aim-to-pace.ai
DEENITFRES

Privacy Policy

Preamble

With the following privacy policy we would like to inform you about the types of your personal data (hereinafter also referred to as "data") we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").

This privacy policy applies to aim-to-pace.ai including all subdomains and all products published under this brand, including the browser extension Pace Prepped Prompts (PPP) and the personality test ego-check (ego-check.aim-to-pace.ai).

The terms used are not gender-specific.

Last updated: October 31, 2026

Table of Contents

Controller

Andreas Schnorr
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany

Email address: info@aim-to-pace.ai

Legal notice: https://aim-to-pace.ai/en/imprint/

Overview of Processing Operations

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of Data Processed

Categories of Data Subjects

Purposes of Processing

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Applicability of data protection regulations in the country of domicile: In the country in which the controller is domiciled, national data protection regulations apply in addition to the General Data Protection Regulation (GDPR).

Provision of your data: There is no statutory obligation to provide us with personal data. Without processing your IP address, the website cannot be delivered technically. To make a purchase, you must provide your email address; without it, our Merchant of Record cannot process the purchase. All other information is voluntary.

International Data Transfers

Data processing in third countries: Insofar as we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies (which is evident from the postal address of the respective provider or where the privacy policy expressly refers to a data transfer to third countries), this is always done in accordance with the statutory requirements.

Depending on the provider, we base transfers to the USA on the adequacy decision for the EU-US Data Privacy Framework (DPF, Article 45 GDPR) or on Standard Contractual Clauses (Article 46(2)(c) GDPR). Which basis applies is stated for the respective provider.

For the individual service providers, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, appropriate safeguards apply, in particular Standard Contractual Clauses, explicit consent or transfers required by law.

General Information on Data Retention and Deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or there are no further legal bases for the processing. This concerns cases in which the original purpose of processing ceases to apply or the data are no longer required. Exceptions to this rule exist where statutory obligations or particular interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or the storage of which is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Where several indications of the retention period or deletion deadlines of a piece of data exist, the longest period is always decisive.

Rights of Data Subjects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

Right to Object (Article 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. To do so, write to info@aim-to-pace.ai.

Provision of the Online Offer and Web Hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

Further information on processing operations, procedures and services:

Tools in the Browser

At your request, the website stores your language choice in your browser's local storage (localStorage). The tools on aim-to-pace.ai (including hushlock, Light Planner, OG Studio, Icon-Mergerator, PPTX Asset Extractor, howto-pad) process inputs and files exclusively in your browser; none of this is transmitted to us or to third parties. For the functions you use, individual pages store settings and work in progress locally (localStorage, IndexedDB); for offline use, hushlock stores its program files in the browser cache (service worker). This storage is strictly necessary for the function you have requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)), remains on your device and can be deleted via your browser settings. The microphone and clipboard are used only upon your action and with your permission, and only locally.

howto-pad. howto-pad stores guides and settings locally in your browser (localStorage, IndexedDB). If you embed images, videos or audio in a guide via a web address, the browser of every person who opens the guide loads this content directly from the respective third-party server; that server's operator receives the IP address and technical browser data in the process. We are not involved in this retrieval. howto-pad does not embed videos from YouTube or Vimeo, nor other web pages: they appear as a link card and open in a new tab only when you click them.

Sale of Digital Products and License Keys

We process our customers' data in order to enable them to purchase and use our digital products (downloadable software/tools). The contract is concluded and payment is made via our Merchant of Record (see the section "Payment Procedure"). From the Merchant of Record we receive the data required for order fulfilment, in particular your email address and order data (where applicable, name and country as well as an order or transaction reference).

After a successful purchase, our infrastructure automatically generates an individual license key. This is triggered by a notification from our Merchant of Record about the completed purchase; the key is generated by a server-side function (Cloudflare Workers) of our processor Cloudflare (see the section "Provision of the Online Offer and Web Hosting"). Your email address is technically embedded in the license key; this serves the recovery of lost keys (key recovery).

