Privacy statement

1. Who we are

Metrara is part of Goldcompass, based in Dordrecht, the Netherlands, Chamber of Commerce 87161079, VAT NL004366990B11.

For questions about this statement or about your data: privacy@metrara.com.

2. Two roles, two responsibilities

This distinction shapes the rest of this statement, so we're putting it first.

For our own customer administration we are the data controller. That covers your account details, your billing and the support we give you. We decide why and how we process those.

For the marketing data you connect we are a processor. Your analytics, search console, advertising, webshop and social data remains yours. We process it solely on your instructions. We enter into a data processing agreement with you for this; it's available on request at privacy@metrara.com.

Are you an agency connecting your own clients' accounts? Then you are the controller or processor towards them, and we are your sub-processor.

3. What data we process

• Account details. Name, email address, company name, phone number (optional), your password in encrypted form, language preference and settings.
• Billing details. Billing address, VAT number, invoice history and your subscription. We don't process payment details ourselves: your bank account or card details go straight to Mollie and never enter our systems.
• Usage data. Login times, browser type, which sections you use, and error messages. Metrara does not store IP addresses itself. Our hosting providers process IP addresses briefly in their security logs; we cannot disable those logs and do not use them.
• Connected marketing data. Connected marketing data. Website traffic statistics, keywords and rankings, advertising performance, orders and revenue, product data, reach and engagement on social channels (Instagram, LinkedIn and TikTok), and email campaign statistics. This concerns aggregated figures and not, in principle, personal data of your own end customers.
• Website chat conversations. We keep the content of conversations with our website assistant for 180 days, without linking personal data to them. A visitor's IP address is used only briefly, in server memory, to limit abuse, and is not stored.

4. Why, and on what legal basis

Purpose	Legal basis
Providing the service	Performance of the contract
Billing and administration	Legal obligation
Support and service communication	Performance of the contract
Security and abuse prevention	Legitimate interest
Improving the service using aggregated data	Legitimate interest
Newsletter and product updates	Consent

5. Google API Services and limited use

What we access

• Google Analytics (read-only): website traffic, channels, pages and conversions.
• Google Search Console (read-only): search queries, clicks, impressions and positions.
• Google Ads: campaign, keyword and cost figures. Only requested if your business advertises.
• Google Merchant Center: product and listing status. Only requested for webshops.
• Your Google email address: to show which account is connected.

How we store and protect it

Access tokens are stored encrypted. Data retrieved from Google is stored in the European Union and separated per organisation at database level. Only you and the team members you invite can see it.

Who we share it with

To generate summaries, rankings and advice shown in your dashboard, we send aggregated figures derived from Google data to Anthropic (Claude). Anthropic does not use this data to train models. We do not share Google data with any other party, except the hosting and database providers listed in section 7.

Disconnecting and deletion

When you disconnect Google in Metrara, we immediately delete the access token and the connected email address, and stop retrieving data. Figures already retrieved remain visible in your dashboard until you ask us to delete them or end your subscription; after termination they are deleted within 90 days. You can request deletion of your Google data at any time via privacy@metrara.com; we delete it within one month. You can also revoke Metrara's access at

https://myaccount.google.com/permissions.

Metrara uses Google APIs to read data from Google Analytics, Search Console, Google Ads and Merchant Center.

Metrara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In concrete terms, this means we do not:

• use data from Google APIs for anything other than providing features visible within your dashboard;
• transfer that data to third parties, except where necessary to provide the service, to comply with the law, or with your express consent;
• use or transfer that data for advertising purposes;
• allow humans to read that data, except with your express consent, for security purposes, to comply with the law, or in aggregated and anonymised form;
• use that data to train generalised AI or machine learning models.

All Google connections are read-only. Metrara never changes anything in your Google accounts. You can revoke access at any time through your Google account settings.

For Google Ads and Merchant Center, Google offers no read-only permission scope. You therefore grant broader permission than is technically needed. We use that permission solely to read.

6. TikTok

When you connect a TikTok account, Metrara reads your profile name, follower count, total likes and the figures of your own videos (views, likes, comments and shares) through TikTok's official interface. We use this data only to show it in your dashboard and to keep a history of these figures from the moment you connect. We do not post on your behalf and do not share this data with third parties, except the hosting and database providers listed under Processors. Access tokens are stored encrypted. You can disconnect in Metrara at any time; you can also revoke Metrara's access in the TikTok app under Settings and privacy, Security, Apps and services.

