Privacy policy

The provider named in the legal notice is the controller for processing on this website. For the data collected in the product about visitors to our customers’ websites, that customer is the controller; there we act as a processor.

Controller

Kokolorum GmbH
Industriering Ost 66
47906 Kempen

Data protection officer

heyData GmbH
Schützenstraße 5
10117 Berlin
www.heydata.eu
datenschutz@heydata.eu

Contact for data protection matters

privacy@metrunio.com

Competent supervisory authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf

Metrunio processes data in two separate roles. As controller for this website and for our customers’ accounts. As processor for the measurement data collected on our customers’ websites on their behalf — there the customer determines purpose and means, not us. The two roles carry different legal bases, recipients and retention periods, which is why they are described separately.

Art. 6(1)(b) GDPR applies only where you yourself, as a natural person, are our contracting party and the processing is necessary for the contract. Where you act for a business, for example as managing director, employee or appointed agency, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in setting up and managing the business customer account, sign-in and the security of your access, billing and communication for performing the contract. You may object to processing under point (f) on grounds relating to your particular situation under Art. 21 GDPR.

Setting up through the Shopify app

When you set up through our Shopify app, Shopify provides us with the shop data needed to link the account (the shop’s identifier, name, language, currency, time zone and domains), the shop owner’s name and email address as stored in the shop’s settings — that address becomes the account’s contact address — and the shop’s billing address. We merely propose the billing address as company name and address for the data processing agreement; what is stored is what the acting person confirms. From the person who operates the app and creates the account we receive their Shopify user ID, name, email address and whether Shopify identifies them as the shop’s owner. That person becomes the owner of the Metrunio account, and their details record who accepted the terms and conditions and the data processing agreement. We use this information to set up and manage the Metrunio account and to connect it to the shop.

Where the data subject is themselves a party to the contract and the processing is necessary, it is based on Art. 6(1)(b) GDPR. For contact persons of a company it is based on Art. 6(1)(f) GDPR; our legitimate interest lies in managing the business customer account and in communication for performing the contract. You may object to processing under point (f) on grounds relating to your particular situation (Art. 21 GDPR); your other rights are listed under “What you can ask for”. We keep this information like the account data in the first row of the table above: for the term of the contract, then per commercial retention periods. The record of acceptance and of the conclusion of the contract remains in minimised form after the contract ends for as long as the last row of the table states – as a rule six years after the year in which the contract was concluded (§ 257 HGB). If the owner’s address stored in the shop differs from the acting person’s address — for example because an employee or an agency set up the app — the shop owner receives this information by email under Art. 14 GDPR.

Signing in with Google Ads and Meta

When customers connect their ad account by signing in with Google or Meta, the platform gives us an access credential: a refresh token from Google, a long-lived access token from Meta. We store it encrypted (AES-256-GCM) and bound to the customer's workspace. It is never displayed or logged.

With this access we read from the selected ad account:

• the list of accessible accounts with name, ID and currency, so the right one can be chosen;
• cost, impressions and clicks per campaign and day.

If the customer turns on conversion upload, we also report conversions to their account. This sends the platform’s click ID, the type, time, value and currency of the conversion, depending on the platform an event ID that lets the platform recognise duplicate reports (Meta, TikTok, LinkedIn), the order number (Google, Meta, TikTok) and the address of the page on which the click landed (Meta, TikTok). As the value we send the revenue of the conversion or, if the customer sets this for a destination, for orders the contribution margin (net value minus cost of goods). If the customer limits a destination to first orders, it reports only those; the platform thereby learns indirectly that an order was a first order. We do not send email addresses, phone numbers, IP addresses, browser attributes or our own personal or device identifiers. Reports are sent only with marketing consent, and for Google additionally only with `ad_user_data` consent or the consent category the customer has mapped to it. We do not change campaigns, ads, bids or budgets.

The data is used solely to show customers their own costs next to their own conversions and to report their conversions back to their own account. At the customer's request, the data assistant in the portal may read the same cost figures. It runs on Vertex AI in the europe-west3 region, and its inputs are not used to train models. We do not sell the data, use it for advertising or combine it across customers. We share it with third parties only if the customer connects an AI tool or program to her account and thereby instructs us to transfer her data to it (see “Connecting AI tools from other providers”).

