Privacy Policy

GENERAL INFORMATION

About this Privacy Policy: This Privacy Policy (the “Privacy Policy”) governs the processing of personal data by MetricsNavigator (“MetricsNavigator”, “we”, “us”, or “our”). The Privacy Policy does not cover any third-party websites, applications, software, products, or services.

Our role as a data controller and data processor: We may act either as a data controller or a data processor. Our role depends on the specific situation in which personal data is handled by us, as explained in detail below:

Data controller: When we are the data controller, we determine the purposes and means of the processing of personal data. Hence, we are the controller when you send us an inquiry or conclude a service or employment contract with us. Situations when we are controller of personal data are further explained in this document. We comply with the data controller’s obligations set forth in the applicable laws.

Data processor: When we are the data processor, we process personal data on behalf of, and according to the instructions of, another organization that acts as the controller. This is the case, for example, when we process data that you connect to our services (such as data from your Google account) in order to provide the service to you. In these situations we process the data only to deliver and support the service, and we comply with the data processor’s obligations set forth in the applicable laws.

Minors: Our services are directed at businesses and are not intended for, or directed to, children. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us and we will take reasonable steps to delete such data.

Amendments: The Privacy Policy may be updated from time to time. If we change how we use personal data — including how we use Google user data — we will update this Privacy Policy, revise the “Current as of” date above, and, where required, notify you and request your consent before the new use takes effect. We encourage you to review our Privacy Policy periodically to stay informed.

WHAT PERSONAL DATA DO WE COLLECT AND FOR WHAT PURPOSES AND WHICH LEGAL BASES DO WE USE IT?

Personal data processed: We shall process the following personal data provided by you:

• Account information: When you register your user account, we collect personal data necessary in order to register you to our services, such as email address, name, company name, website URL, and your role in the company.
• Agreement related information: We shall process agreement-related information, such as service agreements or employment agreements, in connection with our business operations.
• Inquiries: When you contact us, we process information related to your inquiry such as your name, email address, and any information that you decide to include in your message.
• Payments: We might process payment information in connection with our business. However, please note that we do not process payments in connection with our service. It is done by our third-party payment processors Shopify and Stripe.

We shall observe the following information from the usage of our services:

• Usage data: When you use services provided by us, we may collect usage information such as registration log, login/logout, time stamps of usage activities, including how you open and close communication sent by us.
• Cookies: When you browse our websites, we collect your cookie-related data including advertising identifiers.

Legal basis: We use your personal data to provide you with the service and/or fulfil the contractual obligations. This requires us to process your above-mentioned personal data for customer/employment/partner relationship management, support, and communication, conducting customer surveys, customer complaint handling, maintenance, software and system updates, user identification, as well as for problem diagnosis and fixing. Hence, the above-mentioned processing of your personal data is based on your contract with us.

In addition, we use your above-mentioned personal data for the following purposes based on legitimate interests pursued by us:

• Analytics and development purposes, including creating aggregated groups based on your usage activities. This also enables us to understand our users’ needs as customers and to improve the quality and user experience of our current and future services and offerings.
• Marketing purposes, including communicating with you about our offerings, conducting sales promotions and other marketing campaigns, and creating aggregated target groups for marketing. Knowing customers’ preferences enables us to target our offerings and provide products and services that better meet the needs and expectations of our customers.
• Information and account security purposes, including detecting or preventing various types of misuse of services and fraud to provide you with secure and reliable services.

Electronic Direct Marketing and communication via email: We may send you electronic direct marketing, such as newsletters, promotions about new products, and information about user surveys and trials, by email. You can opt out of such electronic direct marketing or communication at any time free of charge by clicking the “unsubscribe” link included in our newsletters, adjusting the settings of your user account, or by contacting us directly.

Sensitive data: We do not collect or have access to any special categories of personal data as defined by Art. 9 of the GDPR (“sensitive data”) from you unless contractual obligations or mandatory legislation, such as employment legislation, requires us to process it. Sensitive data is information that is, for example, health-related data. If Your Data contains the said sensitive data, we will process such data for the purpose of fulfilling our contractual or legal obligations, such as regarding employment relationships.

GOOGLE USER DATA

Some MetricsNavigator features let you connect your Google account so that we can provide functionality within our application. This section describes specifically how MetricsNavigator accesses, uses, stores, and shares data obtained through Google APIs, and how that handling complies with Google’s policies. This section applies in addition to the rest of this Privacy Policy; where there is any conflict regarding Google user data, this section controls.

Google services and data we access: With your authorization through Google’s OAuth consent flow, MetricsNavigator may access the following Google user data to provide our features:

• Gmail — to read, compose, send, and/or organize email on your behalf in connection with the email and communication features of our service.
• Google Calendar — to read and/or manage calendar events in connection with scheduling and planning features.
• Google Drive — to read, create, and/or store files in connection with features that generate, save, or reference documents on your behalf.

We only request access to the Google data that is necessary for the features you choose to use, and we request access in context using Google’s incremental authorization. The specific scopes you are asked to grant are shown to you on the Google consent screen at the time you connect your account.

How we use Google user data: We use Google user data solely to provide and improve the user-facing features of MetricsNavigator that you have requested — for example, generating and sending email, referencing your calendar, or creating and storing documents in your Drive. We do not use Google user data for any purpose other than providing or improving these prominent, user-facing features, with your consent.

How we store Google user data: We treat all Google user data securely in transit and at rest (see “Data Security” below). We store Google user data only for as long as needed to provide the feature you are using and do not create permanent copies beyond what is necessary to provide the service. OAuth access and refresh tokens are stored in encrypted form.

