// Legal
Privacy policy
Data protection notice for pixelpropaganda.io
Based on the privacy notice at pixelpropaganda.de/impressum/#datenschutz. English version for the suite product. Plugin sections for Facebook, Google Analytics, Google +1 and Twitter from the consultancy site are not repeated here because this product does not load those services. Section 5 discloses Amazon Ads Partner Network / Advertising API data use for Amazon Partner review.
1. Controller
The controller for personal data processed through pixelpropaganda.io and dashboard.pixelpropaganda.io is:
Studio PixelPropaganda
Nova North, 11 Bressenden Place
London SW1E 5BY, United Kingdom
Email: info@pixelpropaganda.com
Website: https://pixelpropaganda.com
Privacy and Amazon Ads data-security contact (same mailbox): info@pixelpropaganda.com
2. Scope of this notice
This notice covers the public marketing site (pixelpropaganda.io), the authenticated suite (dashboard.pixelpropaganda.io), account registration and login, billing via Stripe, connected advertising platforms (including Amazon Ads for Sponsored Products, Sponsored Brands, Sponsored Display and related PPC reporting), and the privacy export and erasure tools in the product.
You can use large parts of the public site without creating an account. Where we collect personal data, we do so as described below.
3. Server logs
When you call our pages, the hosting stack may store general technical data in server logs, for example browser type and version, operating system, referrer URL, requested path, date and time, IP address, and similar data needed to deliver the site and defend against attacks.
We do not use these logs to identify you as a person. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and stable operation). Logs are kept only as long as needed for those purposes and are stored separately from account data.
4. Account and workspace data
If you register, we process the name, workspace name, email address and password hash you submit, plus membership and role data for the workspace. This is required to provide the contractually requested service (Art. 6(1)(b) GDPR).
Inside the suite you may connect store or ad-platform credentials. Those tokens are encrypted at rest with AES-256-GCM before storage.
5. Amazon Ads (PPC) integration and Amazon Data
Pixel Propaganda is an advertising operations product. When you connect an Amazon Ads account (Amazon Advertising console / Sponsored Ads PPC), we access Amazon Ads APIs solely to create, manage, optimise and report advertising campaigns on your behalf, after you grant express, verifiable authorisation (OAuth or equivalent Amazon login consent). We do not act on an Amazon Ads account without that authorisation.
This section is the clear and conspicuous notice required under the Amazon Ads Partner Network Policies regarding Amazon Data we access and the purposes of that use. We also comply with the Amazon Advertising API License Agreement and related Amazon Ads API policies as published by Amazon.
- Purpose (permitted use only): create, edit, pause and structure Sponsored Products / Sponsored Brands / Sponsored Display (and related Amazon Ads campaign types available to your account); set and adjust bids, budgets, targeting, keywords and negative keywords; pull performance and reporting metrics (for example impressions, clicks, spend, sales, ACoS, ROAS, search-term reports) so you can review results in the Pixel Propaganda dashboard; surface recommended bid or keyword changes for your approval or automated rules you enable.
- Amazon Data categories we may process: advertising profile / account identifiers; campaign, ad group, ad and keyword identifiers and settings; bids, budgets, targeting and match types; search-term and performance reports; creative and product-ad metadata you already manage in Amazon Ads; OAuth access and refresh tokens needed to call the APIs. We do not request Amazon buyer or shopper PII through the Advertising API, and we do not send Amazon buyer PII to Amazon Ads.
- Legal basis: Art. 6(1)(b) GDPR (performance of the contract to run your ad workspace). Where a separate Amazon advertiser entity authorises our workspace, we process that Amazon Data as instructed to deliver the same PPC create / manage / report service.
- No sale or unauthorised sharing: we do not sell, rent, license or publicly publish Amazon Data. We do not share Amazon Data with third parties except (a) back to Amazon via the official Amazon Ads APIs to perform the actions you authorised, (b) hosting and infrastructure subprocessors bound by confidentiality that operate our product in Germany (see Hosting), and (c) where Amazon has approved a Service Provider under confidentiality solely to maintain the integration.
- No combining without Amazon approval: we do not combine Amazon Data with unrelated third-party data sources for interest-based advertising, behavioural retargeting, or re-identification of individuals. Cross-channel dashboards in Pixel Propaganda show metrics side by side for your workspace only; they do not merge Amazon Ads audience graphs with non-Amazon identity graphs.