Your license key is displayed to you immediately after purchase on the confirmation page of our website; we do not send an email at purchase. You can request your key again at any time via a self-service function on our website by entering the email address used at purchase (key recovery). If a purchase exists for that address, we send the key by email to that address; the email is sent via our email service mailbox.org. The website gives the same response in every case, so it is not possible to tell whether a purchase exists for an address. To prevent misuse, we send no more than three emails to the same address within 24 hours; for this we store only a hash of the address, which expires after 24 hours. No user account is required.

To protect against abusive mass requests, we count the requests per IP address for purchase, discount-code and recovery requests. For this purpose, the IP address is held in a Cloudflare cache (Workers KV) for up to 10 minutes and then deleted automatically (Article 6(1)(f) GDPR). To match purchases, we additionally store the Merchant of Record's customer number.

Creem's checkout script (www.creem.io) is loaded only when you click a purchase button; Creem then receives your IP address and technical browser data (Article 6(1)(b) GDPR).

Where the Merchant of Record's checkout provides for this, we additionally record at purchase the consent you give there to the immediate provision of the digital content (proof under § 356(6) no. 2 of the German Civil Code (BGB)). We store this proof together with the other license data (legal bases: Article 6(1)(c) or (f) GDPR).

The license keys we generate — including the email address embedded in them — and the associated order reference are stored in a database operated by our service provider Cloudflare; processing may also take place in the USA (see the sections "Provision of the Online Offer and Web Hosting" and "International Data Transfers"). We store license data until the end of product maintenance (EOL) of PPP plus three years. Because the email address is technically embedded in license keys that have already been delivered, we cannot subsequently remove it from the keys in your possession. Upon your request, we erase the copy stored by us, unless its storage is necessary for the establishment, exercise or defence of legal claims or on account of statutory retention obligations.

The extension itself verifies your license exclusively locally on your device and does not connect to our servers or third-party servers for this purpose. Server contact occurs only at purchase (display of the key on the confirmation page) and on optional re-retrieval (key recovery).

Selected text and "Send to LLM". The extension stores prompts, collections and settings exclusively locally in your browser. It reads text you have selected on a web page only when you trigger it (right-click menu or keyboard shortcut), and only in the active tab; the text is processed locally in your browser. A prompt — including any selected text — leaves your browser only when you send it with "Send to LLM", and then exclusively to the AI chat site you have added yourself. The extension asks for access to that site when you add it and gives the access back when you remove the site again. We receive none of this. The operator of the chat site is responsible for the processing there; its privacy policy applies.

Personality Test ego-check

At ego-check.aim-to-pace.ai we offer a personality test based on the public-domain IPIP-NEO-120 questionnaire. The test is an entertainment and self-reflection offering; it is built so that as little data as possible arises:

Local processing. Answering the questions, calculating the results and the free short evaluation take place entirely in the browser on your device. Your individual answers and results are stored in your browser's local storage (localStorage) and do not leave your device. There is no user account, no registration and no collection of names or email addresses. Cookies and tracking or analytics tools are not used.

AI-assisted evaluation (Anthropic). Only if you request a written interpretation does the application transmit aggregated metrics of your result (levels of the five traits and their facets as a band and a score, response-behaviour ratios, test length) to our server (Cloudflare Worker) and from there to our processor Anthropic for the generation of the evaluation text by the AI model "Claude". For customers in the European Economic Area, the contracting entity under Anthropic's Commercial Terms is Anthropic Ireland, Limited (Ireland); processing takes place on infrastructure operated by Anthropic, PBC (548 Market Street, San Francisco, California, USA), which also issues the invoices. A transfer to the USA therefore takes place. No individual answers, no name, no email address and no identifier are transmitted to Anthropic; the metrics cannot be attributed to any person by Anthropic. The purchase identifier or the invitation code is sent only to our server, which uses it to verify access. The application shows you verbatim what exactly will be transmitted before it is sent.

