Your data, what we keep and why.

01The short version

We collect what the product needs to run, we host it in Frankfurt, we don't sell it, and you can export or delete it. The rest of this page is that sentence, expanded.

02What we collect

Account basics — your name, agency, email, and the WhatsApp number you give us when you book a demo. Workspace content — the videos, captions, comments, approvals and client data your team puts in. Billing country and subscription state. And the operational logs it takes to keep the service healthy and secure.

03Payments

Card payments run on Stripe (in US dollars) and, once card checkout in Egyptian pounds opens, on Paymob (in Egyptian pounds). You enter your card on their hosted payment page, which is PCI DSS-compliant and served over HTTPS; your full card number and security code never reach PaceHaus. For payments in US dollars, Stripe is also the merchant of record (see section 04 of the terms), so it handles your payment details under its own privacy policy as well. To take a payment, Stripe or Paymob receives your name, email and billing details.

On your billing page and receipts we show only the card brand, the last four digits and the expiry date. For renewals in Egyptian pounds we also keep, encrypted, the token Paymob issues for your saved card — a reference to the card, not the card number. We keep the payment records Stripe and Paymob send us, for accounting, refunds and disputes. Besides the card brand, last four digits and expiry, these records can hold other details the processor reports about the card and the payment — such as whether it's a credit or debit card, the country that issued it, a masked card number and the results of its security checks — but never the full card number or the security code. We also keep your billing country and subscription state. Some agencies pay invoices by bank transfer instead.

04Where your data lives

The platform is hosted in Frankfurt (EU) — the database and media storage live in the same region. Client review links and portal pages are served from the same infrastructure.

05How we use it

To run the workspace you paid for: serving your content to the people you invited, sending the notifications your team configured, and keeping the lights on. We don't run third-party advertising, we don't build ad profiles, and we never sell your data.

06AI features

When you run an AI action, the relevant content is sent to our AI model provider to produce the draft, which lands back in your approval pipeline — AI output that reaches your clients is reviewed and sent by your team inside the product, never published on its own.

07Cookies

Only the cookies the product needs: session and sign-in cookies, your language and billing-country choices, and — once you press Get started — a short-lived checkout cookie and an anonymous first-party id that counts the sign-up steps in our own database. No third-party advertising trackers, no pixels.

08Who we share with

These companies do one job each for us, under contract, and get only the data that job needs. We never sell your data, and they may not use it for themselves.

• Vercel — runs the app and serves its pages, in Frankfurt.
• Supabase — hosts the database and sign-in, in Frankfurt.
• Cloudflare — stores your files (R2) and plays review videos (Stream).
• Resend — delivers the emails the product sends.
• Zoho Mail — holds the emails you send to our support address.
• Inngest — runs the product's background and scheduled jobs.
• Upstash — keeps the short-lived counters that rate-limit sign-in, sign-up and forms — they include IP addresses.
• Sentry — monitors errors: error reports and service logs, which can include an email address or a workspace name.
• Anthropic — the AI model provider, when your team runs an AI action (section 06).
• Stripe — takes card payments in US dollars, and is the merchant of record for them (section 03).
• Ayrshare — when your team connects social accounts: publishes your posts and media to the networks you pick, which then receive them too.
• Google — when your team connects Google Drive: copies your files into your own Drive.
• Your browser's push service — when you turn on push notifications: carries them to your device, encrypted so it can't read them.
• Paymob — once card checkout in Egyptian pounds opens: takes card payments in Egyptian pounds (section 03).
• Cloudflare Turnstile — once we turn it on: checks that the sign-up page is used by a person, not a bot (it sees your IP address and browser).

Beyond this list, we share data only when the law requires it.

09Your rights

You can access, correct and export your data at any time — export is a product feature, not a support ticket. Cancellation drops the workspace to a free read-only fallback where everything stays readable and exportable; if you want the data deleted instead, ask and we delete it.

10Retention

Workspace content lives as long as the workspace does — including the read-only fallback after cancellation, until you ask for deletion. Billing records are kept as long as tax and accounting law requires.

11Changes and contact

Material changes move the “last updated” date above and are flagged inside the product. Privacy questions or requests: support@pacehaus.com — a person answers.