01 — The short version
Your data stays yours. We process it only to run the service you pay for, only on your instructions, and we never sell it or use it to train anyone's models. This page is the agreement that puts that in writing, plus exactly how we protect it. It's a template written for your counsel to review before you rely on it.
02 — Who's who
For your workspace, you are the data controller and PaceHaus is your data processor — we act on your behalf. For the client data your team puts in (your clients' names, content, approvals), you remain the controller and we process it as your processor under this agreement.
03 — What we process, and why
Account basics, the workspace content and client data your team creates, and the operational logs it takes to keep the service healthy — all to run the workspace you paid for and nothing else. The full list, in plain language, is in the privacy policy.
04 — Only on your instructions
We process your data to provide the service and to follow your documented instructions — nothing more. We don't mine it for our own purposes, we don't build advertising profiles, and we don't use your content or your clients' content to train AI models.
05 — How we protect it
In transit, everything moves over encrypted connections (TLS). At rest, the database and media storage — including backups — are encrypted on disk. Every workspace is isolated at the database level by row-level security, so one agency can never read another's data even by mistake. Access is least-privilege and audited, and the keys that run the service stay server-side, never in the browser.
06 — A word on encryption
We're straight with you about what encryption can and can't do here. Your data is encrypted in transit and at rest, and walled off per workspace. What we can't offer — and no platform with search, AI, reporting, or automated invoicing can — is encryption that even we can't read: the server has to read your content to do those jobs for you. So the honest protection is strong security plus this written commitment, not a claim that your data is invisible to the system that runs it.
07 — Where it lives
The platform is hosted in Frankfurt (EU) — the database and media storage are in the same region, and your client review links and portal pages are served from the same infrastructure.
08 — Sub-processors
A short list of providers do specific jobs under contract: hosting and database (Frankfurt), media storage, email delivery, and the AI model provider that produces drafts inside your approval pipeline. Each is bound by its own data terms, and we stay responsible to you for the work they do. Billing runs on direct invoicing by PaceHaus itself; as online card processors come online, they'll be added to this list.
09 — Helping you answer your clients
When one of your clients (or your own team) asks to access, correct, export, or delete their data, the product's built-in export and erasure tools let you answer without waiting on us. Where you need our help, we give it.
10 — If something goes wrong
If we become aware of a breach affecting the personal data in your workspace, we notify you without undue delay — with what we know, what it affects, and what we're doing about it — so you can meet your own obligations.
11 — Getting your data back — or gone
You can export your workspace data at any time from inside the product. On request, or when you close your account, we delete or return your data and remove it from active systems, with backups aging out on their normal cycle.
12 — This document
This DPA applies for as long as you use the service and forms part of your terms of service. It's written in plain language on purpose; have your legal counsel review it against your obligations before you rely on it, and we'll gladly sign a countersigned copy on request.