HYPD Advertising Intelligence GmbH ("HYPD", "we", "us") operates the HYPD platform, an AI co-pilot for performance marketers. This Privacy Policy explains what personal data we process, why, on what legal basis, for how long, and what rights you have. It applies to the website at hypd.ai and its subdomains, the HYPD application at app.hypd.ai, the HYPD tools you can use inside AI assistants such as Claude and ChatGPT, and our documentation and support channels (together, the "Services").
This policy is written to meet the information duties of Articles 13 and 14 of the General Data Protection Regulation (GDPR). It is provided in English and German. The English version is authoritative.
1. Who is responsible
Controller
HYPD Advertising Intelligence GmbH, Attilastraße 16, 12529 Schönefeld, Germany
Commercial register: Amtsgericht Cottbus, HRB 18651 CB. Managing directors: Ionut Ciobotaru, Philip Mohr, Simon Schneckenberger
Data protection contact
Philip Mohr, privacy@hypd.ai
We are not required to appoint a data protection officer. Please direct all privacy questions and requests to privacy@hypd.ai. For general enquiries and support use help@hypd.ai.
2. Our two roles: controller and processor
HYPD acts in two different roles. Which one applies depends on the data.
HYPD is the controller for data it processes for its own purposes: your account and login data, usage and security logs, product analytics, billing, support, and marketing. Section 4 describes this processing. Your rights for this data are exercised against HYPD (Section 12).
HYPD is the processor for data it handles on the customer's instructions: everything we read from, or write to, the advertising, analytics and measurement platforms you connect ("Connected Platform Data"), the prompts and questions you enter, the account context you set up, the results we generate for you, and the content of the Write Actions change log. Section 5 describes this processing. Here the customer, meaning the organisation that owns the HYPD workspace, is the controller. Our processing is governed by our Data Processing Agreement (DPA), which forms part of our Terms of Service and applies to every customer automatically: https://www.hypd.ai/dpa.
If you use HYPD under a workspace owned by your employer or client, that organisation decided to use HYPD and is the controller for the Connected Platform Data and other content it processes through HYPD. Contact them first for questions about that data. HYPD remains the controller for your account, login, security and product analytics data as described in Section 4.
3. How HYPD works
HYPD connects to the platforms you choose using each platform's official API, after you have explicitly authorised the connection on that platform's consent screen.
Read-only by default. Unless you enable Write Actions, every integration is read-only. We analyse and report on your data and do not create, edit, publish or delete anything in your connected accounts.
Write Actions, opt-in. An account owner can enable Write Actions for an account. Where available for a platform, HYPD then applies changes, but only changes you have explicitly approved one by one, and every applied change is recorded in a change log you can access in the app. The approval procedure is set out in our Terms of Service. Section 5.3 lists the platforms where Write Actions are available and the permissions involved.
Nothing is sold, no model training on your data. We do not sell personal data. We do not allow our AI model providers to train on your data, and we do not train AI or machine learning models on Connected Platform Data, prompts or account context. We use your own data to improve the recommendations you receive. Where the platforms' terms allow it, we use aggregated and anonymised data to provide benchmarks and improve our recommendation logic for all customers (Section 7). The models and algorithms behind HYPD are improved only with data about how the HYPD app itself is used.
4. Data we process as controller
4.1 Website visitors
When you visit hypd.ai we process the data your browser sends: IP address, date and time, pages requested, referrer, browser and operating system. Our hosting provider stores these server logs for intrusion detection and troubleshooting. Legal basis: legitimate interest in operating a secure website, Art. 6(1)(f) GDPR. Server logs are deleted after 30 days.
Cookies and tracking on the website are described in Section 11.
4.2 Account and workspace
When you create an account we process your name, email address, password or sign-in method, profile picture if provided, workspace or company name, role, language and time zone, and your notification settings. Account and session data are stored on our own infrastructure in the EU. Legal basis: performance of the contract, Art. 6(1)(b) GDPR. Name, email address and, for paid plans, billing details are required to conclude the contract; without them we cannot provide an account.
If you invite team members, we process their name and email address to send the invitation and manage their access. The invitation email tells the invited person who invited them and links to this policy. You are responsible for being allowed to invite them.
4.3 Usage data
When you use the app we process technical and usage data: IP address, device and browser, pages and features used, actions taken, timestamps, performance and error information. We use a product analytics tool, PostHog, hosted in the EU and configured without cookies or persistent device identifiers, with IP addresses anonymised. We use this data to operate, secure and improve the Services. Legal basis: legitimate interest in a reliable and secure product, Art. 6(1)(f) GDPR. Technical logs are kept for 60 days, product analytics events for 12 months.
4.4 Payments
If you subscribe to a paid plan we process your billing name and address, VAT ID, plan, invoices and payment status. Card details are entered directly with our payment processor, Stripe Payments Europe Ltd, and never reach our servers. We receive only a payment confirmation and the last four digits of the card for your reference. Legal basis: performance of the contract, Art. 6(1)(b), and our legal obligation to keep accounting records, Art. 6(1)(c) GDPR. Invoices and payment records are kept for 10 years as required by German tax and commercial law.
4.5 Support, feedback and communication
If you contact us by email, through the app or through our feedback portal, we process your contact details, the content of your message and any attachments, and the time and channel of the communication. Our feedback and changelog portal is provided by Featurebase, hosted in the EU. Legal basis: performance of the contract where you are a customer, otherwise our legitimate interest in answering enquiries, Art. 6(1)(b) and (f) GDPR. Support conversations are kept for 24 months after the last message.
4.6 Product and marketing emails
We send transactional emails you cannot opt out of while you have an account: onboarding, security notices, billing, essential product changes.
To customers on a paid plan we may send news about similar HYPD services without consent, as permitted by § 7(3) of the German Act against Unfair Competition; we point this out when you subscribe and in every email. Users on the free plan receive product news only if they opted in at sign-up. Legal basis: Art. 6(1)(a) GDPR, or Art. 6(1)(f) GDPR together with § 7(3) UWG. You can unsubscribe at any time via the link in each email or by writing to privacy@hypd.ai.
5. Data we process as processor
5.1 Connected Platform Data
When you connect a platform, we read the data needed to provide the feature you use. For each platform you see the exact permissions on that platform's consent screen before you approve the connection. Every connection is a separate, explicit action by you. Below is what each integration can read.
Google. After you connect a Google service we may receive your Google account identifier and email address, plus the data of the services you selected:
| Service | Data read | OAuth scope |
|---|---|---|
| Google Ads | linked customer IDs; campaign, ad group, keyword, audience and creative metadata; metrics such as impressions, clicks, cost, conversions and revenue; account settings such as budgets, bid strategies and targeting. Google Ads data is retrieved live for each request and is not cached. | https://www.googleapis.com/auth/adwords |
| Google Analytics | accounts and GA4 property IDs; reporting data such as traffic, users, sessions, conversions, events, landing pages, channels and campaigns | https://www.googleapis.com/auth/analytics.readonly |
| Google Merchant Center | account IDs and settings; product data such as titles, descriptions, identifiers, availability and pricing; product and account status such as disapprovals and feed diagnostics. Google may share information about HYPD's access to your Merchant Center account with Google Business Manager. | https://www.googleapis.com/auth/content |
| Google Search Console | verified sites; search analytics such as queries, clicks, impressions, click-through rate and position; sitemaps | https://www.googleapis.com/auth/webmasters.readonly |
| Google Tag Manager | account and container IDs; container configuration such as tags, triggers, variables and versions | https://www.googleapis.com/auth/tagmanager.readonly |
Meta (Facebook and Instagram). Ad account IDs and Business Manager metadata; campaign, ad set, ad and creative metadata; performance and aggregated audience insights; Pages, pixels and product catalogues linked to your account; the names, sizes and settings of your audiences, but never their members; lead form definitions, but never the submitted records (Section 5.2). Meta data is used only to analyse and optimise your own Meta campaigns. It is shared only with the sub-processors listed in the DPA and, on your instruction, with an AI assistant you connect. It is never sold, never combined with other customers' data, and never used to build profiles of individuals.
LinkedIn Ads. Ad account IDs; campaign group, campaign and creative metadata; performance and aggregated audience reporting; audience names and sizes, never members.
Microsoft Advertising. Account and customer IDs; campaign, ad group, ad and keyword metadata; performance and search term reporting; audience names and settings, never members.
TikTok for Business. Advertiser IDs; campaign, ad group and ad metadata; performance and aggregated audience reporting.
We use Connected Platform Data only to provide the Services to you: analytics, audits, anomaly detection, reports, recommendations and, where you enabled Write Actions, the changes you approved.
Revoking access. You can disconnect any platform in the app at any time. You can also revoke HYPD's access on the platform itself: Google at https://myaccount.google.com/permissions, Meta under Settings, Business integrations, LinkedIn under Settings, Data privacy, Permitted services, Microsoft at https://account.live.com/consent/Manage, TikTok under Business Center, Integrations.
5.2 What we minimise and what we never access
HYPD is built to hold as little personal data as possible. We do not request user-level dimensions, such as GA4 user or client IDs or click identifiers, and where an API response nevertheless contains such fields we remove them before storage. The email address of the user who authorised a connection is kept to show you which account is connected. Free-text fields such as search terms, URLs, ad texts and keywords are stored as received; they may occasionally contain personal data entered by third parties, which is one reason we limit their storage to 12 months.
We do not retrieve lead form submissions, the members of Customer Match, custom or other audience lists, or any other record about your customers or advertising audiences. We read only the names, sizes and settings of audiences.
5.3 Write Actions and write permissions
Write Actions are off by default and are enabled per account by the account owner. We hold the write permissions below only to apply changes you have explicitly approved. Approval is given by a signed-in user in HYPD, using that user's own authorisation with the platform; HYPD does not route changes through shared credentials. Write Actions are currently available for:
| Platform | What an approved Write Action can do | Additional OAuth scopes |
|---|---|---|
| Google Ads | create campaigns, ad groups, ads and assets; change budgets, bids, keywords, ads, assets and the status of campaigns, ad groups, keywords and ads; revert a change previously applied through HYPD. Each change is a separate approved draft. | covered by https://www.googleapis.com/auth/adwords |
| Google Tag Manager | apply an approved change to a container, save it as a restorable version, and publish that version after a separate approval | https://www.googleapis.com/auth/tagmanager.edit.containers, https://www.googleapis.com/auth/tagmanager.edit.containerversions, https://www.googleapis.com/auth/tagmanager.publish |
HYPD never deletes accounts, containers or properties, and never changes user permissions on any platform. Every applied change is recorded in an immutable change log you can access in the app, showing the approving user, the time and the full change details. Where a platform's policies require it, we may make that log available to the platform operator.
5.4 Prompts, chat history and account context
When you ask HYPD questions in the app, the content you provide is processed to answer them: your questions, the filters, date ranges and accounts you select, the account context you set up to describe your business and goals, and the analyses, summaries and reports generated for you. Chat history is stored for 30 days so you can revisit past analyses, then deleted. Account context is stored for as long as you keep it.
5.5 Using HYPD inside Claude, ChatGPT or another AI assistant
You can connect HYPD to an AI assistant you already use, such as Claude or ChatGPT, through the Model Context Protocol (MCP). The assistant then sends requests to HYPD and HYPD returns results into your conversation.
The assistant is your tool, provided by its operator under your own agreement with that operator. By connecting it you instruct HYPD to transmit results, including Connected Platform Data, to that operator for the purpose of answering your requests. HYPD records the connection as proof of that instruction; you can withdraw it at any time by disconnecting the assistant. During the connection the assistant's operator learns your HYPD identity and email address. Everything that appears in the conversation, including the results HYPD returns, is processed by the operator under its terms and your privacy settings, which you control. Whether the operator acts as your processor or as an independent controller depends on your agreement with it. HYPD recommends business or enterprise plans with model training disabled.
