Privacy Policy

1. Data Controller

The controller responsible for data processing on this website and the AIMpact platform is:

AIMpact by always-improve.com
Tim Fricker
Röttler Weg 8
79400 Kandern
Germany
Email: info@aimpact.app

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

2. General Information and Mandatory Disclosures

The following notice provides an overview of what happens to your personal data when you visit our website or use our SaaS platform. Personal data is any data that can be used to identify you personally.

We treat your personal data confidentially and in accordance with statutory data protection regulations (in particular the EU General Data Protection Regulation – GDPR and the German Telecommunications-Telemedia Data Protection Act – TDDDG) and this Privacy Policy.

2.1 Key Definitions

Personal Data: Any information relating to an identified or identifiable natural person (e.g., name, email address, telephone number, IP address, online identifiers).

Processing: Any operation performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, retrieval, use, disclosure, or erasure.

2.2 Storage Duration & Retention

Unless a more specific storage period has been stated within this Privacy Policy, your personal data remains with us until the purpose for data processing ceases to apply. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial retention periods).

2.3 SSL / TLS Encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the change in the browser’s address line from "http://" to "https://" and by the lock symbol in your browser address bar.

3. Data Collection on This Website

3.1 Server Log Files

When accessing our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in server log files:

• Browser type and browser version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer
• Time of the server request
• IP address of the accessing device

Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in the technically error-free presentation, stability, and security of our website).

Retention: Log files are deleted automatically after a maximum of 7 days.

3.2 Cookies and Local Storage

Our website uses cookies and similar storage technologies (such as Local Storage). Cookies do not cause damage to your computer and do not contain viruses. They serve to make our offer more user-friendly, effective, and secure.

• Technically Necessary Cookies: These cookies are mandatory for operating the website and its core features (e.g., session management, CSRF security tokens, authentication). Legal basis: Section 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR.
• Optional Analytics & Marketing Cookies: Used only if you have granted explicit consent via our cookie banner. Legal basis: Section 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR.

You can adjust or revoke your cookie settings at any time via the "Cookie Settings" link in our website footer.

3.3 Vercel Web Analytics

We use Vercel Web Analytics provided by Vercel Inc., USA. This analytics tool operates privacy-friendly without cookies and without storing personal IP addresses in plain text. Only aggregated metrics (page views, operating systems, geographic regions) are processed to optimize site performance.

Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in optimizing our web offering).

3.4 Google Analytics 4 (GA4)

Where you have given your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). GA4 uses cookies to analyze how you use our website.

IP anonymization is activated by default on this website. Your IP address is shortened by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area prior to storage. Google is certified under the EU-US Data Privacy Framework.

Legal Basis: Art. 6 (1) lit. a GDPR in conjunction with Section 25 (1) TDDDG (consent via cookie banner). You can revoke your consent at any time with effect for the future.

3.5 Meta Pixel & Conversions API

With your consent, we use the Meta Pixel and Meta Conversions API provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This allows us to track visitor behavior after clicking on a Facebook or Instagram advertisement.

Meta processes this data under its own data protection responsibility and may associate it with your Facebook/Instagram account. Meta Platforms Inc. is certified under the EU-US Data Privacy Framework.

Legal Basis: Art. 6 (1) lit. a GDPR in conjunction with Section 25 (1) TDDDG (consent).

3.6 Email Communications and Newsletter (Klaviyo)

If you subscribe to our newsletter or register for product updates, we use the service Klaviyo (Klaviyo Inc., 125 Summer St, Boston, MA 02110, USA). We process your email address and, where provided, your name.

Subscription takes place via a double opt-in procedure. Klaviyo is certified under the EU-US Data Privacy Framework. You can unsubscribe from our newsletter at any time via the unsubscribe link in every email.

Legal Basis: Art. 6 (1) lit. a GDPR (consent).

3.7 Contact Form & Email Inquiries

When you send us inquiries via email or contact forms, your details including the contact information provided are stored by us for the purpose of processing the inquiry and in the event of follow-up questions.

Legal Basis: Art. 6 (1) lit. b GDPR (performance of a contract or pre-contractual measures) and Art. 6 (1) lit. f GDPR (legitimate interest in prompt customer communication).

