Privacy Policy

Last updated: 21 October 2026

This policy explains which personal data the Measrtag web application (“Measrtag”, “we”) processes, in particular the data we receive from Google when you sign in with Google, connect Google services to Measrtag or grant your agency access through our client access page, what we use it for, and how you can remove it. Section 8 covers the Measrtag MCP connector for AI applications such as Claude and ChatGPT.

1. Controller

Lukas Esser, Measrment – operator of Measrtag
Dorfstraße 18c, 51515 Kürten, Germany
E-mail: admin@measrtag.com
Further details: Legal Notice

2. Data we receive from Google

Sign in with Google

Scopes openid, email, profile. We receive your name, e-mail address, profile picture and a Google account identifier. We use them only to create and secure your Measrtag account and to show who is signed in.

Google Analytics (scope analytics.readonly)

We read the list of Google Analytics accounts and properties you have access to, the configuration of the property you select (data streams, events, conversions, custom definitions, settings) and aggregated report data (for example sessions, events and revenue per day or channel). We use this data only to run the GA4 audit you start and to show you its results.

Google Analytics user management (scope analytics.manage.users)

This permission is used for exactly two purposes:

• GA4 audit. When you start an audit, Measrtag adds its own audit service account to the selected property with the role Analyst, so that the audit can read the property. When the audit is finished, Measrtag removes exactly this entry again.
• Client access page. When you grant your agency access (see “Client access page” below), Measrtag adds the e-mail addresses your agency named to the accounts or properties you select, with the role shown to you before you confirm.

Measrtag does not change or remove any other user, and it does not store the list of your property's users.

Client access page — granting your agency access

An agency that uses Measrtag can send you a link to a page on connect.measrtag.com (or on the agency's own domain). There you sign in with Google once and choose what your agency may access. Depending on what the agency requested, Measrtag asks for:

• Google Analytics (analytics.readonly, analytics.manage.users): we list the accounts and properties you manage so you can choose, and add the agency's addresses to the ones you select.
• Google Tag Manager (tagmanager.readonly, tagmanager.manage.users): we list the accounts and containers you manage so you can choose, and add the agency's addresses with the permission shown to you.
• Google Ads (adwords, read only on this page): you invite the agency yourself in Google Ads; we then read the account's users and pending invitations to confirm that the invitation exists.
• Google Merchant Center (content, read only, only where it is offered): as for Google Ads, we read the account's users to confirm your invitation.

This page uses online access only: Google issues no refresh token. The access token is stored encrypted for at most one hour and is deleted when you complete the page, when Google reports it invalid or when you sign in again. Your agency sees which accounts were shared and with which role, never your Google token.

Google Ads (scope adwords)

We read the Google Ads accounts you have access to and, for the accounts you connect, campaign structure, performance metrics (impressions, clicks, cost, conversions) and conversion settings. We use this data only to show you reports and tracking checks in Measrtag. Measrtag does not create, change or delete campaigns, budgets, ads or any other object in your Google Ads account.

Google Ads conversions from the Measrtag Tag Manager (scope datamanager)

If you set up the Measrtag Tag Manager to send conversions to Google Ads, Measrtag sends the conversion events of your website to your Google Ads account through Google's Data Manager API: time, value, currency and order ID, the ad click identifiers (gclid, gbraid, wbraid), the visitor's consent status and, where your tag configuration provides them, SHA-256-hashed e-mail addresses or phone numbers. Nothing is read from Google Ads with this permission.

Google Calendar (scopes calendar.freebusy, calendar.events, calendar.calendarlist.readonly)

If you connect your calendar to a Measrtag booking page, we read when you are busy (start, end and whether you accepted an event) so that only free slots are offered, list your calendars so you can choose which ones count, and create, update or cancel the event for each booking made through your booking page. For your other appointments we do not read titles, descriptions or attendees.

Google Sheets (scopes drive.file, spreadsheets.readonly)

If you connect a spreadsheet (for example to import costs), Measrtag reads only the spreadsheet you choose, and creates or writes only spreadsheets that Measrtag created for you. We do not access any other file in your Google Drive.

3. Limited Use of Google user data

Measrtag's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not sell Google user data and do not use or transfer it for advertising, including retargeting or personalized ads.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• We do not transfer Google user data to third parties, except to the service providers listed in section 5 that host and operate Measrtag on our behalf, where required by law, or as part of a merger or acquisition with prior notice to you.
• No person at Measrtag reads Google user data unless you ask us to for support, it is needed for security purposes or to comply with the law, or the data has been aggregated and anonymized for internal operations.

4. Storage and security

Access and refresh tokens issued by Google are stored encrypted (AES-GCM) on our own servers and are only used by the Measrtag back end. Data is transmitted over encrypted connections (TLS). Our servers are located in the European Union (Germany and Finland).

