure the service and to see how actively it is used, we record each sign-in (your user ID, the sign-in method such as password or Google, and the time) and, at most once per hour, the day on which you used the app in a workspace (your user ID, the workspace ID, the first and last time of use that day and a request count). These records contain no IP address, no device or browser details and no page content. They are stored in our database at Supabase in the EU and are visible only to our own staff in our internal admin console. Access by our staff in a support session is not recorded as your activity. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interests are securing accounts, providing support and understanding product adoption. You can object at any time at info@baoks.de.

6. Contracts, billing and payment

For contracts and invoices we process company name, billing address, VAT ID, contact person, subscription status and payment history. Stripe Payments Europe, Ltd. (Ireland) processes payment data such as card details as an independent controller. We do not receive full card numbers. Stripe also sends payment and trial-ending emails. We keep a record of the reminder emails we trigger (recipient and content) for 12 months. See Stripe's privacy policy. Legal basis: Art. 6(1)(b) and (c) GDPR.

7. Support and support access

We process support requests, including any account details they contain, to help you. At a customer's request, or where necessary to investigate a security incident or malfunction, authorized staff may open that customer's workspace in a time-limited support session. Each session is recorded with the staff account, time, affected pages, IP address and browser details; these records are deleted after 12 months. Legal basis: Art. 6(1)(b) and (f) GDPR. Our legitimate interest is secure and accountable support.

8. Amazon Advertising data

With the customer's authorization, we access the following data through the Amazon Ads API:

  • Campaign data: names, types, states, budgets and targeting settings for Sponsored Products, Sponsored Brands and Sponsored Display.
  • Keyword and targeting data: keywords, search terms, bids, match types and negative keywords.
  • Performance and placement data: impressions, clicks, spend, sales, orders, ACOS, ROAS and placement breakdowns.
  • Aggregated insights: aggregate metrics from Amazon Marketing Cloud and Amazon Attribution, such as lifetime-value cohorts and new-to-brand rates, and the configuration of advertiser-directed Amazon Marketing Cloud audiences. These are aggregate statistics. We never receive or store shopper-level identifiers.

This data is mostly business data. Where it relates to identifiable persons, we process it as the customer's processor (section 2). It is "Amazon Data" under the Amazon Ads Partner Network Policies. For Amazon Data we commit that:

  • we use Amazon Data only to operate the service for the customer who connected the account and, if that customer switches it on, for cross-customer learning as described below. Operating the service includes training machine-learning models on that customer's advertising performance data, only to set bids for that customer's own campaigns, and continuously comparing our bidding methods (rule-based methods and these models) on parts of the customer's campaigns to find the method that works best for that customer, within its budgets and bid limits and our safety limits. The customer can opt out of the comparison and of model training by email to info@baoks.de; its campaigns are then managed by rule-based methods only;
  • we do not sell, license, rent or otherwise make Amazon Data available to unauthorized third parties;
  • we do not use Amazon Data for our own advertising or profiling, or for any purpose other than those described in this section, and we do not use it to train third-party AI or language models;
  • we do not combine Amazon Data with third-party data without Amazon's prior written approval;
  • cross-customer learning is an optional feature and is currently inactive; it remains switched off and will not be offered or enabled unless and until Amazon has expressly confirmed in writing that this specific use is permitted for our approved integration; customer opt-in alone does not activate it. After such confirmation, and only if the customer switches it on, we may use aggregated, anonymized, numeric performance statistics derived from its Amazon Data, together with those of other customers, to improve our bidding models. Where the source data are personal data, we first anonymize them on the customer's documented instruction so that no natural person is identifiable by means reasonably likely to be used. We document re-identification and model-extraction testing; data that do not meet this standard are excluded from cross-customer learning. The statistics contain no search terms, keywords, campaign names, ASINs or other content that identifies the customer, its products or its campaigns, are never shown to other customers and never include Amazon Marketing Cloud or Amazon Attribution data. The customer can switch cross-customer learning off at any time;
  • at the customer's direction, we may create rule-based audiences inside Amazon Marketing Cloud for the customer's own campaigns. Audience processing stays inside Amazon's clean room. The customer is responsible for the legal basis of its audience instructions.

