Privacy Policy

Effective Date: April 30, 2026

MetricMap (https://metricmap.tech) values your privacy. This policy explains how we collect, use, and protect your information.

1. Information We Collect

Personal Data

We collect email addresses when you sign up for a free account or subscription. This data is used to manage your account, communicate with you about service updates, billing, and provide access to our analytics platform.

If you choose to sign up using Google OAuth, we collect your name and profile picture from your Google account to personalize your experience.

Non-Personal Data

Through our analytics script, we collect non-personal data including:

Anonymized IP addresses (hashed, not stored in full)
Browser type and version
Device information (type, screen size)
User agent strings
Country and city location (derived from IP, not precise)
Page views and navigation patterns
Referrer information (where visitors came from)
Unique identifiers (anonymized, cookie-free)

This data is collected through our lightweight tracking script installed on your website and is used solely for analytics purposes.

2. Use of Information

Personal Data

Your email address and account information are used for:

Account management and authentication
Service-related communications (updates, maintenance, security alerts)
Billing and subscription management
Providing access to your analytics dashboard
Customer support and responding to your inquiries

Non-Personal Data

Non-personal data collected through our analytics script is used to:

Analyze website traffic and visitor behavior
Provide insights into marketing channel performance
Track conversions and revenue attribution
Generate reports and visualizations in your dashboard
Improve our analytics services and user experience

This data is used solely for analytics purposes and is never used for advertising, profiling, or sold to third parties.

3. Sharing of Data

We do not sell, trade, or share your email address or other personal data with third parties, except as necessary to:

Provide Services: We share data with trusted service providers who help us operate our platform:
- Supabase – Database hosting and authentication services
- Vercel – Frontend hosting and CDN
- Stripe – Payment processing (only billing information, not analytics data)
- Mapbox – Geographic mapping services for visitor location visualization
Comply with Legal Obligations: We may disclose data if required by law, court order, or government regulation.
Protect Rights and Safety: We may share data to protect our rights, property, or safety, or that of our users.

All service providers are contractually obligated to protect your data and use it only for the purposes we specify. For more details, please refer to our Data Processing Agreement.

4. Cookies and Tracking Technologies

MetricMap uses cookies and similar tracking technologies to track website usage and improve your experience. These technologies collect non-personal data, such as visitor activity, for analytics purposes.

Important: As a website owner using MetricMap, you are responsible for obtaining consent from your website visitors before collecting cookies or tracking data, as required by GDPR, ePrivacy Directive, and other applicable privacy laws. You must display a cookie consent banner on your website if you collect data through our script.

You can disable cookies in your browser settings, but doing so may limit your access to certain features of our platform. Our analytics script is designed to work without cookies when possible, using server-side session management instead.

5. Security

We take reasonable steps to protect your personal data and non-personal data from unauthorized access, disclosure, or misuse. Our security measures include:

Encryption in transit (HTTPS/TLS) for all data transmission
Encryption at rest for stored data
Row-Level Security (RLS) policies in our database to ensure data isolation
Regular security audits and updates
Access controls limiting data access to authorized personnel only
Secure hosting with reputable providers (Supabase, Vercel)

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. User Rights

Under GDPR and other applicable privacy laws, you have the following rights regarding your personal data:

Right of Access: You may request access to your personal data we hold.
Right to Rectification: You may request correction of inaccurate or incomplete data.
Right to Erasure: You may request deletion of your personal data.
Right to Restrict Processing: You may request that we limit how we process your data.
Right to Data Portability: You may request your data in a structured, machine-readable format.
Right to Object: You may object to certain types of data processing.

To exercise these rights, you can:

Contact us at our support page
Use the account deletion feature in your dashboard settings
Remove our tracking script from your website to prevent further non-personal data collection

We will respond to your requests within 30 days as required by GDPR.

7. Data Retention

Account Data: Your account information and personal data (email, name) are retained until you delete your account or request deletion.

Analytics Data: Visitor analytics data retention varies:

Free accounts – Analytics data may be deleted after extended inactivity (typically 90 days)
Subscribed accounts – Analytics data is retained for the duration of your subscription to provide historical insights
Upon account deletion – All associated analytics data is permanently deleted within 30 days

You can request immediate deletion of your data at any time through your account settings or by contacting support.

8. Children's Privacy

MetricMap is not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately so we can delete it.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and European Union. We ensure that such transfers comply with applicable data protection laws, including:

GDPR Standard Contractual Clauses where applicable
Our subprocessors' compliance with data protection regulations
Appropriate technical and organizational security measures

Supabase, our primary data processor, offers EU data residency options and maintains GDPR compliance. For more details, see our Data Processing Agreement.

10. Updates to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will notify you of any material changes via email to the address associated with your account. The "Effective Date" at the top of this page indicates when the policy was last updated.

11. Governing Law

This Privacy Policy is governed by and construed in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable.

Questions about this privacy policy?