Legal bases for the processing: performance of the contract concluded via Creem for the ordered evaluation or, for invitation codes, of the free use (Article 6(1)(b), alternatively (f) GDPR) and your explicit consent, which you give before the transmission (Article 6(1)(a), Article 9(2)(a) GDPR). The AI-assisted evaluation requires a minimum age of 16.

Basis for the transfer to the USA: the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), which form part of the data processing agreement concluded with Anthropic. Anthropic is not certified under the EU-US Data Privacy Framework (as at 17 September 2026).

Retention at Anthropic: according to its own statements, Anthropic deletes inputs and outputs within 30 days. They are retained for longer only where an automated safety system detects a possible violation of the usage policies (inputs and outputs then for up to two years, the associated classification scores for up to seven years), or where required by law. Under the Commercial Terms applicable to us, they are not used to train the models.

Server processing (Cloudflare). Our evaluation server runs as a Cloudflare Worker (see the section "Provision of the Online Offer and Web Hosting" — Cloudflare is already described there as a processor). The Worker stores no content; IP addresses are counted only briefly for rate limiting. It keeps an anonymous counter (monthly cost total), a usage counter per invitation code — pseudonymous, because we hand out invitation codes personally — and, if you purchase an evaluation, a purchase entitlement: the checksum (SHA-256) of a purchase identifier generated at random in your browser, the purchased tier, the number of evaluations generated, and the version and time of the consent text you confirmed. It contains neither a name nor an email address nor an order number and is deleted automatically 30 days after the last purchase. Creem receives the same checksum as well as the version and time of the consent as order details; to confirm the purchase, our server retrieves the order from Creem and stores only the tier and the counters from it. As the infrastructure operator, Cloudflare processes IP addresses for transport purposes. To protect the purchase process against mass automated requests, our server counts how often the same IP address sends purchase requests (rate limiting via a Cloudflare function); the counter expires after one minute, and the IP address is neither stored nor logged.

Paid evaluations (Creem). The purchase of an evaluation is handled — like our other digital products — via the Merchant of Record Armitage Labs OÜ (trading as "Creem", Tallinn, Estonia); the section "Payment Procedure" applies. Payment data remains with Creem. The purchase identifier serves only to check whether payment has been made; it is not stored together with the metrics and is not transmitted to Anthropic. The evaluation itself knows neither your name nor your email address. If you opened ego-check via a discount link, the application asks our server once, when the page loads, what Creem has on record for this discount code; only the code is transmitted, and the request is subject to the same rate limiting as purchase requests.

Gift links. Anyone who gives a Pro evaluation as a gift buys a link from Creem. In doing so, the browser generates a random gift identifier. When the checkout is set up and for status queries, only its checksum (SHA-256) is sent to our server and to Creem; for confirmation and redemption, the browser transmits the identifier to our server, which uses it only to calculate the checksum and does not store it. After payment, our server creates a gift entitlement: the checksum, the tier, the version and time of the confirmed purchase text, the Creem order number and the expiry date. We need the order number to ask Creem, at the time of redemption, whether the payment has been refunded; we delete it upon redemption. After that, the entitlement only records that it has been redeemed — not when and not by whom. It is deleted at the latest on the expiry date (31 December of the third year after the purchase). Anyone who opens a gift link sends only the checksum, so that we can show whether the link is still valid. On redemption, the recipient's browser generates its own purchase identifier; from then on, the same applies to the recipient as after a purchase (purchase entitlement, 30 days) — with the recipient's own consent to the transfer to Anthropic (Article 9(2)(a) GDPR). We store no connection between the gift and the recipient's identifier. Checking and redeeming a gift link are subject to the same rate limiting as purchase requests. Our server receives no names, email addresses or messages when a gift is given; the giver's email address is collected by Creem (see the section "Payment Procedure"). A gift card (names, message, design) is created exclusively in the giver's browser and does not reach us; a draft remains in the giver's browser storage until it is deleted. Legal basis for the gift entitlement: performance of the contract with the giver (Article 6(1)(b) GDPR).