4. Hosting and Content Delivery Networks (CDN)

4.1 Vercel

Our website and platform are hosted by Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA). Vercel provides the global serverless edge network and static file hosting.

Vercel processes data on our behalf on the basis of a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR and is certified under the EU-US Data Privacy Framework.

Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in the secure, fast, and reliable delivery of our online offering).

4.2 Supabase (Database, Authentication & Storage)

For storing user accounts, workspace configurations, application data, and uploaded assets, as well as for user authentication, we use Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore / USA).

Passwords are never stored in plain text, but are irreversibly hashed using industry-standard cryptographic algorithms (Argon2 / Bcrypt). All database connections are strictly encrypted via TLS. A Data Processing Agreement (DPA) including EU Standard Contractual Clauses (SCCs) has been concluded with Supabase.

Legal Basis: Art. 6 (1) lit. b GDPR (performance of contract) and Art. 6 (1) lit. f GDPR (legitimate interest in high database security and integrity).

4.3 Upstash QStash (Background Task Processing)

For asynchronous execution of time-intensive background tasks (e.g., scheduled data syncs, automated reporting jobs), we use the serverless queue service QStash provided by Upstash Inc., USA. Only technical job parameters and triggers are transmitted via QStash; no end-customer personal data is processed.

Legal Basis: Art. 6 (1) lit. f GDPR (legitimate interest in resilient background architecture).

5. Platform Features and Third-Party Integrations

When you use the AIMpact SaaS platform and connect third-party business accounts, we process data through the respective APIs:

5.1 Meta / Facebook Marketing API

When connecting your Meta ad accounts, we process:

• Ad account metadata and account status
• Campaign data, adsets, and creative configurations
• Performance metrics (spend, impressions, clicks, ROAS, conversions)
• Creative assets (images, videos, copy)
• Public comments on your ads for sentiment analysis and auto-moderation

Authorization takes place via Meta’s official OAuth protocol. You can revoke access at any time in your Meta Business Manager settings.

Legal Basis: Art. 6 (1) lit. b GDPR (performance of contract) and Art. 6 (1) lit. a GDPR (consent upon connecting).

5.2 Shopify E-Commerce Integration

When connecting a Shopify store to AIMpact, we retrieve data via the official Shopify Admin and Storefront APIs:

• Store metadata (store name, primary domain, currency, timezone)
• Product catalog (products, variants, prices, inventory status)
• Order data for marketing attribution: order ID, revenue, timestamps, line items, marketing UTM parameters.

Pseudonymization of Customer Data: Where end-customer data is processed for attribution, customer email addresses and sensitive identifiers are stored strictly in pseudonymized format (one-way SHA-256 hash). IP addresses are truncated and anonymized prior to storage.

Legal Basis: Art. 6 (1) lit. b GDPR in conjunction with Art. 28 GDPR (data processing agreement).

5.3 Google Ads Integration

When connecting your Google Ads account, we process campaign structures, performance metrics, and search queries. If you activate offline conversion synchronization, conversion data including Google Click Identifiers (GCLID) can be uploaded via the Google Ads API.

Legal Basis: Art. 6 (1) lit. a and b GDPR.

5.4 Google Drive Integration (Optional)

If you choose to connect Google Drive, AIMpact receives strictly read-only access (Scope: drive.readonly) to user-selected folders and files to import creative assets into AIMpact. Access tokens are encrypted, and you can revoke access at any time in your Google Account security settings.

Legal Basis: Art. 6 (1) lit. a and b GDPR.

5.5 Google Calendar & Meet Integration (Optional)

If activated, we process calendar events for sales pipeline reconciliation and, upon explicit authorization, meeting transcripts to generate automated AI summaries.

Legal Basis: Art. 6 (1) lit. a and b GDPR.

5.6 Slack Integration (Optional)

If you enable Slack alerts, we process incoming webhook URLs and channel IDs to deliver automated notifications, performance reports, and threshold alerts to your designated channels.

Legal Basis: Art. 6 (1) lit. b GDPR.

5.7 ClickUp Integration (Optional)

When connecting ClickUp, we synchronize task metadata and selected knowledge base documents upon your authorization. You can adjust or disconnect synchronization at any time.

Legal Basis: Art. 6 (1) lit. b GDPR.