5. Service providers

• Hetzner Online GmbH, Germany — server hosting (Germany, Finland).
• BunnyWay d.o.o., Slovenia — content delivery network for the web application.
• Sendinblue GmbH (Brevo), Germany — sending account e-mails.

All providers act on our instructions under a data processing agreement.

6. Retention and deletion

• Google tokens are kept until you disconnect the Google connection in Measrtag or delete your account; then they are deleted.
• On the client access page the Google token is kept for at most one hour and deleted when you complete the page.
• The audit service account is removed from your GA4 property when the audit ends.
• Audit results and reports are kept as long as your account exists, and deleted with it.

You can revoke Measrtag's access at any time at myaccount.google.com/permissions. To delete your account and all data, write to admin@measrtag.com.

7. Legal basis and your rights

We process this data to perform our contract with you (Art. 6(1)(b) GDPR) and, for security logs, based on our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR). You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

8. Measrtag MCP connector for AI applications

The Measrtag MCP connector is the server at https://data.measrtag.com/mcp with its sign-in under https://data.measrtag.com/oauth. AI applications such as Claude, ChatGPT or Claude Code use it to read your Measrtag data when you ask them to. The connector only reads: it does not create, change or delete anything in Measrtag or in your advertising accounts.

What the connector collects

• Sign-in and consent. You sign in to Measrtag as usual, including your second factor, and approve the connection. We store the connection: the application's client ID and name as it registered, the address it returns to, the account and properties you selected, the scope read, who approved it and when, and when it was last used. Access and refresh tokens are stored only as SHA-256 hashes.
• Who connected (OpenID Connect). Some applications (ChatGPT) ask to know who connected them, using the scopes openid and email. The consent page names this before you approve. The application can then ask our UserInfo endpoint for a pseudonymous identifier, which is different for every application, and, with email, the e-mail address of your Measrtag login and whether it is confirmed. Nothing else about you is returned. Applications that ask only for read (Claude) receive neither.
• Tool calls. For every call that reads data we record the time, account, property, credential ID, the API route and dataset, the file format, the response status, the duration and the number of rows returned. We do not record the arguments of a call (such as the fields or date range asked for) and not the figures returned.
• Network data. The IP address of the calling service (for Claude and ChatGPT these are servers of Anthropic and OpenAI) is used in memory to enforce rate limits and to slow down repeated failed sign-ins. The connector keeps no access log with IP addresses.
• Exports. If the AI application starts an export, the file with the query result is stored for 24 hours and its status for 7 days.

The connector does not receive your conversation with the AI application, your prompts, files, memory or the results of other tools. It sees only the tool calls the application sends, with their arguments.

What it returns and how we use the data

The tools return figures from the data sources you connected to Measrtag (for example advertising platforms, your shop and web analytics), aggregated by day, campaign, product or a similar grouping, and the settings of your properties. They return no names, e-mail addresses or order numbers of your customers. Data classes your account restricts (for example revenue) stay hidden for the connection exactly as for the person who approved it. We use the data above to answer the tool calls you started, to show and revoke your connections (Art. 6(1)(b) GDPR), and to protect the service, enforce limits and bill the Data API by usage (Art. 6(1)(b) and (f) GDPR). For the marketing and shop data of your account we act as your processor under the data processing agreement of your Measrtag contract. We do not sell this data, do not use it for advertising and do not use it to train AI models.

Who receives it

Tool results go to the AI application that called the tool, because you asked it to. What that provider (for example Anthropic for Claude or OpenAI for ChatGPT) does with them is governed by your agreement with that provider and its privacy policy. Otherwise only the service providers in section 5 process the data on our behalf; data.measrtag.com is delivered through the content delivery network of BunnyWay d.o.o.

How long we keep it

• A connection lasts until you revoke it or the person who approved it leaves the account. A client that registered itself and has not been used for 90 days is deleted together with its revoked connections.
• Authorization codes expire after 5 minutes, access tokens after 60 minutes and refresh tokens after 30 days; each refresh replaces the refresh token.
• Records of single calls are deleted after 400 days, daily totals per credential after 800 days.
• Export files are deleted after 24 hours, their status after 7 days.
• Approving and revoking a connection is written to the security log of your account, which owners and admins see in the app.

Revoke a connection at any time in the app under Settings › API keys › Connected apps; it stops working immediately. An account admin can switch off all external MCP clients under Settings › Security › Integrations and AI. Questions: admin@measrtag.com.

9. Shopify stores

When a merchant connects a Shopify store, the merchant is the controller and Measrtag processes the data on the merchant's behalf under our data processing agreement (Art. 28 GDPR).

