Privacy Policy

Last updated: June 2026

This policy covers the CopyPasteCEO website (copypasteceo.com) and the CopyPasteCEO mobile app.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Robert Engel An den Stadtsgärten 19 58636 Iserlohn Germany Email: robert@copypasteceo.com

2. Overview

We process personal data only as far as it is necessary to provide a working service, its content and features, or where you have given consent. Legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (performance of a contract), (c) (legal obligation) and (f) (legitimate interest).

3. Hosting (Vercel)

The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the site is accessed, technically necessary data (IP address, date/time, page requested, browser) is processed in server log files (Art. 6(1)(f) GDPR). A data processing agreement is in place; transfers to the USA are based on EU Standard Contractual Clauses.

4. Account and member area (Supabase)

For registration, login and the member area (web and app) we use Supabase (Supabase Inc.; data stored in the EU, AWS region Frankfurt / eu-central-1). We process your email address, display name, encrypted password, your membership tier and purchase mapping, and any community content you create. Legal basis is Art. 6(1)(b) GDPR (performance of the usage contract).

5. Payments

Web (Stripe)

Payments on the website are handled by Stripe (Stripe Payments Europe Ltd., Dublin, Ireland, and Stripe Inc., USA). The data required for payment (e.g. name, email, billing address, payment method) is processed directly by Stripe. We do not receive full payment details. Legal basis is Art. 6(1)(b) GDPR.

App (Apple In-App Purchase via RevenueCat)

Purchases inside the iOS app are processed by Apple as in-app purchases. Apple handles the payment; we do not receive your payment details. To manage entitlements and subscriptions we use RevenueCat, Inc. (USA). RevenueCat receives a pseudonymous app user id, your purchase/subscription status and device information to unlock your access. Legal basis is Art. 6(1)(b) GDPR. Transfers to the USA are based on EU Standard Contractual Clauses.

6. Email marketing (Kit / ConvertKit)

For emails (lead magnet delivery, newsletter, product information) we use Kit (ConvertKit LLC, USA). On sign-up we store your email address and, where provided, name and source. Legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email.

7. Transactional email (Resend)

System emails (e.g. registration confirmation, password reset) are sent via Resend, Inc. (USA). Your email address is processed for the purpose of sending (Art. 6(1)(b) and (f) GDPR).

8. Direct messages (ManyChat / Meta)

If you interact with us via Instagram/Facebook (e.g. comment-to-DM), the data involved is processed via ManyChat, Inc. (USA) and the Meta platforms. Legal basis is Art. 6(1)(a)/(f) GDPR.

9. Analytics and measurement (website only)

The website uses technically necessary cookies for operation and login (Art. 6(1)(f) GDPR). With your consent (Art. 6(1)(a) GDPR) we also use Google Analytics 4 (Google Ireland Ltd.) and the Meta Pixel and Conversions API (Meta Platforms Ireland Ltd.) to measure the effectiveness of our marketing. These load only after you accept them in the cookie banner. For server-side conversion events, identifiers such as your email are cryptographically hashed before transmission. The mobile app does not use advertising cookies.

10. Community content

If you post in the community, your display name and the content you submit are visible to other members. You can report content or block other users in the app. You can delete your own posts, and deleting your account removes your posts (see section 12). We enforce a zero-tolerance policy for abusive, harassing or unlawful content.

11. Data retention

We store personal data only as long as necessary for the respective purposes or as required by statutory retention periods (in particular commercial and tax law, up to 10 years).

12. Account deletion

You can delete your account at any time in the app under Account, or by emailing robert@copypasteceo.com. Deletion permanently removes your profile and the content you created.

13. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Contact: robert@copypasteceo.com.

14. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

15. Children

Our service is not directed to children under 16. We do not knowingly collect personal data from children.

16. Encryption

This service uses SSL/TLS encryption to protect your data in transit.