Amazon sign-in tokens are encrypted with AES-256-GCM. Raw report files are discarded after import.

9. AI assistant

When users chat with our AI assistant "Günther", the service processes their messages, the account data the assistant retrieves to answer them, its replies and proposals, and notes it keeps to remember the account's context. You are interacting with an AI system, not a person; the chat shows this next to the input field. The assistant can propose changes, but only an authorized user, or our staff in a support session at the customer's request, can approve them.

The assistant runs either in our application functions at Vercel in the EU (Dublin) or on company-managed, encrypted hardware in Germany. In both cases it reaches customer data only through tenant-checked tool functions of our application. To generate answers, requests are sent exclusively through the Vercel AI Gateway (Vercel Inc., USA) to one of the inference providers xAI (SpaceXAI LLC, USA), Fireworks AI (USA) or Baseten (Baseten Labs Inc., USA), which Vercel engages as its subprocessors. Which provider serves a request depends on the language model selected for the workspace; short messages may be answered by a smaller model and analyses by a larger one. To classify campaign names, keywords, search terms and product titles, and optionally to make that choice, we use the decision model Jev from TypeSafe AI, Inc. (USA), also through the Vercel AI Gateway. Jev receives only the message or advertising text, with email addresses and phone numbers removed. Open-weight models such as DeepSeek run on Fireworks or Baseten infrastructure; their developers receive no data. Requests are processed under zero-data-retention terms: prompts and answers are not stored after processing and are not used to train models. We process this data as the customer's processor (section 2).

Chat histories and assistant notes are stored in the customer's workspace until the workspace is deleted or the customer requests their deletion at info@baoks.de. Temporary working copies on the assistant's hardware are deleted after 30 days at the latest.

If a customer connects its own external AI tools through our agent API, data is sent to those tools on the customer's instruction and under the customer's responsibility.

10. Contract acceptance records

When a customer accepts our agreements, we store the accepting account's identity and email address, the workspace and its name at that time, the declarations made, a server timestamp, the browser details (user agent), the document versions and an exact copy of the accepted documents. Company and address details from billing are linked through the workspace. They are not collected again and do not overwrite the original record. Legal basis: Art. 6(1)(b), (c) and (f) GDPR. Our legitimate interest is proving and defending contracts. We keep these records for the term of the contract and until the end of the regular limitation period (three years after the end of the year in which the contract ended), and longer only where a statutory obligation or ongoing legal dispute requires it.

11. Recipients

We use the following service providers. Vercel, Supabase, IONOS and PostHog are bound to us by data processing agreements. xAI, Fireworks AI and Baseten are bound as Vercel's subprocessors under Vercel's agreements. TypeSafe AI is bound to us by its data processing agreement.

  • Vercel Inc. (USA): hosting of website and application, with application functions running in the EU (Dublin); server logs; performance measurement in the app; AI Gateway for the assistant.
  • Supabase, Inc. (USA): database and authentication, with data stored in the EU (AWS region Ireland).
  • IONOS SE (Germany): sending account emails and delivering contact-form messages.
  • PostHog Inc. (USA): product analytics, with data stored in its EU cloud (Frankfurt, Germany).
  • Cal.com, Inc. (San Francisco, USA): scheduling demo calls booked through our website.
  • xAI (SpaceXAI LLC, USA), Fireworks AI (USA) and Baseten (Baseten Labs Inc., USA), engaged by Vercel for the AI Gateway: language-model processing for the AI assistant, under zero-data-retention terms.
  • TypeSafe AI, Inc. (USA), reached through the Vercel AI Gateway: routing messages to the assistant to a model tier, and classifying campaign names, keywords and search terms, under zero-data-retention terms.