6. Artificial Intelligence (AI) Features

AIMpact utilizes state-of-the-art machine learning models, primarily Google Gemini (Google Ireland Limited / Google LLC) and specialized visual models (e.g., Google Veo / Imagen for creatives, and optionally OpenAI or Anthropic).

AI application areas include:

• AIMq Chat Assistant for analyzing campaign performance and e-commerce metrics
• Automated comment analysis (sentiment classification, purchase intent, tagging)
• AI-generated reply drafts for social media community moderation
• Automated adset briefings, angle ideation, and creative scripting
• Visual creative analysis (Gemini Vision)
• Semantic text vectorization (embeddings) for knowledge base search
• Automated meeting summary generation

Legal Basis: Art. 6 (1) lit. b GDPR (performance of contract).

7. Payment Processing (Stripe)

For processing subscription payments and invoicing, we utilize the payment service provider Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland / Stripe Inc., USA).

Payment credentials (such as credit card numbers or bank account details) are handled directly through encrypted Stripe Elements interfaces and are never stored on our own application servers. Stripe is certified PCI-DSS Level 1 and complies with the EU-US Data Privacy Framework.

Legal Basis: Art. 6 (1) lit. b GDPR (performance of contract).

8. Transactional Emails and Notifications

For sending transactional system emails (e.g., password reset instructions, team invitations, critical security alerts), we use Resend (Resend Inc., 2261 Market St #5039, San Francisco, CA 94114, USA) and Supabase Auth.

Legal Basis: Art. 6 (1) lit. b GDPR (performance of contract) and Art. 6 (1) lit. f GDPR (legitimate interest in prompt email delivery).

9. Data Transfers to Third Countries

Certain service providers (e.g., Vercel, Supabase, Google, Stripe, Resend, Meta, Shopify, Upstash, ClickUp) are headquartered in the United States or process data on servers located outside the European Economic Area (EEA).

Data transfers to third countries take place on the basis of:

• The EU-US Data Privacy Framework (for certified organizations, an adequacy decision of the European Commission exists pursuant to Art. 45 GDPR).
• The Standard Contractual Clauses (SCCs) of the European Commission (Art. 46 (2) lit. c GDPR) including additional technical and organizational measures (TOMs).
• Where applicable, your explicit consent in individual cases (Art. 49 (1) lit. a GDPR).

10. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation and details of personal data processed by us.
• Right to Rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate personal data or completion of incomplete data.
• Right to Erasure (Art. 17 GDPR): You have the right to obtain the erasure of your personal data, provided statutory retention duties do not require continued storage.
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to restrict processing under certain circumstances.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive personal data you provided to us in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of personal data based on Art. 6 (1) lit. f GDPR.
• Right to Withdraw Consent (Art. 7 (3) GDPR): You have the right to withdraw previously granted consent at any time with future effect.

Right to Lodge a Complaint with a Supervisory Authority

In the event of GDPR infringements, data subjects have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for our headquarters is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
PO Box 10 29 32, 70025 Stuttgart, Germany
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de

To exercise any of your rights, please reach out to us at: info@aimpact.app

11. Data Processing on Behalf of Controllers (Art. 28 GDPR)

Where you utilize AIMpact as an e-commerce merchant or appointed marketing agency for attribution tracking, creative strategy, or comment moderation, AIMpact acts as a Data Processor within the meaning of Article 28 GDPR. You remain the Controller under data protection law.

We process end-customer data strictly in accordance with your documented instructions and agreed contractual purposes.

Authorized Sub-processors

A comprehensive Data Processing Agreement (DPA) pursuant to Art. 28 GDPR including technical and organizational measures (TOMs) is available upon request. Please contact us at: info@aimpact.app

12. Meta / Facebook Data Deletion Instructions

In accordance with Meta Platform policies, we provide a clear procedure for data deletion (User Data Deletion Callback). If you wish to unlink your Facebook or Instagram account from AIMpact, you can do so directly in your Meta account settings or by emailing an informal request to info@aimpact.app. All associated OAuth tokens and cached metrics will be erased from our systems without delay.

13. Currency and Amendments to this Privacy Policy

This Privacy Policy is currently effective and will be adapted as our platform evolves or as legal requirements change.