Metrunio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If the connection is removed in Metrunio, we delete the credential immediately. Access can also be revoked at any time on the platform, at myaccount.google.com/permissions or under “Business integrations” in Meta's settings. Imported costs are kept for as long as the Metrunio account exists and are deleted with it. Deletion of individual data can be requested at any time at privacy@metrunio.com.

Connecting AI tools from other providers

If you connect an AI tool from another provider to your account via the consent page in the portal, for example Claude by Anthropic or ChatGPT by OpenAI, or if you create a read key, this tool or program receives a continuing read authorization for the account's measurement data. Within the authorization granted, the connected tool can request data for your analyses; it decides which requests to make as part of its own processes. Only the account's administrators can grant access or create keys, and only after a notice explaining what the authorization means.

Available are metrics and breakdowns, including ad costs imported from Google Ads, Meta and other connected ad accounts, individual conversions with time, value and the order number in plain text, and pseudonymous customer journeys with identifier, times and channels. Metrics are aggregated; conclusions about individual transactions may nevertheless be possible. The connection does not return names, email addresses, IP addresses, browser identifiers, click identifiers of the ad platforms or the pages visited. Orders without tracking consent appear only as a count.

We release the measurement data of our customers' visitors and buyers as a processor on our customer's instruction; our customer, as the controller, determines the legal basis for this transfer. The provider of the tool is not our sub-processor. It processes the data it retrieves under the terms of the account our customer holds with it, possibly also outside the European Union. Our customer ensures the contract with the provider, any data processing agreement that is required and the conditions for transfers to third countries; our own obligations as a processor remain. We are the controller for the details of the authorization itself; they are listed in the table above.

The specific safeguards of our data assistant in the portal do not apply to this connection: order numbers and journey identifiers are not replaced by short codes, the limit on individual rows per question does not apply, and storage, training and deletion at the provider are governed by its terms, not those of Google Cloud for Vertex AI.

You can disconnect an authorization at any time in the portal under “Exports & AI connections”; you also revoke a read key there. From its next request on, the tool then receives no more data. Disconnecting does not delete data the tool has already retrieved at the provider; that depends on your contract with it.

Partners recommend Metrunio and receive a commission for it. From partners who are natural persons and from contact persons of a partner company we process name, address, email address for billing, tax number or VAT identification number, tax status and the date of the partner agreement, together with the net amount paid and the month of payment for each referred customer. The purpose is assigning referred customers to the partner, calculating the commission, issuing the self-billed credit note (section 14(2) sentence 2 UStG) and bookkeeping.

The legal basis is Art. 6(1)(b) GDPR (partner agreement); for contact persons of a partner company Art. 6(1)(f) GDPR (performing the partner agreement with the company; you may object under Art. 21 GDPR); for retention Art. 6(1)(c) GDPR in conjunction with section 147 AO and section 257 HGB. We keep credit notes as accounting records for eight years from the end of the calendar year; master data until the end of the partnership and beyond for as long as a credit note naming it must be kept. Recipients are our tax adviser and, for operations, the processors listed under “Recipients”.

If a customer registers with a partner’s referral code, we store with the account which partner it is assigned to and, for the commission, the amounts paid per month. The partner receives no breakdown by customer: their credit note states only the total and the number of customers for each commission rate. With small groups, for example where only one customer falls under a commission rate, conclusions about the amount of individual customers may be possible. The legal basis is Art. 6(1)(f) GDPR (settling the partner programme); the amounts per customer are kept as the basis of the credit note for as long as the credit note itself.

