Privacy policy

1. Controller

The operator of this instance hasn’t published their contact details yet. Until they do, please don’t enter personal data you aren’t comfortable sharing with an unidentified operator.

2. What we process and why

Your account. Name, email address and a salted scrypt hash of your password (never the password itself), to provide your workspace (Art. 6(1)(b) GDPR). If you sign in with Google, we receive your Google account ID, name and verified email address from Google and keep the ID to recognise you next time; we get no access to your Google data beyond that.

Product emails. If you sign up and haven't run an audit after a day, we may send you one email explaining how to start (Art. 6(1)(f) GDPR; our interest is that the service you signed up for is used). Each such email has an unsubscribe link, and you can turn them off under Settings. Account, security and billing emails are not affected.

Sign-in cookie. One strictly necessary, HttpOnly session cookie that keeps you signed in for up to 7 days. We use no analytics or advertising cookies. The only cookie that needs your consent is the optional partner-link cookie described under “Invite and partner links” (§ 25(1) TDDDG); everything else here is strictly necessary (§ 25(2) TDDDG).

Your audits and pages. Ads you upload, ad copy, the landing-page URL you enter, the text and images our server fetches from that page, the resulting analyses, generated pages, experiments and brand rules. We process them to perform the service you request (Art. 6(1)(b) GDPR). Uploaded files are processed in temporary storage and deleted after the audit; we keep the extracted text, transcript and results, not the original file. We also retain small, metadata-stripped image previews (or sampled video stills) privately with the audit so you can compare the ad with your draft. They are included in your workspace export and removed with the audit or account; they are not included in published landing pages.

Shared test results. When you mark a finished experiment with the kind of change it tested, its change type, the ad angle and awareness stage of its audit, a coarse price range and its visitor and conversion counts are added to a results pool. Other accounts only see totals from at least five tests at three or more brands, never a single account’s numbers, page content, product names or shop details. Purpose: showing which changes tend to work (Art. 6(1)(f) GDPR, our and our customers’ interest in better recommendations). You can switch this off in account settings at any time, which removes your tests from the pool at once; deleting your account removes them too.

Usage statistics for Hookpair itself. To improve the product we count which of our own pages and screens are opened and which buttons and links are clicked, without cookies and without storing IP addresses. For visitors who aren't signed in, a visitor is counted once per day through a hash of a salt that changes daily, the IP address and the browser; the salt of a past day is deleted, so visits can't be linked across days. We keep the first page and where the visit came from (utm_source or the referring site). For signed-in accounts we record on which days the account was active and which screens it opened, so we can see where people get stuck; this is deleted with the account. Click labels are button texts or the route of a link, never what you type. Browsers that send Global Privacy Control or Do Not Track are not counted. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR); daily counts are kept for up to 400 days.

Published pages. When you publish a page, visitors can open it without signing in. For the page owner's analytics we record each page view without cookies and without storing IP addresses: the source (UTM parameters, whether an ad click ID was present, the referring site's host name), the device class, how far the visitor scrolled, how long they were active and which button they clicked. To count a visitor once per day, we keep a hash of a key that changes daily, the page, the IP address, the browser identification and language; the previous day's key is deleted, so visitors can't be recognised on later days or across pages. Browsers that send the Global Privacy Control signal get no such hash at all. Visit records are deleted after 180 days, daily totals after 90 days (Art. 6(1)(f) GDPR, our and the page owner's interest in measuring the page).

Split links. When a page owner sends ad traffic through a split link, the link stores which page variant a visitor was shown in a cookie that holds only the variant's position (no identifier) for 30 days, so a returning visitor sees the same page. Visits are counted per page and day only.

Meta ad data and Shopify orders. If a workspace owner connects a Meta ad account or Shopify order access, we read ad-level spend and results and recent orders with their landing-page parameters to show performance per ad and page. Order data is reduced to order ID, date, amount, currency and the page it came through; no customer names or addresses are stored.

