PRIVACY

Privacy policy

Who processes what, for which purpose, on which legal basis and for how long — separately for this website and for the product.

NO LONGER CURRENT

This is the version of October 2, 2026. It is no longer current and is kept here unchanged so that it remains clear what was agreed under it.

Current version: October 17, 2026

01 / CONTROLLER

Who is responsible

The provider named in the legal notice is the controller for processing on this website. For the data collected in the product about visitors to our customers’ websites, that customer is the controller; there we act as a processor.

Controller: Kokolorum GmbH
Industriering Ost 66
47906 Kempen
Data protection officer: ePrivacy GmbH
vertreten durch Prof. Dr. Christoph Bauer und Stefanie Bauer
Bei den Mühren 5
20457 Hamburg
privacy@metrunio.com
Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf

02 / TWO ROLES

The distinction without which nothing adds up

Metrunio processes data in two separate roles. As controller for this website and for our customers’ accounts. As processor for the measurement data collected on our customers’ websites on their behalf — there the customer determines purpose and means, not us. The two roles carry different legal bases, recipients and retention periods, which is why they are described separately.

03 / THIS WEBSITE

What happens when you visit this site

What happens when you visit this site
Processing	Purpose	Legal basis	Retention
Server logs	Delivering the pages, defending against attacks	Art. 6(1)(f) GDPR (operation and security)	7 days, IP address truncated
Demo request	Handling your request and getting in touch	Art. 6(1)(b) GDPR (pre-contractual)	6 months after the enquiry is closed, or 6 months after receipt if it was never handled
Language choice	Showing the site in the chosen language	Art. 6(1)(f) GDPR, section 25(2) no. 2 TDDDG	12 months, on your device
Explainer videos	Showing how the product works	No access to your device; served from our own servers	not applicable
Newsletter	Sending the newsletter after a confirmed sign-up	Art. 6(1)(a) GDPR, § 7(2)(2) UWG (consent)	Until you unsubscribe; address, timestamp and a hash of the IP address then remain, suppressed, as proof of consent for three years (§ 195 German Civil Code) and are then deleted
Chat on this website	Answering your question from the help centre; a language model at Google Cloud (Vertex AI, region europe-west3) phrases the answer from the articles found. Email addresses, IBANs and phone numbers in the question and the conversation are masked beforehand; the model does not receive your email address. Handing it to a person where needed	Art. 6(1)(f) GDPR (information on request); (b) only where your request is itself a pre-contractual step. You may object under Art. 21 GDPR	Question, course of the case and any email address you give, 30 days after the last message; for a recurring support case, 365 days after the last message; earlier if you ask. If abuse is suspected, Google may keep input for up to 90 days
Enquiries by email to support@metrunio.com	Answering your enquiry. A language model at Google Cloud (Vertex AI, region europe-west3) phrases the answer from our help centre; email addresses, IBANs and phone numbers in the text are masked beforehand, and the model does not receive your sender address. Anything the help centre does not answer, or that concerns contract, price, law, complaints or security, is handled by a person	Art. 6(1)(f) GDPR (information on request); (b) where the enquiry concerns a contract with you. You may object under Art. 21 GDPR	6 months after the last message in the case; earlier if you ask. If abuse is suspected, Google may keep input for up to 90 days

Everything that happens when you visit this website is listed in full in the table above — and no third-party tool is among it. Our own product does not measure this site today; as soon as it does, it gets its own row there, with purpose, legal basis and retention period. There is no consent banner for as long as no row requires consent.

04 / ACCOUNT AND SIGN-UP

What happens to the details you give at sign-up

We process these details as a controller — they concern you as a customer, not the visitors to your website.