Payment Procedure

We process sales and payments via a Merchant of Record (MoR). The MoR acts as the seller (reseller) towards you; the contract relating to payment is concluded with the MoR. The MoR processes the payment and billing data under its own responsibility, remits value added tax, handles fraud prevention as well as refunds and chargebacks, and issues your payment receipt. With respect to these processing activities, we and the MoR are independent controllers. Insofar as the MoR additionally processes data on our behalf, a data processing agreement is in place for that purpose.

As Merchant of Record we use: Armitage Labs OÜ, trading as Creem, Telliskivi 57b/1, 10412 Tallinn, Estonia (company number 16977866). For purchases from Germany or the EU, Armitage Labs OÜ is your contractual partner for the purchase. Creem's privacy information can be found at: https://www.creem.io/privacy.

From the MoR we receive the data required for order fulfilment, order processing, fraud prevention and product support, in particular your email address and your order data. We use this data exclusively for the purposes stated; we use it for marketing only where you have separately consented to this.

Third-country transfer: Armitage Labs OÜ is established in Estonia and therefore within the European Union; processing by the MoR itself takes place within the EU/EEA. Insofar as the MoR engages sub-processors outside the EU/EEA, such transfers are to be safeguarded under its data processing agreement by appropriate measures within the meaning of Chapter V GDPR (in particular EU Standard Contractual Clauses or an adequacy decision). For details and the current list of sub-processors, please refer to Creem's privacy information and data processing agreement: https://www.creem.io/dpa.

Newsletter (Substack)

Our newsletter is published on the Substack platform (Substack Inc., 548 Market St PMB 72296, San Francisco, CA 94104, USA). No sign-up form is embedded on this website; we link to aimtopaceai.substack.com, where sign-up takes place under Substack's privacy policy. As the publisher, we receive the subscribers' email addresses as well as open and click statistics and use them exclusively for sending and managing the newsletter (Article 6(1)(a) GDPR). Substack is certified under the EU-US Data Privacy Framework (Article 45 GDPR). Data are stored until you unsubscribe; you can withdraw your consent via the unsubscribe link in every email.

Instagram Presence

We operate the Instagram profiles @aimtopaceai_de and @aimtopaceai_en. Instagram is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). When you visit or interact with our profiles, Meta processes your data in accordance with its own terms: https://privacycenter.instagram.com/policy/. In doing so, Meta also compiles statistics on the use of our profiles (Insights), which are made available to us in aggregated form; for this processing, we and Meta are joint controllers (Article 26 GDPR). Under the agreement with Meta, Meta assumes primary responsibility, in particular for fulfilling your rights; Meta makes the essence of the agreement available at: https://www.facebook.com/legal/terms/page_controller_addendum. In this context, a transfer to the USA may take place. We use messages you send us via Instagram only to reply to them.

Use of Cookies

The term "cookies" refers to functions that store information on users' devices and read information from them. Cookies may also be used for various purposes, e.g. for the functionality, security and comfort of online offers as well as the creation of analyses of visitor flows. We use cookies in accordance with the statutory provisions. Where necessary, we obtain the prior consent of users. Where consent is not necessary, we rely on our legitimate interests. This applies where the storage and reading of information is essential in order to provide expressly requested content and functions. This includes, for example, the storage of settings as well as ensuring the functionality and security of our online offer.

This website sets cookies in only one case: a technically necessary cookie of our CDN provider Cloudflare (__cf_bm) to defend against automated attacks. No other cookies, in particular for tracking, analysis or marketing purposes, are used. For the local storage of your language choice, settings and work in progress in your browser, see the section "Tools in the Browser".

Changes and Updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or any other individual notification.

Insofar as we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time and we ask you to verify the information before contacting them.

Definitions of Terms

In this section you will find an overview of the terms used in this privacy policy. Insofar as the terms are legally defined, their legal definitions apply. The following explanations, on the other hand, are primarily intended to aid understanding.

The legally binding German original was created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke.