Legal

Privacy Policy

Last updated: August 17, 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Baoks UG (haftungsbeschränkt)
Kruppstraße 41
72760 Reutlingen
Germany

Email: info@baoks.de

2. Data We Collect

We collect only the data required to provide the service:

  • Account data: name, email address, login metadata, and billing status.
  • Amazon credentials: OAuth connection tokens provided to connect your Amazon Ads account. Refresh tokens are encrypted at rest with AES-256-GCM.
  • Amazon Data (via the Amazon Ads API): We access and process the following data from your Amazon Advertising account through the Amazon Ads API:
    • Campaign data: campaign names, campaign types, states, budgets, and targeting settings for Sponsored Products, Sponsored Brands, and Sponsored Display campaigns
    • Keyword and targeting data: keywords, search terms, bids, match types, and negative keywords
    • Performance metrics: impressions, clicks, spend, sales, orders, ACOS, ROAS, and conversion data
    • Placement data: top-of-search, rest-of-search, and product page performance breakdowns
    • Aggregated insights (AMC and Amazon Attribution): aggregated, anonymized metrics from the Amazon Marketing Cloud clean room (e.g. customer lifetime value cohorts, new-to-brand rates, conversion paths) and Amazon Attribution reports. These are aggregate statistics only; we never receive or store shopper-level identifiers.
    • AMC audience configuration: audience name, rule definition, and aggregate size metadata for advertiser-directed Amazon Marketing Cloud audiences. We do not receive or store shopper-level identifiers.

    This data is classified as "Amazon Data" under the Amazon Ads Partner Network Policies. We process it solely to provide automated bid optimization, search term harvesting, reporting, and dashboard functionality as described in our service.

  • Technical data: IP address (for rate limiting only; not stored persistently), browser type, and device information transmitted automatically by your browser.

3. Legal Basis for Processing

We process personal data on the following legal bases (Art. 6(1) GDPR):

  • Art. 6(1)(b) — Contract performance: account creation, authentication, bid optimization, search term harvesting, reporting, and billing.
  • Art. 6(1)(f) — Legitimate interest: platform security, abuse prevention, error diagnostics, and service improvement. Our legitimate interest is ensuring reliable and secure operation of the platform.
  • Art. 6(1)(a) — Consent: where you explicitly opt in (e.g. connecting your Amazon Ads account). You may withdraw consent at any time by disconnecting your account.

4. How We Use Data

  • Operate automated bid optimization, search term harvesting, and scheduled automation runs.
  • Provide dashboards, reporting, and account functionality.
  • Provide Amazon Marketing Cloud and Amazon Attribution measurement where the connected account is eligible, including advertiser-directed Amazon Marketing Cloud audiences.
  • Maintain platform security, prevent abuse, and troubleshoot errors.
  • Process billing and send essential service communications.

4a. Amazon Data - Use and Restrictions

This service interfaces with the Amazon Ads API. Our use of Amazon Advertising data is governed by the Amazon Ads Partner Network Policies in addition to this Privacy Policy.

  • Amazon Data is used only to operate the service on behalf of the user who connected their Amazon Advertising account.
  • We do not sell, license, sublicense, rent, or make available Amazon Data to any unauthorized third party.
  • We do not use Amazon Data for our own advertising, profiling, or any purpose beyond operating the service for the account owner.
  • Amazon Marketing Cloud audiences: At the direction of the authorized account owner, Holy Quack may create and manage rule-based audiences within Amazon Marketing Cloud for the advertiser's own Amazon Ads campaigns. Audience processing remains within Amazon's clean-room environment, and Holy Quack does not receive or store shopper-level identifiers. The advertiser is responsible for ensuring that its instructions and intended audience use have the necessary legal basis and permissions. Holy Quack stores only the audience configuration and aggregate metadata required to provide the service.
  • We do not combine Amazon Data with third-party data sources without express prior written approval from Amazon.
  • Upon termination of the account or receipt of a deletion request, we immediately discontinue all processing and syncing of Amazon Data. Amazon Data in active production systems is deleted without undue delay. Residual encrypted backup copies are deleted automatically within a maximum of 30 days. You can request deletion by email to info@baoks.de.
  • We comply with the Amazon Ads Partner Network Policies: Amazon Ads Partner Network Policies.

5. Service Providers and Data Sharing

We do not sell, rent, or disclose Amazon Data to third parties for marketing or other unrelated purposes.

To operate Holy Quack, we use carefully selected service providers in the following categories:

  • cloud hosting and application infrastructure;
  • database and authentication services;
  • payment processing services; and
  • security and operational support services.

These providers process personal data only to the extent necessary to provide their respective services and are subject to appropriate contractual confidentiality and data-protection obligations.

Amazon Data is disclosed only to service providers permitted under the applicable Amazon Ads policies and solely for operating the Holy Quack service. Payment providers do not receive Amazon Data.

Where personal data is transferred outside the European Economic Area, we use an applicable adequacy decision, including the EU–US Data Privacy Framework where available, or appropriate safeguards such as the EU Standard Contractual Clauses.

Information about our current subprocessors is available to customers upon request at info@baoks.de.

6. Third-Country Transfers

Some of our service providers may process personal data in countries outside the European Economic Area, including the United States. Where this occurs, we rely on an applicable adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the relevant provider is certified) or on appropriate safeguards such as the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

7. Cookies

This website uses only essential cookies required for authentication and session management. We do not use analytics cookies, tracking pixels, or third-party advertising cookies. Because these cookies are strictly necessary for the service, no consent is required under Art. 5(3) of the ePrivacy Directive.

8. Data Retention

  • Account data: retained while your account is active. Deleted within 30 days of account deletion.
  • Amazon credentials (OAuth tokens): deleted immediately when you disconnect your Amazon Ads account or delete your account.
  • Amazon Data: retained while your account is active, because historical performance data is the functional basis of the service (year-over-year comparisons, seasonality-aware bidding, and lifetime-value analysis require it). Raw report files are discarded after import. Upon termination of the account or receipt of a deletion request, we immediately discontinue all processing and syncing of Amazon Data. Amazon Data in active production systems is deleted without undue delay. Residual encrypted backup copies are deleted automatically within a maximum of 30 days. You can request deletion by email to info@baoks.de. Disconnecting your Amazon account alone stops all syncing but keeps your historical data available in case you reconnect; you can request its deletion at any time.
  • Billing records: retained for 10 years after the end of the calendar year in which the transaction occurred, as required by German tax law (§ 147 AO).
  • Server logs (IP addresses): not stored persistently; used only for in-memory rate limiting.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

To exercise these rights, contact us at info@baoks.de.

You may also withdraw consent at any time where processing is based on consent (Art. 7(3) GDPR), without affecting the lawfulness of processing prior to withdrawal.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for our company is:

Baden-Württemberg State Commissioner for Data Protection and Freedom of Information (LfDI)
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

11. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date.