7. LinkedIn

When you connect LinkedIn, you sign in with a LinkedIn account that is an administrator of one or more company pages. Metrara then reads, through LinkedIn's official interface:

• the list of company pages you administer, so you can choose which page belongs to which business in Metrara. We only store the page you choose;
• statistics of the chosen company page: followers and new followers, page views, impressions, clicks and engagement;
• the page's own posts, with their text, date and statistics.

We do not read your personal LinkedIn profile, your connections or your messages, and we do not post, comment or change anything on LinkedIn.

We use this data only to show it in your dashboard, to keep a history of these figures from the moment you connect, and, when you ask for it, to generate an analysis of your posts. For that analysis we send the post texts and their statistics to Anthropic (Claude); see AI processing.

An agency can connect LinkedIn for the pages it manages. A client of an agency can also connect their own LinkedIn account; that connection is used only for the client's own businesses, and the client only sees their own pages.

Access tokens are stored encrypted and are used only on our servers. We do not share LinkedIn data with third parties, except the hosting and database providers and Anthropic as listed under Processors.

You can disconnect in Metrara at any time: under Manage for an agency, or under Connections for a client. We then immediately delete the access token and stop retrieving data. Figures already retrieved remain visible until you ask us to delete them or end your subscription; after termination they are deleted within 90 days. You can also revoke Metrara's access in LinkedIn under Settings & Privacy, Data privacy, Permitted services.

8. AI processing

Metrara uses AI to rank and summarise figures, and to draft concepts for blogs, mailings and reports.

All figures are calculated in code from the source systems. AI does not calculate figures and does not invent them.

For these features we use Claude, provided by Anthropic. We send aggregated marketing data, and no personal data of your end customers. Anthropic does not use data sent through its API to train models.

9. Processors and sub-processors

We work with the following parties:

• TransIP - Hosting of metrara.com - Netherlands
• Vercel - Hosting of the dashboard application - EU region, US parent company
• Supabase - Database, file storage and authentication - EU region, US parent company
• Mollie - Billing and collection - Netherlands
• Resend - Transactional and service email - United States
• Anthropic (Claude) - Generating texts, summaries and advice - United States

For search volumes, rankings, competitor data and backlink data we also use specialised data providers. We send these parties only keywords, domain names and URLs, never personal data. They are therefore not processors of your data.

When adding or replacing a sub-processor we inform you in advance, so you can object.

10. Hosting and transfers outside the EU

Your data is stored within the European Union. Our website runs at TransIP in the Netherlands; the dashboard application runs on Vercel's EU infrastructure, with the database and file storage at Supabase in the EU. Data is separated per organisation at database level.

Vercel and Supabase are US companies. While your data is processed and stored in the EU, access from the United States cannot be entirely ruled out on a technical level.

Our email delivery runs through Resend in the United States, which involves processing email addresses and message content.

For our AI features we send aggregated marketing data to Anthropic in the United States.

Transfers to these parties are based on an adequacy decision or the European Commission's Standard Contractual Clauses, supplemented with appropriate additional measures.

11. How long we keep data

• Account details - For the term of your subscription
• Customer data after termination - 90 days, then automatic and irreversible deletion
• Invoices and administration - 7 years (statutory retention)
• Website chat conversations - 180 days
• Log data at our hosting providers - Per their policy, typically a few days

12. Security

We take appropriate technical and organisational measures, including encrypted connections, encrypted storage of passwords and access tokens, separation of data per organisation at database level, role-based access restrictions, and access logging.

In the event of a data breach posing a risk to individuals, we report it to the Dutch Data Protection Authority within 72 hours and inform you without delay.

13. Your rights

You have the right to access, correct, delete, restrict processing of, object to, and port your data. Send a request to privacy@metrara.com; we respond within one month.

If your request concerns data we process as a processor on behalf of your own client, we refer you to the data processing agreement.

You may lodge a complaint with the Dutch Data Protection Authority.

14. Cookies

On metrara.com we place functional cookies necessary for the site to work, and analytical cookies to measure usage. We ask for consent before placing non-essential cookies.

Within the dashboard itself we place only functional cookies needed to keep you logged in and to remember your preferences.

15. Changes

We may update this statement. We announce material changes in advance by email or within the service. The current version is always available at metrara.com.

This is a translation. In the event of any discrepancy, the Dutch version prevails.