- Need-to-know and credentials: Amazon Ads developer credentials and end-user OAuth tokens are restricted to personnel and systems with a strict need-to-know for the integration. We do not solicit, proxy, buy or sell Amazon login passwords. End-user Amazon credentials are never stored; only Amazon-issued API tokens are stored, encrypted at rest (AES-256-GCM) and in transit (TLS).
- Retention and deletion: Amazon Data is retained only while required to provide the connected PPC features or to meet a short operational cache window for reporting. When you disconnect Amazon Ads, close your workspace, or erase your account (Art. 17), we delete stored Amazon tokens and Amazon campaign/report copies we hold, except data we must keep under a narrow legal obligation (in which case it is locked down and deleted when the obligation ends). On Amazon request or Partner Network termination we delete or discontinue use of Amazon Data as required.
- Security: administrative, physical and technical safeguards include encryption at rest and in transit, access controls, least-privilege roles, monitoring of API usage, and separation of production systems on Hetzner servers in Germany.
- Incidents and privacy requests: report suspected misuse of Amazon Data, security vulnerabilities, or privacy requests to info@pixelpropaganda.com. We track, investigate and respond through that publicly documented channel. Amazon may audit or monitor our Amazon Ads API usage under its Partner Network Policies; we cooperate with reasonable Amazon investigations.
- Your controls: you can revoke Amazon authorisation in Amazon Advertising / Seller or Vendor Central and disconnect the integration in the Pixel Propaganda dashboard. After revocation we stop new API calls and delete retained Amazon tokens and cached Amazon Data as described above.
- Accuracy of statements: we do not make false or misleading claims about Amazon Ads capabilities. Campaign changes that affect spend are executed only through Amazon Ads APIs under your authorisation and product settings.
6. Billing (Stripe)
Paid plans and trials are billed through Stripe. We transmit the data Stripe needs to run checkout and subscriptions (for example email, customer and subscription identifiers, plan tier). Stripe acts as a payment provider. Payment card data is entered on Stripe-hosted pages and is not stored on our servers.
Legal basis: Art. 6(1)(b) GDPR (contract) and, where required for invoicing records, Art. 6(1)(c) GDPR. Invoice records may be retained in anonymised or legally required form after account erasure (§ 147 AO where applicable).
7. Hosting location
The application and database for the suite run on Hetzner servers in Germany. Session authentication cookies are issued for the dashboard host. Amazon Data processed for the PPC integration is stored and processed in that same German hosting environment unless Amazon requires a specific API call to be sent to Amazon’s advertising endpoints (which are operated by Amazon under Amazon’s own terms).
8. Cookies
This product uses a session cookie required for login. We do not place advertising pixels on the marketing or dashboard sites. The consent banner on the site acknowledges that essential session use. Legal basis for the session cookie: Art. 6(1)(b) GDPR and, where applicable, § 25(2) TDDDG.
9. Contact
If you contact us by email, we process the data you send so we can answer your request (Art. 6(1)(b) or (f) GDPR, depending on context).
10. Retention and erasure
We store personal data only as long as needed for the stated purposes or as required by law. You can export a machine-readable archive of your data (Art. 20 GDPR) and request erasure of your account (Art. 17 GDPR) from the privacy page inside the dashboard after login. Account erasure includes deletion of connected Amazon Ads tokens and retained Amazon campaign/report copies we hold, as described in section 5.
11. Your rights under the GDPR
Subject to the legal requirements, you have the right to confirmation and access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.
To exercise these rights, email info@pixelpropaganda.com or use the in-product export and delete tools where available.
- Confirmation and access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction (Art. 18)
- Portability (Art. 20)
- Objection (Art. 21)
- Complaint to a supervisory authority (Art. 77)
12. Security of transmission
Internet transmission (including email) can have security gaps. Absolute protection against third-party access is not possible. Prefer the authenticated dashboard tools for sensitive account actions. Amazon Ads API traffic uses TLS.
13. Unsolicited advertising
The use of contact data published under imprint obligations for sending unsolicited advertising is opposed. The operators reserve the right to take legal action in the event of unsolicited advertising information, for example spam emails.