HYPD has no access to your conversation beyond the requests sent to it. We treat those requests like prompts in the app: they are stored for 30 days as chat history, and technical logs of the calls are kept for 60 days.
5.6 HYPD's own use of AI models
To generate insights, summaries, recommendations and the additional account context we provide to connected assistants, HYPD itself sends data to large language models. We use Google Gemini and Anthropic Claude models through Google Cloud Vertex AI in EU regions, and OpenAI models through Azure OpenAI or OpenAI with EU data residency. All of these are contractually configured so that the provider does not use your data to train its models. Providers retain requests only transiently, for up to 30 days, for abuse monitoring under their EU terms, after which they are deleted. We send only what the request needs, typically aggregated metrics, structured descriptions of campaigns and your question. Your use of the Services is your instruction to disclose this data to these providers for that purpose only.
5.7 Marketing Intelligence data
Features such as keyword research, search results data, shopping intelligence, landing page audits, competitor domains and the ad libraries use third-party data sources. When you run such a feature, only the query itself is sent to the source: a keyword, a domain, a URL or an advertiser name. No identifier of you or your organisation is passed on. The providers are listed in our documentation.
6. Purposes and legal bases at a glance
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Services, connecting platforms, generating analyses | account, usage, Connected Platform Data, prompts | contract, Art. 6(1)(b); for Connected Platform Data as processor on the customer's instructions |
| Applying approved Write Actions | Connected Platform Data, change log | contract, Art. 6(1)(b); as processor |
| Security, abuse prevention, troubleshooting | usage data, logs | legitimate interest, Art. 6(1)(f) |
| Improving the product and the models behind it | usage data of the HYPD app, in aggregated form | legitimate interest, Art. 6(1)(f) |
| Benchmarks and recommendation logic for all customers | aggregated and anonymised data, see Section 7 | creation of the anonymised data: on the customer's instruction under the DPA; the anonymised data itself is not personal data |
| Billing | billing data | contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Support | contact and message data | contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Product and marketing emails | email, name | consent, Art. 6(1)(a); paid customers, Art. 6(1)(f) with § 7(3) UWG |
| Website analytics and advertising measurement | cookie data, see Section 11 | consent, Art. 6(1)(a) and § 25(1) TDDDG |
| Legal compliance and defence of claims | any of the above as needed | legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
Where we rely on legitimate interests you can object at any time, see Section 12.
7. Aggregated and anonymised data
With the customer's instruction under the DPA, we create aggregated and anonymised data from the use of the Services: statistics such as which campaign structures tend to waste budget or which settings correlate with better results, calculated across many unrelated accounts after all account identifiers have been removed. This data cannot be linked back to you, your organisation, your accounts or any individual. We use it to provide benchmarks to customers and to improve the rules and heuristics behind our recommendations. We do not use it, or any Connected Platform Data, to train AI or machine learning models.
The platforms' own terms limit this further, and we follow them:
- Data from Meta is never aggregated across customers and is used only to analyse and optimise your own Meta campaigns.
- Data from LinkedIn is aggregated only to provide performance reporting and benchmarks to customers, never contains member-level data, and is aggregated only with the consent of the connecting account manager, which you give when you connect a LinkedIn ad account.
- Data obtained through Google APIs is used in aggregated, anonymised form only for benchmarks shown to customers and for internal operations, as permitted by the Google API Services User Data Policy (Section 8), and never for model training.
Anonymised data is not personal data and is not covered by the GDPR. Customers on an enterprise order can opt out of the use of their data for aggregated benchmarks.
8. Google API Services User Data Policy
HYPD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Data obtained through Google APIs is used only to provide and improve the user-facing features of HYPD and to maintain the security of the platform. We do not use it to develop, improve or train generalised AI or machine learning models, we do not sell it, we do not use it for advertising, and no human at HYPD reads it except with your permission, for security purposes, to comply with law, or in aggregated and anonymised form for internal operations. If we ever intend to use Google data in a new way, we will ask for your consent to an updated policy first. You can revoke HYPD's access to your Google account at any time at https://myaccount.google.com/permissions.
9. Who receives your data
We share personal data only with providers who process it on our behalf under data processing agreements, with the platforms you connected, with the AI assistant operators you connected, and where the law requires it.
Sub-processors. The current list of our sub-processors, with their role, location and transfer mechanism, is published at https://www.hypd.ai/subprocessors. We notify account owners by email at least 30 days before adding or replacing a sub-processor that processes personal data on your behalf.
Connected platforms. When you connect a platform, that platform receives the information that HYPD is accessing your account. When you approve a Write Action, the change is sent to that platform. The platform's own privacy policy applies to what it does with it. Platforms are independent controllers, not our sub-processors.
AI assistant operators. As described in Section 5.5, the operator of an assistant you connect HYPD to receives the results HYPD returns into your conversation, on your instruction.
Authorities and legal claims. We disclose data where required by law, by a court or authority order, or where necessary to establish, exercise or defend legal claims, or to protect the rights and safety of HYPD, our users or others.
Business transfers. If HYPD is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, who assumes the obligations of this policy. We will notify you where the law requires it. Data obtained through Google APIs is transferred in such a transaction only with your explicit prior consent, and is never transferred for financing purposes.
10. Where data is stored and how long we keep it
Location. Customer data, Connected Platform Data, prompts and AI processing are stored and processed in the European Union: on Google Cloud and Amazon Web Services EU regions, on Railway running on Google Cloud EU, on Vercel in the Frankfurt region, and with PostHog, Stripe and Featurebase in their EU environments. Some of these providers are US companies; support and administrative access by their US staff is possible and is covered by the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Our internal tools for email, documents and team chat, Google Workspace, Microsoft 365 and Slack, see customer data only in support correspondence and are contracted with their EU entities under the same safeguards. Where any transfer outside the EEA takes place we rely on an adequacy decision, the Data Privacy Framework, or Standard Contractual Clauses with supplementary measures. You can request a copy of the safeguards at privacy@hypd.ai.
Retention.
| Data | Kept |
|---|---|
| Account and profile data | until you delete your account, then removed within 30 days |
| OAuth tokens for connected platforms | until you disconnect the platform or delete your account |
| Google Ads data | not cached; retrieved live for each request |
| Raw data from other connected platforms, with user-level fields removed at ingest | while the account is active, at most 12 months from retrieval, to enable year-over-year comparison; then deleted |
| Derived metrics, audits, reports and dashboards | while the account is active; derived data based on LinkedIn reporting data at most 12 months |
| Account context you set up | while the account is active, or until you delete it |
| Chat history and prompts, including requests from connected AI assistants | 30 days |
| Write Actions change log | while the account is active, then 12 months as documentation of the instructions you gave us (DPA § 5.10), then deleted |
| Technical logs and traces | 60 days |
| Product analytics events | 12 months |
| Support conversations | 24 months after the last message |
| Invoices and payment records | 10 years, German commercial and tax law |
| Website server logs | 30 days |
Disconnecting a platform stops all access immediately. Cached data from that platform is deleted within 30 days, or immediately on request. Data obtained from LinkedIn is deleted within 10 days of disconnection, deletion request or account closure.
Export. During the term you can request an export of the Output, account context and Connected Platform Data we store for you, in a common machine-readable format, as set out in the Terms of Service.
Deleting data. Any user of a workspace can request deletion of the data HYPD holds that was obtained through their own platform login, by disconnecting the platform in the app or by emailing privacy@hypd.ai. Account owners can delete the whole account at any time in the app settings, or by emailing privacy@hypd.ai. Within 30 days we delete or anonymise all data associated with the account, except invoices and records we must keep by law and the change log documentation described above, which are kept separately with restricted access.
