Privacy Policy

This is an English translation of our German privacy policy. In case of doubt, the German version prevails.

1. Controller

The controller for the processing of personal data on this website and in the set-up application is Joshevski & Wendel GbR, represented by its managing directors Naumche Joshevski and Andree Wendel.

2. General information on data processing

We only process personal data to the extent necessary to provide a functional website and our content and services. The legal bases are in particular Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (legitimate interests) and, where applicable, Art. 6(1)(c) GDPR (legal obligation).

3. Hosting and server log files

This website and the application are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All data is stored on servers in Germany. We have concluded a data processing agreement with the hosting provider under Art. 28 GDPR.

When you visit the website, information is automatically stored in server log files: IP address, date and time of the request, requested page, browser type and operating system. This data is used to ensure operation, analyse errors and defend against attacks (Art. 6(1)(f) GDPR) and is deleted automatically after a short time.

4. Cookies and local storage

This website only uses technically necessary cookies and similar storage technologies: a session token for the login area and a cookie for your language setting. No third-party marketing or tracking cookies are used on this website. The legal basis is Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

5. Registration and use of the platform

When you register for set-up, we process the data you provide (name, email address, company name, password in encrypted form) to set up and manage your account and to provide the contractual services (Art. 6(1)(b) GDPR). If you connect advertising accounts such as Google Ads or Meta to set-up, we store the required access tokens in encrypted form. Section 6 describes which data we retrieve through Google's APIs. The data is deleted after the end of the contract unless statutory retention obligations apply.

6. Connection to Google services

set-up offers sign-in with a Google account and, if you explicitly allow it, can access your Google Ads account and your Google Merchant Center. You grant this access in a consent dialog provided by Google. We only receive the permissions shown there and use the data exclusively for the features described here. The legal basis is Art. 6(1)(b) GDPR.

6.1 Sign in with Google

When you sign in with Google, we receive your email address, Google's confirmation that this address has been verified, and your name (openid, email and profile permissions). We use them to match your set-up account and to display your name in the application. We do not store a Google access token for sign-in and cannot access other Google services on your behalf.

6.2 Google Ads

If you connect a Google Ads account (permission for the Google Ads API), set-up retrieves the following data: accessible customer accounts, campaigns, ad groups, booked keywords, search terms, location targeting, conversion actions and metrics such as impressions, clicks, cost and conversions. We use this data to show you reports, score search terms for relevance, generate optimisation suggestions and attribute clicks to your enquiries.

set-up only writes to your account when you trigger an action or explicitly enable an automation: uploading offline conversions and conversion adjustments, creating conversion actions, maintaining negative keyword lists, pushing campaign drafts you have reviewed beforehand, and optimisation actions. set-up carries out optimisation actions either after your approval in each individual case or under a standing approval that you grant for specific types of actions with fixed limits and can revoke at any time.

6.3 Google Merchant Center

If you connect a Merchant Center account (permission for the Merchant API), set-up reads the product identifiers (item ID, GTIN, item group) and the cost of goods sold of your products. We use them to calculate the profit per order so that you can optimise for profit instead of revenue in Google Ads. Google does not offer a read-only permission for the Merchant API. set-up nevertheless uses this access read-only and never creates, modifies or deletes products.

6.4 Storage and sharing

We store access tokens encrypted with AES-256-GCM and the retrieved data on our servers in Germany (section 3). The data is only visible to users who have access to the respective workspace. For the AI features, individual data is transmitted to OpenAI (section 7). Beyond that, we do not share data from Google services with third parties, do not sell it, do not use it for advertising and do not use it to train generalised AI models. set-up staff only see this data with your consent, where necessary for security purposes or to comply with legal obligations, or after the data has been aggregated and anonymised.

6.5 Revocation and deletion

You can disconnect Google Ads and Merchant Center in set-up at any time. When you do, we delete the stored access token. You can also revoke access in your Google account at myaccount.google.com/permissions. Data already retrieved remains stored until you delete the workspace or the contract ends. On request to support@set-up.io we delete it earlier.

6.6 Compliance with Google's policies

set-up's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. AI features (OpenAI)

For search term scoring, optimisation suggestions, campaign drafts, blog drafts and the help assistant we use language models from OpenAI via its API. We transmit the content required for the respective task, for example search terms, keywords, campaign metrics and content of your website. We do not pass on contact data from enquiries for this purpose. According to OpenAI, data sent through the API is not used to train its models. We have concluded a data processing agreement with OpenAI. Processing may take place in the USA on the basis of the EU Standard Contractual Clauses under Art. 46 GDPR.

8. Payment processing (Stripe)

We bill paid plans via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). When you subscribe, you enter your payment details directly with Stripe, we do not receive them. We transmit your name, email address, billing address and, where applicable, your VAT ID to Stripe and receive the status of your subscription in return (Art. 6(1)(b) and (c) GDPR). Stripe may also process data in the USA on the basis of the EU Standard Contractual Clauses under Art. 46 GDPR.

9. Processing on behalf of our customers

When our customers use set-up to capture enquiries, events and conversions on their own websites, we process the resulting data (for example form data, click IDs, technical identifiers) as a processor on behalf of the respective customer under Art. 28 GDPR. The respective customer is the controller of this data. Data subjects should address requests about this processing directly to the operator of the website on which the data was collected.

10. Email communication

To send system and transactional emails (for example registration, notifications, reports) we use a technical email service provider, currently Resend (Resend, Inc., USA). We have concluded a data processing agreement and EU Standard Contractual Clauses as appropriate safeguards under Art. 46 GDPR with this provider. If you contact us by email, we process your details to handle your request (Art. 6(1)(b) and (f) GDPR).

11. Retention period

We only store personal data for as long as necessary for the purposes stated or as required by statutory retention periods. Tracking-related raw data in the application is subject to automatic deletion periods.

12. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

13. Security

All data is transmitted encrypted via TLS. Passwords are stored only as hashes, and access tokens for connected advertising accounts are stored in encrypted form.

14. Changes to this policy

We update this privacy policy whenever the legal situation or our services change. Last updated: October 2026.