Data processing for agency workspaces.

01The short version

Your data stays yours. We process it only to run the service you pay for, only on your instructions, and we never sell it or use it to train anyone's models. This page is the agreement that puts that in writing, plus exactly how we protect it. It's a template written for your counsel to review before you rely on it.

02Who's who

For your workspace, you are the data controller and PaceHaus is your data processor — we act on your behalf. For the client data your team puts in (your clients' names, content, approvals), you remain the controller and we process it as your processor under this agreement.

03What we process, and why

Account basics, the workspace content and client data your team creates, and the operational logs it takes to keep the service healthy — all to run the workspace you paid for and nothing else. The full list, in plain language, is in the privacy policy.

04Only on your instructions

We process your data to provide the service and to follow your documented instructions — nothing more. We don't mine it for our own purposes, we don't build advertising profiles, and we don't use your content or your clients' content to train AI models.

05How we protect it

In transit, everything moves over encrypted connections (TLS). At rest, the database and media storage — including backups — are encrypted on disk. Every workspace is isolated at the database level by row-level security, so one agency can never read another's data even by mistake. Access is least-privilege and audited, and the keys that run the service stay server-side, never in the browser.

06A word on encryption

We're straight with you about what encryption can and can't do here. Your data is encrypted in transit and at rest, and walled off per workspace. What we can't offer — and no platform with search, AI, reporting, or automated invoicing can — is encryption that even we can't read: the server has to read your content to do those jobs for you. So the honest protection is strong security plus this written commitment, not a claim that your data is invisible to the system that runs it.

07Where it lives

The platform is hosted in Frankfurt (EU) — the database and media storage are in the same region, and your client review links and portal pages are served from the same infrastructure.

08Sub-processors

These providers process personal data for us, each for one job, under contract. Each is bound by its own data terms, and we stay responsible to you for the work they do:

• Vercel — runs the app and serves its pages, in Frankfurt.
• Supabase — hosts the database and sign-in, in Frankfurt.
• Cloudflare — stores your files (R2) and plays review videos (Stream).
• Resend — delivers the emails the product sends.
• Zoho Mail — holds the emails you send to our support address.
• Inngest — runs the product's background and scheduled jobs.
• Upstash — keeps the short-lived counters that rate-limit sign-in, sign-up and forms — they include IP addresses.
• Sentry — monitors errors: error reports and service logs, which can include an email address or a workspace name.
• Anthropic — the AI model provider, when your team runs an AI action.
• Stripe — takes card payments in US dollars, and is the merchant of record for them.
• Ayrshare — when your team connects social accounts: publishes your posts and media to the networks you pick, which then receive them too.
• Google — when your team connects Google Drive: copies your files into your own Drive.
• Your browser's push service — when you turn on push notifications: carries them to your device, encrypted so it can't read them.
• Paymob — once card checkout in Egyptian pounds opens: takes card payments in Egyptian pounds.
• Cloudflare Turnstile — once we turn it on: checks that the sign-up page is used by a person, not a bot (it sees your IP address and browser).

Card payments run on Stripe, in US dollars, and — once card checkout in Egyptian pounds opens — on Paymob, in Egyptian pounds. For payments in US dollars, Stripe is also the merchant of record under Stripe Managed Payments: it sells the subscription to you and handles the tax. Some agencies pay PaceHaus's invoices by bank transfer instead.

09Helping you answer your clients

When one of your clients (or your own team) asks to access, correct, export, or delete their data, the product's built-in export and erasure tools let you answer without waiting on us. Where you need our help, we give it.

10If something goes wrong

If we become aware of a breach affecting the personal data in your workspace, we notify you without undue delay — with what we know, what it affects, and what we're doing about it — so you can meet your own obligations.

11Getting your data back — or gone

You can export your workspace data at any time from inside the product. On request, or when you close your account, we delete or return your data and remove it from active systems, with backups aging out on their normal cycle.

12This document

This DPA applies for as long as you use the service and forms part of your terms of service. It's written in plain language on purpose; have your legal counsel review it against your obligations before you rely on it, and we'll gladly sign a countersigned copy on request.