• Pseudonymous identifiers for session and device, where consent has been given. Before the decision in the consent banner the script keeps events only in the page’s memory; after consent it sends them with that consent, after a refusal or when the page is left it discards them.
• Campaign details from creatives. Individual click and impression identifiers, our own as well as the advertising platforms’ (such as gclid or fbclid), only with marketing consent; with consent to statistics only, all that remains is which platform a click came from.
• Event data such as page views, interactions and conversions with value and currency.
• Truncated or hashed technical attributes; no storage of raw IP addresses.
• No plain-text email addresses or phone numbers in analytics events. Events rejected on receipt (invalid format, a time outside the permitted window, or an email address or phone number in plain text) are not stored. For troubleshooting we record only the reason for rejection, time, source, website, event type and the names of the affected fields with the type and length of the value, no field contents and no identifiers. These details are deleted with our customer’s raw-data retention period (default 180 days).
• The consent state is stored and evaluated with every event. Without matching consent no advertising event is stored, not even in raw form; all that is recorded, without any identifier, is that an event was not stored for this reason.
• A view identifier for post-view: a cookie on our customer’s measurement address (`metrunio_view`, 30 days, for that address only). It is set only with marketing consent, by the impression pixel and viewability tag on the advertising site or by the measurement script in the shop; the browser returns it on a visit to the shop. If the browser drops it, nothing replaces it: no fingerprinting, no probabilistic matching. If the person withdraws marketing consent, the measurement address removes the cookie when the withdrawal is reported; if they withdraw consent entirely, the script also deletes the pseudonymous identifier and the session in the browser. Advertising contacts already recorded that are linked to that browser are deleted; any later consent starts without them.
• For orders a shop reports with consent, a pseudonymous customer identifier: the shop’s customer number or a checksum (SHA-256) of the email address, as transmitted by our Shopify app and our Shopware plugin. On receipt we combine each of these values with a key that differs for every customer and store only the result; the same person yields two different values at two customers. The identifier links purchases by the same person across devices and is not transmitted to any advertising platform.
• A redirect for clicks on creatives: our measurement address forwards to our customer’s website. Without a consent signal from the advertising site it appends only the campaign identifier to the target address (`metrunio_camp`, the same for all clicks of a campaign) and stores no click; all that is recorded, without any identifier, is that a click was not stored for this reason.

The legal basis for identifiers and events from the browser is the data subject’s consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. On our customer’s website their consent management platform obtains it. For advertising contacts on third-party websites the delivering ad server transmits the consent signal; we receive no separate proof of it. Where our customer uploads conversions from a file, they state for each row the source, time and a reference to proof of consent; we check these details for completeness and contradictions, not the consent itself. Without consent only what the following paragraphs describe takes place; the legal basis for it is determined by our customer as controller. The retention period is set by the customer within their plan; the default is 180 days for raw data.

A withdrawal in the consent banner applies to the browser in which it is declared. If the person withdraws only marketing consent, we delete that browser’s advertising events and the advertising contacts linked to it and remove click and impression identifiers from its remaining events; whatever rests on consent to statistics remains. If they withdraw entirely, we delete all events of that browser, including orders the shop reported with its identifier. Reports to advertising platforms not yet transmitted are stopped. Those already transmitted are held by the platform and we cannot recall them; we name the recipients to our customer so that they can meet their duty to inform them under Art. 19 GDPR. We store the consent state with the time of withdrawal against the browser’s pseudonymous identifier as proof that the withdrawal has been carried out and to reject later events from that browser; it remains until our customer’s website or account is deleted. A withdrawal in the banner is not a request under Art. 15 to 21 GDPR: anyone seeking access, erasure of all data about them on all devices or an objection should address our customer, who implements it in the product’s privacy area.

Reach measurement for visits without consent can no longer be switched on since 29 September 2026. For websites where our customer switched it on before then: no personal or device identifier is stored where consent is missing. Each view creates an event with time, page without query string, page title, referring origin and campaign details, which is condensed into a count per day, website, channel and source. Neither the event nor the count contains an identifier through which an access or erasure request could find a person. The legal basis is determined by our customer as controller; we process on their instruction. Sources with fewer than five views appear pooled rather than individually, and events and counts expire on the same schedule as other raw data.