Meta Pixel on published pages. If a workspace owner connects Meta and supplies their privacy-policy URL, their published pages show a consent banner. Only after a visitor accepts does the page load the Meta Pixel. A click that opens a configured checkout can also send an InitiateCheckout event with IP address, browser and Meta cookie identifiers to Meta Platforms Ireland Ltd. via the Conversions API (Art. 6(1)(a) GDPR, § 25(1) TDDDG). A normal product-page link does not send this checkout event. The visitor’s choice is stored for 180 days, separately for each page, Pixel and privacy notice. For this processing the workspace owner whose page it is acts as controller. Reopen Privacy settings on the published page and choose Decline to withdraw consent for future tracking; this does not undo events already sent.

Partner-link cookie (only with your consent). If you arrive through a partner's link, we ask whether we may remember that for 30 days. Only if you choose “Allow” we set the cookie hp_ref (the partner's 8-character code, HttpOnly, 30 days), so the partner is credited if you sign up on a later visit; it is deleted when you sign up. Your answer is stored in hp_ref_consent (“granted” or “denied”, 180 days) so we don't ask again. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with the button below or by deleting the cookies; withdrawal doesn't affect sign-ups before it. Remove the partner cookie and my choice

Preventing self-referrals. To stop partners from crediting themselves through extra accounts, we store, for sign-ins and for sign-ups through a partner link, a keyed hash of the network you connect from (the first three parts of an IPv4 address, or the first three groups of an IPv6 address), never the address itself, for 90 days (Art. 6(1)(f) GDPR: preventing fraud in the partner program). For partners and the customers they refer, we also keep a hash of the card identifier Stripe assigns to the paying card (not the card number), so a partner can't earn commission on payments made with their own card; it is deleted with the account.

Invite and partner links. If you sign up through someone's invite or partner link, we store that link with your account and where the sign-up came from: the utm tags of the link you arrived with, which the page keeps in the open tab's memory only (no cookie, no browser storage) until you sign up. The person who invited you sees only that someone joined. An approved affiliate partner sees a pseudonym for your account (never your name or email), the sign-up date, whether you ran an audit, your current plan and the payments their commission is based on, including refunds, so they can check their commission (Art. 6(1)(f) GDPR). For partners, we keep their application, payout email, commissions and payouts; payout records are kept as long as accounting law requires.

Security. To stop password guessing and abuse we keep short-lived counters of attempts, keyed by a one-way hash, for 15 minutes (Art. 6(1)(f) GDPR).

3. AI processing

AI analysis and page generation use the Claude API by Anthropic (see recipients below). Content you submit for an audit is sent to Anthropic for that purpose only. Results are generated automatically and may contain errors; review them before publishing.

4. Recipients and service providers

We use the following processors and, for payments, independent controllers. Each receives only what it needs:

• Anthropic PBC (Claude API)Purpose: AI analysis of uploaded ads and landing pages and generation of page draftsData: Ad copy, ad images and video frames, transcripts, landing-page text, brand rulesLocation: United States; transfer based on the EU Standard Contractual Clauses / EU-U.S. Data Privacy Framework as offered by the provider
• Resend (Plus Five Five, Inc.)Purpose: Sending account emails such as password resets and email verificationData: Email address and the content of the account emailLocation: United States; transfer under Standard Contractual Clauses as offered by the provider

When you run an audit, our server requests the landing page you entered. The website owner can see our server’s IP address, not yours.

5. How long we keep data

Your account and workspace data stay until you delete them. Sessions expire after 7 days, email verification links after 24 hours and password reset links after 30 minutes. Page statistics are kept for 90 days. Payment and invoice records are kept by the configured payment provider (Stripe or Whop) for the periods required by tax and commercial law (up to 10 years).

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).

You can do most of this yourself in account settings: download all your workspace data as JSON, change your name, and permanently delete your account and everything in it. For anything else, contact us at the address above.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or place of work.

7. Security

The public service is only offered over HTTPS. Workspaces are isolated per account and every request is checked for ownership. Store access tokens are encrypted at rest. No system is perfectly secure; please use a unique password.