How we share Google user data: We do not sell Google user data, and we do not share it with third parties except with service providers (sub-processors) that host or operate our infrastructure on our behalf under contractual data-protection obligations consistent with this Privacy Policy, or where required by law. We do not transfer Google user data to advertising platforms, data brokers, or information resellers.

Limited Use disclosure: MetricsNavigator’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, information received from Google APIs is not:

• used or transferred for serving advertisements, including retargeting, personalized, or interest-based advertising,
• sold or transferred to data brokers, information resellers, or other parties for their independent use,
• used or transferred to determine creditworthiness or for lending purposes,
• used to develop, train, fine-tune, or improve generalized or non-personalized artificial intelligence and/or machine-learning models, including large language models,
• read by humans, except (a) with your affirmative consent to view specific messages, files, or data; (b) where necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data is aggregated and anonymized and used only for internal operations.

Revoking access: You can revoke MetricsNavigator’s access to your Google account at any time by disconnecting the relevant Google integration in your MetricsNavigator account settings, or through your Google Account permissions page at https://myaccount.google.com/permissions. Revoking access stops further processing and, on request, we will delete Google user data associated with your account except where retention is required by law.

DATA SECURITY

We are committed to protecting the confidentiality, integrity, and availability of your personal data, including any Google user data. We maintain security procedures designed to protect your data against unauthorized or unlawful access, use, destruction, loss, alteration, or disclosure. These measures include:

• Encryption in transit and at rest: We use encryption (such as TLS) to protect data transmitted between you and our services, and we encrypt stored data, including OAuth tokens.
• Access controls: Access to personal data and Google user data is restricted to authorized personnel on a need-to-know basis and is governed by role-based access controls.
• Operational safeguards: We take reasonable and appropriate technical and organizational steps — including logging and monitoring of access, and security reviews of systems that handle user data — to protect the applications and systems that make use of Google APIs and any data derived from them.

No method of transmission or storage is completely secure, but we work to protect your data using appropriate safeguards and to promptly address any identified vulnerabilities.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

Retention of personal data: We store your personal data only for as long as such personal data is required for the purposes described in this Privacy Policy or until you request us to delete your personal data, whichever comes first. Google user data is retained only for as long as the relevant integration remains connected or as needed to provide the requested feature; upon disconnection or deletion, it is deleted in accordance with our standard retention and deletion procedures, except where retention is required by law. If you wish to know more about your rights, please see the “What rights do you have” chapter of this Privacy Policy.

HOW DO WE SHARE AND DISCLOSE YOUR DATA?

Location of personal data: We store your data in databases located in the USA.

Sharing of your personal data: We share your data in the following ways:

• Our third-party vendors: who provide us with cloud-based IT and business support as well as customer care services may need to process your information. All such third parties operate under contract and act on behalf of us. (Note: as described in the “Google User Data” section, Google user data is only shared with sub-processors that host or operate our infrastructure, and is never sold or shared for advertising.)
• Competent authorities: When required in response to a legal process or request from a competent authority according to applicable laws, or in connection with a legal proceeding or process.
• Mergers, acquisitions or sale of assets: When required as part of a merger, acquisition, sale of assets (such as service agreements), or transition of service to a group entity or another company.
• Third Party Advertising Platforms: When our digital marketing activities utilize third-party advertising platforms' features, we may target you by uploading your account information (e.g. a hashed email address or phone number) or advertising ID to such a platform. We may also use third-party tracking platforms, which collect data about how users interact with our ads for ads-attribution analysis and effect evaluation purposes. Such third parties operate under contract and act on behalf of us and include data transfers to partners located in the US. Google user data is never used for, or shared with, third-party advertising platforms.

International transfers: When transferring and disclosing your data outside the EU/EEA in the above-mentioned situations, where local law may not provide the same level of protection, we comply with applicable legal requirements for providing adequate safeguards to such transfer, e.g. by using the European Commission's Standard Contractual Clauses.

WHAT RIGHTS DO YOU HAVE WITH REGARD TO YOUR PERSONAL DATA?

Data Subject Rights: You have the right to control how your personal data is processed by us by exercising the rights listed below:

• Right of access: you can get a copy of your personal data that we store in our systems;
• Right to rectification: you can rectify inaccurate personal data that we process about you;
• Right to erasure (‘right to be forgotten’): you can ask us to erase your personal data;
• Right to restriction: you can ask us to restrict the processing of your personal data if:
  • your data is unlawfully processed, but you do not want to erase it;
  • you have a legal claim that you need to establish, exercise, or defend, and you requested us to keep your data when we would not keep it otherwise;
  • you have contested the accuracy of your personal data and its accuracy is pending our verification; or
  • your request for objection is pending our verification process;
• Right to data portability: you can ask us to provide you with a copy of your personal data in a structured, commonly used and machine-readable format;
• Right to object: you can ask us to object to processing of your personal data when processing is based on legitimate interest;
• Right to withdraw consent: you have the right to withdraw your consent, if you have provided one; or
• Right to complaint: you can submit your complaint regarding our processing of your personal data to the local data protection authority.

How to exercise your rights: If you would like to exercise any of your rights, please contact us by email at contact@metricsnavigator.ai and explain your request in detail. The scope of your right depends on the nature of the processing and the legal basis. In order to verify the legitimacy of your request, we may ask you to provide us with an identifying piece of information that allows us to identify you in our system. We will answer your request within a reasonable time frame but no later than one month.

CONTACT

If you have any questions about this Privacy Policy or our data protection practices, please contact us by:

Email: contact@metricsnavigator.ai