11. Cookies and similar technologies
We use cookies and similar technologies on the website and in the app. Technologies that are necessary to provide what you asked for are used without consent, based on § 25(2) TDDDG. All others are used only after you consent in our cookie banner, § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your choice at any time via "Cookie settings" in the website footer; your decision is stored for six months, after which we ask again. We use Google Consent Mode v2: until you consent, Google tags run with all consent signals set to "denied", meaning they set no cookies and send no identifiers, and no marketing tag sets a cookie or reads your device. After you consent, tags run according to the categories you chose.
Necessary
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| hypd_consent | HYPD | stores your cookie choices | 6 months |
| Session cookies | HYPD | keep you signed in to the app and protect against session hijacking | session, up to 7 days |
| Stripe | Stripe | fraud prevention, loaded on the checkout page only | session |
Analytics, with consent
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| Google Analytics 4 | Google Ireland Ltd | website usage statistics, IP anonymised | up to 2 years |
Product analytics in the app (PostHog) runs without cookies or persistent device identifiers and is described in Section 4.3.
Marketing, with consent
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| Meta Pixel | Meta Platforms Ireland Ltd | measuring our Meta advertising campaigns and building ad audiences | up to 3 months |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Company | measuring our LinkedIn advertising campaigns | up to 6 months |
| Reddit Pixel | Reddit Inc. | measuring our Reddit advertising campaigns | up to 3 months |
| FirstPromoter (_fprom_tid, _fprom_ref) | FirstPromoter (Netherlands) | attributing sign-ups to our affiliate partners | up to 90 days |
For the collection of data through the Meta Pixel we are joint controllers with Meta Platforms Ireland (Art. 26 GDPR); the essence of that arrangement is set out in Meta's Controller Addendum at https://www.facebook.com/legal/controller_addendum. LinkedIn processes data collected through the Insight Tag under the LinkedIn Ads Agreement (https://www.linkedin.com/legal/sas-terms) and its data processing terms; for the collection on our website we are jointly responsible with LinkedIn Ireland (Art. 26 GDPR). Meta and LinkedIn are solely responsible for the subsequent processing. Google, Meta, LinkedIn and Reddit may transfer data to the United States; all four participate in the EU-US Data Privacy Framework.
12. Your rights
You have the following rights regarding personal data we hold as controller:
- Access, Art. 15: a copy of your data and information about its processing
- Rectification, Art. 16: correction of inaccurate data
- Erasure, Art. 17: deletion where there is no reason to keep it
- Restriction, Art. 18: limiting processing in certain cases
- Portability, Art. 20: receiving your data in a machine-readable format
- Withdrawal of consent, Art. 7(3): at any time, without affecting earlier processing
Right to object (Art. 21 GDPR). Where we process your data based on legitimate interests, you can object at any time for reasons arising from your particular situation, and we will stop unless we have compelling legitimate grounds that override your interests. You can object to direct marketing at any time, without giving reasons, and we will stop immediately.
No automated decisions. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). HYPD's recommendations concern campaigns, not individuals.
To exercise any right, email privacy@hypd.ai. We may ask you to verify your identity. We respond within one month, extendable by two further months for complex requests, in which case we will tell you.
Where HYPD acts as processor for your employer or client, we forward your request to them and help them respond.
You have the right to lodge a complaint with a supervisory authority. The authority responsible for HYPD is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, https://www.lda.brandenburg.de. You may also complain to the authority of your own place of residence or work.
13. Security
We protect your data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2 or higher) and at rest, encrypted storage of OAuth tokens and API credentials, logical separation of customer data, separate development and production environments, role-based access on a need-to-know basis with multi-factor authentication for all production and administrative access, logging of administrative access, regular backups with tested restores, and a documented incident response process. We notify affected customers without undue delay if a personal data breach affects their data. The full list of measures is part of our Data Processing Agreement.
14. Children
The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with data, contact privacy@hypd.ai and we will delete it.
15. Changes to this policy
We update this policy when our Services or the law change. The date at the top shows the current version. For material changes we notify account owners by email or in the app before they take effect. Changes to the way we use data obtained through Google APIs take effect only after you have consented to the updated policy. Previous versions are available on request.
16. Language
This policy is published in English and German. In case of any discrepancy the English version prevails.