Encryption at rest
Database and analytics storage are encrypted at rest. Credentials live in a dedicated secret store, not in configuration files. No open network is authorised to reach the database, and it accepts encrypted connections only.
PRIVACY & SECURITY
Privacy & security
What Metrunio does with measurement data and what it does not, who to contact and where the documents are. The technical detail follows.
01 / AT A GLANCE
The essentials first.
- Measurement happens only with matching consent. Without it, Metrunio stores no marketing event, not even raw. The exception: orders your server reports without consent count towards revenue, without attribution.
- No fingerprinting, no raw IP addresses. Measurement data is pseudonymous. Metrunio rejects detected email addresses and phone numbers; other personal data does not belong in event fields in the first place.
- The measurement data is stored in the EU, in Frankfurt. Which other sub-processors are involved, and where, is in the sub-processor list. For your visitors’ measurement data, Metrunio acts as a processor.
- You handle access, erasure and objection requests in the portal; every case is logged.
- Data travels encrypted and is stored encrypted, and the database is backed up every night. The details are in the technical and organisational measures.
02 / CONTACTS
Who you can ask.
- Privacy and data subject requests
- privacy@metrunio.com
- Reporting vulnerabilities
- support@metrunio.com
- Contracts and data processing
- support@metrunio.com
03 / DOCUMENTS
To read before you sign.
The data processing agreement, technical and organisational measures, sub-processor list and deletion concept are under Documents. You conclude the data processing agreement electronically in the portal or in the Shopify app; until then Metrunio accepts no data for your account.
DocumentsWhich data is processed for what: the full table
NOTE
This description does not replace legal advice. How you use Metrunio on your website is for you, as the controller, to review with your own data protection adviser.
04 / OUR OWN MEASUREMENT
How we measure ourselves.
This website measures nothing today: it loads no measurement script, not even our own, and so shows no consent banner. If we measure it with Metrunio, it will only be with your consent, and this section will then say what is counted.
05 / ARCHITECTURE
Technical principles.
- Consent state and purpose are stored and evaluated per event.
- Without matching consent no marketing event is stored, not even raw.
- No fingerprints, no circumvention of browser protections.
- No raw IP addresses. Pseudonymous measurement data; event fields are not meant to hold plain-text names or contact details. Detected email addresses and phone numbers cause the event to be rejected; the automatic check does not detect every kind of personal data.
- User identifiers are pseudonymised per account.
- Configurable retention; access, erasure and objection handled in the portal.
- Separation of client accounts additionally enforced by row-level security in the database.
- Signed tracking elements, no open redirect, replay protection.
- Two-step verification with an authenticator app or a passkey, available on every account; a passkey also signs in without a password; API keys with an expiry date.
06 / DATA SUBJECT RIGHTS
Access, erasure, objection: inside the product.
Privacy requests are handled in the portal, not by ticket. Every case is logged and the person is looked up via a pseudonymous identifier.
07 / OPERATIONS
Encryption and backups.
As of 12 October 2026. The full description is in the technical and organisational measures under Documents.
Encryption in transit
Every public address runs over TLS. There is no unencrypted route into the application.
Backups
The database is backed up every night. In production the backups are kept for two weeks, and recovery to any point in time within the last seven days is set up as well. Deletions also reach the analytics storage.
Recovery
A new version can be rolled back to the previous one. Database changes add first and remove only once the new version is running.
WHAT GOES TO A LANGUAGE MODEL
The question feature in the portal passes your question and the results of the reports it queried to a language model in Frankfurt. It receives figures from your account and, where the question calls for it, individual conversions or journeys: at most 300 rows per question, no raw events. Order numbers and journey identifiers from your data only leave as codes, and orders without consent never leave individually. Email addresses, phone numbers and IBANs in your question are replaced before it is passed on. The provider processes the input as a processor and does not use it to train its models. Before returning an answer, the portal checks that every number in it appears in the queried results; if one is missing, the answer is not returned. The check covers where each number comes from, not how it is interpreted. The details are in the privacy policy.
The chat on this website is separate: it reads no measurement data, answers questions from the help centre and hands everything else to a person. What is stored is the question, the course of the conversation and, if you give it, your email address, so an answer can reach you. It is deleted 30 days after the last message, a year later for a recurring support case, or earlier if you ask. Details in the privacy policy.
DATA SOURCES
Metrunio looks up the country of a visit in web analytics in a local file from DB-IP (“IP to Country Lite”, licensed under CC BY 4.0) once the country view is switched on. The IP address is not passed to anyone for this; only the country code is stored.
INFRASTRUCTURE AND ACCESS FROM OUTSIDE THE EU
Metrunio runs on Google Cloud in the Frankfurt region (europe-west3). The application, database and analytics store are located there. The contracting party is Google Cloud EMEA Limited in Dublin. The location says where the data is kept, not on its own which law the provider is subject to: Google belongs to a US group, and its group companies may also be bound by the law of third countries. The exception is parts of the system logs, which Google keeps in global buckets; the subprocessor list names them.
Against access from outside the EU, including by public authorities, the same applies to all data in your account, personal or not: it is encrypted at rest and in transit, the database is not authorised for any open network, and credentials are kept in a separate secret store. Google group companies outside the EU may access it for maintenance and support; this is covered by the data processing terms with Google, the EU standard contractual clauses and, for recipients in the US that take part in the EU-US Data Privacy Framework, the adequacy decision. Article 28 of the EU Data Act requires this information.
REQUESTS FROM AUTHORITIES OUTSIDE THE EU
If an authority or court outside the EU demands data in your account from us, we check whether the request is lawful and whether that body has jurisdiction. An order that is binding in a third country is not enough on its own. We disclose data only to the extent permitted under Union law and the applicable national law, and only what the order strictly requires; for non-personal data we examine in particular the conditions of Article 32 of the EU Data Act. If a request appears unlawful to us, we challenge it. We inform you beforehand as far as the law allows.
Encryption at rest uses keys managed by Google. It protects the storage, but does not rule out that Google itself accesses the data, for example because Google receives an order. We do not use keys of our own outside Google.