Encryption at rest
Database and analytics storage are encrypted at rest. Credentials live in a dedicated secret store, not in configuration files. No open network is authorised to reach the database, and it accepts encrypted connections only.
PRIVACY & SECURITY
Privacy & security
What Metrunio does with measurement data and what it does not, who to contact and where the documents are. The technical detail follows.
01 / AT A GLANCE
The essentials first.
- Measurement happens only with matching consent. Without it, Metrunio stores no marketing event, not even raw. The exception: orders your server reports without consent count towards revenue, without attribution.
- No fingerprinting, no raw IP addresses. Measurement data is pseudonymous. Metrunio rejects detected email addresses and phone numbers; other personal data does not belong in event fields in the first place.
- The measurement data is stored in the EU, in Frankfurt. Which other sub-processors are involved, and where, is in the sub-processor list. For your visitors’ measurement data, Metrunio acts as a processor.
- You handle access, erasure and objection requests in the portal; every case is logged.
- Data travels encrypted and is stored encrypted, and the database is backed up every night. The details are in the technical and organisational measures.
02 / CONTACTS
Who you can ask.
- Privacy and data subject requests
- privacy@metrunio.com
- Reporting vulnerabilities
- support@metrunio.com
- Contracts and data processing
- support@metrunio.com
03 / DOCUMENTS
To read before you sign.
The data processing agreement, technical and organisational measures, sub-processor list and deletion concept are under Documents. You conclude the data processing agreement electronically in the portal or in the Shopify app; until then Metrunio accepts no data for your account.
DocumentsWhich data is processed for what: the full table
NOTE
This description does not replace legal advice. How you use Metrunio on your website is for you, as the controller, to review with your own data protection adviser.
04 / OUR OWN MEASUREMENT
How we measure ourselves.
This website measures nothing today: it loads no measurement script, not even our own, and so shows no consent banner. If we measure it with Metrunio, it will only be with your consent, and this section will then say what is counted.
05 / ARCHITECTURE
Technical principles.
- Consent state and purpose are stored and evaluated per event.
- Without matching consent no marketing event is stored, not even raw.
- No fingerprints, no circumvention of browser protections.
- No raw IP addresses. Pseudonymous measurement data; event fields are not meant to hold plain-text names or contact details. Detected email addresses and phone numbers cause the event to be rejected; the automatic check does not detect every kind of personal data.
- User identifiers are pseudonymised per account.
- Configurable retention; access, erasure and objection handled in the portal.
- Separation of client accounts additionally enforced by row-level security in the database.
- Signed tracking elements, no open redirect, replay protection.
- Two-step verification with an authenticator app or a passkey, available on every account; a passkey also signs in without a password; API keys with an expiry date.
06 / DATA SUBJECT RIGHTS
Access, erasure, objection: inside the product.
Privacy requests are handled in the portal, not by ticket. Every case is logged and the person is looked up via a pseudonymous identifier.
07 / OPERATIONS
Encryption and backups.
As of 12 October 2026. The full description is in the technical and organisational measures under Documents.
Encryption in transit
Every public address runs over TLS. There is no unencrypted route into the application.
Backups
The database is backed up every night. In production the backups are kept for two weeks, and recovery to any point in time within the last seven days is set up as well. Deletions also reach the analytics storage.
Recovery
A new version can be rolled back to the previous one. Database changes add first and remove only once the new version is running.
WHAT GOES TO A LANGUAGE MODEL
The question feature in the portal passes your question and the results of the reports it queried to a language model in Frankfurt. It receives figures from your account and, where the question calls for it, individual conversions or journeys: at most 300 rows per question, no raw events. Order numbers and journey identifiers from your data only leave as codes, and orders without consent never leave individually. Email addresses, phone numbers and IBANs in your question are replaced before it is passed on. The provider processes the input as a processor and does not use it to train its models. Before returning an answer, the portal checks that every number in it appears in the queried results; if one is missing, the answer is not returned. The check covers where each number comes from, not how it is interpreted. The details are in the privacy policy.
The chat on this website is separate: it reads no measurement data, answers questions from the help centre and hands everything else to a person. What is stored is the question, the course of the conversation and, if you give it, your email address, so an answer can reach you. It is deleted 30 days after the last message, a year later for a recurring support case, or earlier if you ask. Details in the privacy policy.