What happens to the details you give at sign-up
Processing	Purpose	Legal basis	Retention
Company name, your name, email address	Creating the account, signing in, invoicing, service notices	Art. 6(1)(b) GDPR (contract)	For the term of the contract, then per commercial retention periods
Password	Signing in	Art. 6(1)(b) GDPR (contract)	Stored only as an Argon2id hash; never in clear text, not even in logs
Your website address (optional)	Pre-filling the first website during setup	Art. 6(1)(b) GDPR (contract)	For the term of the contract
Email confirmation token	Proving the address is yours	Art. 6(1)(f) GDPR (preventing abuse)	7 days, after which the link expires
Log of administrative and security-relevant actions, including sign-ins	Accountability for security-relevant changes	Art. 6(1)(c) and (f) GDPR (accountability, security)	180 days, after which an entry is deleted automatically; at the latest with all account data 30 days after the end of the contract. Where a security incident is investigated, we secure the relevant extract separately until the investigation is closed
Billing address, VAT identification number, invoice and subscription status	Billing and invoicing through the payment service provider	Art. 6(1)(b) and (c) GDPR (contract, commercial and tax obligations)	Eight years after the end of the calendar year of the invoice — the period for accounting records since 2025 (§ 147(3) German Fiscal Code, § 257(4) Commercial Code); books and annual accounts ten years. The payment instrument itself is entered with the payment service provider; we never hold it
Login session and second factor	Staying signed in; protection against account takeover	Art. 6(1)(b) GDPR (contract); for the session cookie § 25(2)(2) TDDDG (strictly necessary)	Until you sign out or the session expires; revocable server-side at any time. The second-factor secret for as long as you leave it switched on
Time-limited support access to your tenant	Handling a request that cannot be resolved without looking — granted by you, not by us	Art. 6(1)(b) GDPR (contract)	Access ends with the period you set. The reason, the period and the actions taken remain in the log
Questions to the data assistant in the portal: your question, the conversation so far and the results of the reports queried for it	Answering your question with a language model at Google Cloud (Vertex AI, region europe-west3). Email addresses, IBANs and phone numbers in the question are masked beforehand; names are not. Order numbers and journey identifiers from your data only leave as codes that apply to this one request. Google does not use the input for training	Art. 6(1)(b) GDPR (contract), where you yourself are our contracting party and the answer is needed for the service requested; otherwise Art. 6(1)(f) GDPR (answering a question you asked while using the portal). You may object under Art. 21 GDPR	Not stored by us: the conversation lives only in your browser; each question carries at most the last twelve messages, and not earlier answers containing individual records. If abuse is suspected, Google may keep requests for up to 90 days and have them reviewed by authorised staff
Record of the conclusion of the contract: company and address, versions of the terms, privacy policy and data processing agreement, times, acting person (name, email address, role or Shopify ID), declaration of authority, origin and shop identifier; where concluded through the Shopify app, also a copy of the confirmation email we sent you (recipient, subject, text, time sent)	Retention of business letters (§ 257 German Commercial Code, HGB); proving who accepted which version on behalf of which company and when – including towards a supervisory authority (Art. 28(9) GDPR); establishing, exercising and defending legal claims	Art. 6(1)(c) GDPR in conjunction with § 257 HGB, to the extent the details must be retained as business letters; beyond that Art. 6(1)(f) GDPR (proof of the conclusion of the contract, legal defence)	During the contract with the account. After the contract ends only these details, kept apart from the deleted account: six years from the end of the calendar year in which the contract was concluded or the confirmation was sent (§ 257(4) and (5) HGB), but at least until the end of the third calendar year after the contract ends; then deleted automatically. Where they are needed for pending or specifically threatened litigation, until it is concluded

Setting up through the Shopify app

When you set up through our Shopify app, Shopify provides us with the shop data needed to link the account (the shop’s identifier, name, language, currency, time zone and domains), the shop owner’s name and email address as stored in the shop’s settings — that address becomes the account’s contact address — and the shop’s billing address. We merely propose the billing address as company name and address for the data processing agreement; what is stored is what the acting person confirms. From the person who operates the app and creates the account we receive their Shopify user ID, name, email address and whether Shopify identifies them as the shop’s owner. That person becomes the owner of the Metrunio account, and their details record who accepted the terms and conditions and the data processing agreement. We use this information to set up and manage the Metrunio account and to connect it to the shop.

Where the data subject is themselves a party to the contract and the processing is necessary, it is based on Art. 6(1)(b) GDPR. For contact persons of a company it is based on Art. 6(1)(f) GDPR; our legitimate interest lies in managing the business customer account and in communication for performing the contract. You may object to processing under point (f) on grounds relating to your particular situation (Art. 21 GDPR); your other rights are listed under “What you can ask for”. We keep this information like the account data in the first row of the table above: for the term of the contract, then per commercial retention periods. The record of acceptance and of the conclusion of the contract remains in minimised form after the contract ends for as long as the last row of the table states – as a rule six years after the year in which the contract was concluded (§ 257 HGB). If the owner’s address stored in the shop differs from the acting person’s address — for example because an employee or an agency set up the app — the shop owner receives this information by email under Art. 14 GDPR.

Signing in with Google Ads and Meta

When customers connect their ad account by signing in with Google or Meta, the platform gives us an access credential: a refresh token from Google, a long-lived access token from Meta. We store it encrypted (AES-256-GCM) and bound to the customer's workspace. It is never displayed or logged.

With this access we read from the selected ad account:

the list of accessible accounts with name, ID and currency, so the right one can be chosen;
cost, impressions and clicks per campaign and day.

If the customer turns on conversion upload, we also report conversions to their account. This sends the platform's click ID, the time, the value and the order number. For Google, this happens only when `ad_user_data` consent was granted. We do not change campaigns, ads, bids or budgets.

The data is used solely to show customers their own costs next to their own conversions and to report their conversions back to their own account. At the customer's request, the data assistant in the portal may read the same cost figures. It runs on Vertex AI in the europe-west3 region, and its inputs are not used to train models. We do not sell the data, share it with third parties, use it for advertising or combine it across customers.

Metrunio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If the connection is removed in Metrunio, we delete the credential immediately. Access can also be revoked at any time on the platform, at myaccount.google.com/permissions or under “Business integrations” in Meta's settings. Imported costs are kept for as long as the Metrunio account exists and are deleted with it. Deletion of individual data can be requested at any time at privacy@metrunio.com.