What we receive

• Orders: order and line item IDs, amounts, currency, taxes, discounts and discount codes, refunds and returns, fulfilment status and tracking numbers, the market, delivery country and region.
• Products, variants, inventory and locations; payment disputes where Shopify Payments is used.
• Customers: the Shopify customer ID, number of orders, creation date, language and marketing consent status. We do not read customers' names, e-mail addresses or street addresses from the Shopify Admin API.
• Customer events from our Shopify web pixel. Contact details in these events (e-mail, phone, name, city, postcode, country) are hashed (SHA-256) in the shopper's browser before they reach us.
• We no longer collect the shopper's IP address with orders (since 10 October 2026); previously stored IP addresses have been deleted.

Forwarding on the merchant's instruction

If the merchant sets up server-side destinations in Measrtag (for example Klaviyo), the order notification's contact details (e-mail, phone, name, address) are passed through to these destinations. They are held only encrypted in a delivery queue (at most 4 hours, or 72 hours for failed deliveries) and are not stored otherwise.

Retention, deletion and data requests

• Order data is kept for up to 7 years for commercial record-keeping and deleted earlier when the merchant disconnects the store or deletes the account (after a 29-day grace period).
• Shopify shop deletion requests (shop/redact) are carried out within 30 days: order data and all information about that store's customers are deleted across our tables, including attribution and identity records derived from it. Only figures without any reference to a person (such as daily totals of revenue and costs) are kept.
• Shopify customer deletion requests (customers/redact) are carried out within 30 days across all our tables that hold data about that customer.
• Shopify customer data requests (customers/data_request) are made available to the merchant in Measrtag within 30 days.
• Access tokens are stored encrypted (AES-GCM) and deleted when the store is disconnected.

10. Import from Klar (browser extension “Measrtag Connect”)

Merchants moving from Klar can import their Klar setup into Measrtag. The merchant is the controller; Measrtag processes the data on the merchant's behalf. Measrtag is not affiliated with Klar Insights GmbH.

• The extension runs in the merchant's own browser and acts only on app.getklar.com. In the merchant's Klar account it creates a read-only API key named “Measrtag” and reads the settings pages (for example data sources, costs, channels, stores). It does not collect browsing history and does not act on any other website.
• Redaction: e-mail addresses, phone numbers, bank and card numbers and postal addresses are removed in the browser before anything is sent to Measrtag. The Klar user list is not read.
• What reaches Measrtag: the API key (stored encrypted), the redacted settings as suggestions for the merchant to confirm, and technical run reports (which step succeeded, without page content).
• Help with unfamiliar pages: if the extension cannot find an element because Klar has changed its page, it sends the list of page elements (role, label and visible text, already redacted in the browser) to Measrtag. Measrtag checks it for personal data again and has it evaluated by an AI model from Anthropic PBC, acting as our sub-processor, which only suggests the next action. Measrtag does not store the list, and Anthropic does not use it to train its models. The merchant agrees to this in the extension before the first run.
• With the API key Measrtag reads the merchant's reports from Klar's API: daily reference figures and attribution per order, to reproduce the merchant's history and to check our figures against Klar's.
• Deletion: after the import the extension revokes the API key in Klar, and Measrtag deletes its encrypted copy once Klar confirms the key is no longer valid. Imported data is kept as long as the merchant's account exists and deleted with it.

11. Import from Admetrics (browser extension “Measrtag Connect”)

Merchants moving from Admetrics can import their Admetrics settings into Measrtag with the same extension. The merchant is the controller; Measrtag processes the data on the merchant's behalf. Measrtag is not affiliated with Admetrics GmbH.

• The extension acts only on datasource.app.admetrics.io, while the merchant is signed in there. Using the merchant's own session it reads a fixed list of settings, read-only: payment fees, the cost-of-goods fallback, logistics costs and shipping regions, recurring expenses, the Google Sheets linked as data sources, and channel rules. It changes nothing in Admetrics and does not act on any other website.
• The Admetrics session stays in the browser. The sign-in token is used only inside the page and is never sent to Measrtag.
• Redaction and allowlist: only the fields Measrtag needs leave the browser. Expense titles in the category “employees” are replaced by “Personal 1, 2 …”, so no names travel with salaries. The Admetrics team list and user accounts are not read.
• What reaches Measrtag: the filtered settings as suggestions for the merchant to confirm (unambiguous ones are applied automatically and can be undone), and technical run reports without page content.
• Deletion: nothing is stored in Admetrics, so nothing needs revoking there. Imported settings are kept as long as the merchant's account exists and deleted with it.

12. Changes

We will update this page when our processing changes. The date at the top shows the current version.