Stripe (payments) acts as an independent controller for payment processing and as our processor for the ad-measurement values we store with a checkout session (Stripe Data Processing Agreement). Google (optional sign-in) acts as an independent controller. Product images in the app are loaded directly from Amazon's servers, so Amazon receives your IP address and browser details when an image is shown. Meta Platforms Ireland Limited (ad measurement, only with your consent) is a joint controller with us for collecting and transmitting that data, see section 3. Amazon is the source of Amazon Data and receives the changes the customer instructs. We disclose data to authorities only where the law requires it. We do not sell personal data.

12. Transfers outside the EEA

Vercel, Supabase, PostHog, Cal.com, xAI, Fireworks AI, Baseten and TypeSafe AI are based in the USA and may access data from there, even where it is stored in the EU. Vercel is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). We additionally rely on the EU Standard Contractual Clauses in Vercel's data processing agreement. xAI, Fireworks AI and Baseten process data as Vercel's subprocessors under Vercel's written agreements with them and Vercel's onward-transfer obligations. For Supabase, PostHog and TypeSafe AI we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) included in their data processing agreements. Cal.com states that it relies on the EU Standard Contractual Clauses for transfers out of the EEA. Meta may transfer ad-measurement data to Meta Platforms, Inc. (USA), which is certified under the EU-U.S. Data Privacy Framework. You can request a copy of the safeguards at info@baoks.de.

13. Retention

  • Account data: for as long as the account exists. Deleted within 30 days after account deletion.
  • Amazon sign-in tokens: deleted immediately when you disconnect the Amazon account or delete your account.
  • Amazon Data: kept while the account is active, because historical data is the basis of the service (year-over-year comparisons, seasonality-aware bidding and lifetime-value analysis). When the account ends or we receive a deletion request, we immediately stop all syncing and processing. Amazon Data in active production systems is deleted without undue delay. Residual encrypted backup copies are deleted automatically within 30 days at the latest. Disconnecting Amazon alone stops syncing but keeps your history in case you reconnect. You can request deletion at any time at info@baoks.de.
  • Machine-learning models: models and other artifacts derived from a customer's Amazon Data are deleted, or retrained without that data, within 30 days after the account ends or we receive a deletion request. If the customer switches off cross-customer learning, we stop using the customer's contributed statistics and, within 30 days, retrain or retire the cross-customer models trained on them; customer-specific models remain in use while the service continues, unless the customer opts out of model training; we then stop using them at once and delete them, or retrain them without the customer's data, within 30 days.
  • Invoices and accounting records: 8 years; commercial and business letters: 6 years; annual financial statements: 10 years (§ 147 AO, § 257 HGB, § 14b UStG).
  • Server logs: short-term, according to the hosting provider's log retention. Pseudonymized IP hashes for abuse protection: up to 24 hours.
  • Sign-in and activity records: 13 months, then deleted automatically.
  • Ad measurement: the Meta cookies expire after up to 90 days and are deleted when you withdraw consent; the Meta values stored with a Stripe checkout session stay with that payment record. Meta keeps the data it receives under its own policy.
  • Product analytics events: 24 months at the latest, so we can compare usage year over year, or earlier on request.
  • Contact requests and demo bookings: until resolved, unless statutory retention obligations apply.
  • Support tickets and support-session records: 12 months after the ticket is closed or the session ends.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). To exercise your rights, contact info@baoks.de. For data we process on a customer's behalf, we forward your request to that customer.

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

We do not use automated decision-making within the meaning of Art. 22 GDPR. Automated bidding concerns advertising settings, not decisions about individuals.

15. Right to lodge a complaint

You may lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

16. US privacy requests

Where we handle personal information for a business customer, that customer decides the purposes and responds to requests under applicable US state privacy laws. We forward and assist with such requests. For processing in our own responsibility, contact info@baoks.de. Exercising your rights will not lead to unlawful discrimination.

17. Changes to this policy

We update this policy when our processing changes. The current version and its date are always shown on this page.