Privacy policy

Last updated 9 September 2026.

This policy is about Paid Acquisition AI, the service described on the homepage. It says what personal data the service handles, who else sees it, why, and what you can ask us to do about it.

Who is responsible

Schröder & Weische Software GmbH, Heimhuder Straße 30, 20148 Hamburg, Germany. Managing directors: Lars Schröder and Carl Weische. E-mail: carlwe@acceleratedagency.com. The full register entry is in the imprint. The company is the controller for the data described here in the sense of the General Data Protection Regulation.

Visiting this site

These public pages set no cookie, run no analytics and carry no tracking pixel. Nothing on them is loaded from another company: the two typefaces are served from this domain, and there is no third party script anywhere on the site. Our hosting provider records the usual server log of a request, described under Vercel below.

Signing in

Signing in is with a Google account and nothing else. When you sign in for the first time, the service stores your name, your e-mail address and the address of your Google profile picture, so that the people you work with can see who did what. Google also issues the session, and the session is held in a cookie in your browser until you sign out.

The service asks Google for the sign-in scopes only, which are your e-mail address and your basic profile. It reads no Gmail, no Drive, no calendar and no other Google data, and it uses what it does read for one thing, to know who you are inside your workspace. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. The service sends no e-mail of its own.

What a workspace puts in

A workspace collects the brand's own material and the language its customers use in public: product reviews, products and orders from the brand's shop, the brand's own web pages, public threads on Reddit, advertising figures from the brand's own ad account, and files somebody in the workspace uploads. Some of that material contains personal data, mostly the names and words of people who wrote a public review or a public post. The service keeps it so it can quote it and show where a claim came from.

The service also records what each run cost and who started it, which is how a workspace sees its own usage.

Who else processes it

Each of the following handles data on our behalf, under a contract, for the purpose named and nothing else.

• Google. Sign-in. Google authenticates you and tells the service your name, e-mail address and profile picture. We send Google no workspace material.
• Supabase. The database, the authentication and the file storage. Everything a workspace holds is stored here. The project runs in the European Union, in Supabase's eu-west-1 region in Ireland.
• Anthropic. The models that write. The material a workspace collects and uploads, and the instructions somebody gives in the chat, are sent to Anthropic through its API so a document can be written from them. Under its API terms this material is not used to train its models.
• OpenAI. The embeddings that make collected material searchable by meaning. Passages of that material are sent to OpenAI through its API and come back as vectors. Under its API terms this material is not used to train its models.
• Stripe. Payment for credits. Card details are entered on Stripe's own form and never reach our servers. Stripe tells us that a payment succeeded and what it was for.
• Vercel. Hosting. Every request to the service passes through Vercel, which keeps a server log of it, including the IP address the request came from, for as long as its own retention period says. The application runs in Vercel's Dublin region.
• The review platforms. Judge.me, Loox, Okendo and Yotpo. The workspace supplies its own API key for the platform its shop uses, and the service reads that shop's reviews with it. We add no account of our own.
• Shopify. The workspace supplies its own credentials and the service reads that shop's own products and orders with them.
• Meta. The workspace supplies its own credentials and the service reads that ad account's own ads and figures with them.
• Reddit. The service reads public posts and comments through Reddit's API to find how customers describe a problem in their own words.

Data leaving the European Union

Supabase holds the workspace data in Ireland and the application runs in Dublin. Anthropic, OpenAI, Stripe, Vercel and Google are companies in the United States, so material sent to them leaves the European Union. Those transfers rest on the standard contractual clauses adopted by the European Commission, or on the recipient's certification under the EU-US Data Privacy Framework where it holds one.

Cookies

The only cookies the service sets are the ones that hold your session after you sign in. They are necessary for the service to work at all and there is nothing to consent to or refuse. There is no advertising cookie, no analytics cookie and no cookie on the public pages of this site.

Why we are allowed to

Running the workspace for a customer, including everything described under what a workspace puts in, is the performance of a contract under Article 6(1)(b) of the General Data Protection Regulation. Keeping the service secure, keeping a record of what a workspace was billed for, and reading public material to write from it are our legitimate interests under Article 6(1)(f). Signing you in with Google happens because you chose to, under Article 6(1)(a), and you can stop by not signing in.

How long it is kept

Workspace data is kept for as long as the workspace exists and for 30 days after it is closed, after which it is deleted. Server logs are kept for as long as our hosting provider keeps them. Records we have to keep for tax or commercial law, such as what was invoiced, are kept for the period that law requires.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict what we do with it, to hand it over in a portable form, and to object to processing we base on a legitimate interest. Write to carlwe@acceleratedagency.com and we will answer.

You can also complain to a supervisory authority. Ours, because the company is in Hamburg, is the Hamburg Commissioner for Data Protection and Freedom of Information, Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit in Hamburg, Germany.

Questions

Write to carlwe@acceleratedagency.com. If you are a customer, your Accelerated Agency contact can answer most of them faster.