If our customer’s shop reports orders and refunds server-side without consent to tracking, we process them on the customer’s behalf solely for revenue reconciliation: matching their revenue, recognising duplicate transactions and assigning refunds. This purpose is separate from tracking. For it we store the order number as the necessary order key, the type of transaction, amount, currency and the day of the order without the time, but no browser, customer or advertising identifiers: anonymous identifier, session, pseudonymous customer identifier, click identifier, IP attribute, page visited, campaign details and items are removed before storage. The data generally remains personal data because our customer can assign the order number to a person. The order is not linked to any visit or advertising contact and is not transmitted to any advertising platform. The only exception applies where our customer has switched it on separately: if you consented in the same checkout to tracking measurement whose scope includes linking orders to visits and advertising contacts, and that consent already existed at the time of purchase, we link the order to your visit on that basis. For this we additionally process a checksum of the checkout identifier and the exact time of the order, for no longer than 24 hours. If you withdraw your consent, we delete the link and the order. This applies where no decision on consent was made and the shop therefore transmits none. Where the shop transmits a refusal, it applies only if our customer has given us a separate instruction for it; without that instruction we do not store such an order. The legal basis is determined by our customer as controller; their legitimate interest in complete revenue figures may apply (Art. 6(1)(f) GDPR). Our customer is to inform about this processing, its legal basis and how to object in their own privacy notice. Refusing tracking is not in itself an objection to revenue reconciliation. Please address an objection under Art. 21 GDPR to our customer; if they implement it in the product’s privacy area, we delete the data relating to your order and block the order number for further transmissions. Withdrawing your consent to tracking means that orders transmitted with that consent are deleted; they are not transferred into revenue reconciliation.

Application, database, analytics mirror and the language model behind the question feature in the portal run in the European Union, in region europe-west3 (Frankfurt). In each case the contracting party is a company established in the EU.

That alone would not be a complete answer. For administration and support, a group company of our provider can access the systems from outside the EU; the basis is the EU standard contractual clauses plus the adequacy decision. Which recipient processes where, who the contracting party is, and what access is possible, is stated per entry in the list of further processors.

We use service providers who run servers, deliver e-mail and process payments for us. The role in which they process is not the same everywhere — and that determines which contract applies and whose instructions they follow.

• Processors under Art. 28 GDPR: operation of the application, mailbox and e-mail delivery. They process solely on instruction.
• The payment provider in a dual role: for the contract data we pass on, it is a processor. For the payment itself it is an own controller — payment services law and anti-money-laundering law impose duties of its own, and whoever has duties of their own does not follow instructions in that respect.
• Advertising platforms are not processors. They receive something only if our customer switches on conversion pushback, and then process as own or joint controllers for their own purposes.

We pass nothing to advertising platforms unless our customer explicitly switches on conversion upload. Even then the only identifiers sent are that platform’s own click IDs, not our own personal or device identifiers. What else is transmitted is described above under “Signing in with Google Ads and Meta”.

Documents for your review

• Access to the data processed about you (Art. 15 GDPR).
• Rectification of incorrect data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR).
• Objection to processing based on legitimate interests (Art. 21 GDPR).
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR).
• Complaint to a supervisory authority (Art. 77 GDPR).

If your request concerns measurement data from one of our customers’ websites, please address it to that customer — they are the controller there. We support them: the product has its own area for access, erasure and objection, and an erasure keeps working through a suppression list so the same identifier is not collected again a minute later.

• No fingerprinting through device characteristics.
• No probabilistic matching.
• No linking across tenant boundaries.
• No sale and no disclosure for our own advertising purposes.
• No storage of raw IP addresses.

Changes to this statement appear in the changelog under Status.

Every version stays available under its date, permanently and unchanged; the confirmation email sent after a contract is concluded in the portal or through the Shopify app links to these addresses, and the portal keeps the agreed wording itself.

• Version of October 17, 2026 · current
• Version of October 16, 2026
• Version of October 15, 2026
• Version of October 14, 2026
• Version of October 13, 2026
• Version of October 12, 2026
• Version of October 11, 2026
• Version of October 10, 2026
• Version of October 7, 2026
• Version of October 4, 2026
• Version of October 3, 2026
• Version of October 2, 2026
• Version of October 1, 2026
• Version of September 30, 2026
• Version of September 26, 2026
• Version of September 25, 2026
• Version of September 24, 2026