We do not use your account data for advertising and do not pass it to third parties other than processors acting for us. You can have your account deleted at any time; the measurement data of your tenant is deleted with it.

05 / IN THE PRODUCT

What Metrunio measures on our customers’ websites

Pseudonymous identifiers for session and device, where consent has been given.
Campaign, click and impression identifiers from creatives.
Event data such as page views, interactions and conversions with value and currency.
Truncated or hashed technical attributes; no storage of raw IP addresses.
No plain-text email addresses or phone numbers in analytics events; an event containing any is rejected.
The consent state is stored and evaluated with every event. Without matching consent no advertising event is stored — not even in raw form.
A view identifier for post-view: a cookie on our customer’s measurement address (`metrunio_view`, 30 days, for that address only) that the impression pixel and viewability tag set only with marketing consent and that the browser returns on a visit to the shop. If the browser drops it, nothing replaces it — no fingerprinting, no probabilistic matching. If the person withdraws marketing consent, the measurement address removes the cookie when the withdrawal is reported, and the script deletes the pseudonymous identifier and the session in the browser. Advertising contacts already recorded that are linked to that browser are deleted; any later consent starts without them.

The legal basis is the data subject’s consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG, obtained through our customer’s consent management platform. The retention period is set by the customer within their plan; the default is 180 days for raw data.

Reach measurement for visits without consent can no longer be switched on since 29 September 2026. For websites where our customer switched it on before then: no identifier is stored where consent is missing. All that is created is a reach count per day, website, channel and source, from which no person can be recognised; an access or erasure request finds nothing in it, because nothing in it is about a person. The legal basis is determined by our customer as controller; we process on their instruction. Sources with fewer than five views appear pooled rather than individually, and the count expires on the same schedule as the events.

If our customer reports orders and refunds server-side without consent, we store them without identifiers: order number, amount, currency and the day of the order without the time. This applies where no decision on consent was made and equally where consent was refused. Anonymous identifier, session, pseudonymous customer number, click identifier, IP attribute, page visited, campaign details and items are removed before storage; the order is not linked to any advertising contact and is not transmitted to any advertising platform. This also applies where the same order number was transmitted from a browser session with consent: there is no subsequent assignment via the order number. The legal basis is determined by our customer as controller; their legitimate interest in complete revenue figures may apply (Art. 6(1)(f) GDPR).

06 / PLACE OF PROCESSING

Where the data sits — and who can reach it from outside the EU

Application, database, analytics mirror and the language model behind the question feature in the portal run in the European Union, in region europe-west3 (Frankfurt). In each case the contracting party is a company established in the EU.

That alone would not be a complete answer. For administration and support, a group company of our provider can access the systems from outside the EU; the basis is the EU standard contractual clauses plus the adequacy decision. Which recipient processes where, who the contracting party is, and what access is possible, is stated per entry in the list of further processors.

07 / RECIPIENTS

Who sees the data besides us

We use service providers who run servers, deliver e-mail and process payments for us. The role in which they process is not the same everywhere — and that determines which contract applies and whose instructions they follow.

Processors under Art. 28 GDPR: operation of the application, mailbox and e-mail delivery. They process solely on instruction.
The payment provider in a dual role: for the contract data we pass on, it is a processor. For the payment itself it is an own controller — payment services law and anti-money-laundering law impose duties of its own, and whoever has duties of their own does not follow instructions in that respect.
Advertising platforms are not processors. They receive something only if our customer switches on conversion pushback, and then process as own or joint controllers for their own purposes.

We pass nothing to advertising platforms unless our customer explicitly switches on conversion forwarding. Even then, only the identifiers that came from that platform are returned.

Documents for your review

08 / YOUR RIGHTS

What you can ask for

Access to the data processed about you (Art. 15 GDPR).
Rectification of incorrect data (Art. 16 GDPR).
Erasure (Art. 17 GDPR).
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR).
Objection to processing based on legitimate interests (Art. 21 GDPR).
Withdrawal of consent with effect for the future (Art. 7(3) GDPR).
Complaint to a supervisory authority (Art. 77 GDPR).

If your request concerns measurement data from one of our customers’ websites, please address it to that customer — they are the controller there. We support them: the product has its own area for access, erasure and objection, and an erasure keeps working through a suppression list so the same identifier is not collected again a minute later.

09 / WHAT WE DO NOT DO

Explicitly excluded

No fingerprinting through device characteristics.
No probabilistic matching.
No linking across tenant boundaries.
No sale and no disclosure for our own advertising purposes.
No storage of raw IP addresses.

10 / STATUS

Status of this text

As of 2 October 2026

The description of the processing matches what the software does. If a processing operation changes, a new version of this notice is published with a new date; earlier versions remain available under their date.

Changes to this statement appear in the changelog under Status.

11 / VERSIONS

All versions

Every version stays available under its date, permanently and unchanged; the confirmation email sent after a contract is concluded in the portal or through the Shopify app links to these addresses, and the portal keeps the agreed wording itself.