Privacy Policy

1. Who is responsible

The controller of your personal data is J. P. Wallman Media Group LTD, a company registered in Cyprus under number HE 485002, with its registered office at Charilaou Xyloforou 13, 4103 Limassol, Cyprus. For anything about your data, write to contact@metrice.io or use the contact page (topic “Privacy and data”).

2. Data about people who use Metrice

Visitors without an account. To count the free searches a visitor has made, we set a cookie with a random ID and keep, for two days, which searches that ID and a scrambled form of your network address (a one-way hash of your IP address and the date, never the address itself) made today.

Account holders. Your email address, name (if you give it) and a securely hashed password, or your Google account ID if you sign in with Google; whether you’ve confirmed your email address; your workspace, plan and its limits. What you do in Metrice that we need to keep for you: saved ads and searches, tracked advertisers, followed ads, snapshots, and the searches your workspace ran (to apply daily limits and show your search history; kept for 90 days).

Payments. Stripe processes your card and billing details. We keep your Stripe customer and subscription references, plan, billing period, renewal date and payment status. Your billing name, address and VAT number are kept by Stripe for your invoices. We never see or store your full card number.

Messages. What you send us through the contact page or by email, and the emails we send you (for example a link to your snapshot or to confirm your address). If you use the withdrawal page, the details you give there.

Teammates and sharing. If you invite someone to your workspace, we use the address you enter to send that one invitation; it is kept until the invitation is used, withdrawn or expires. A snapshot you share by link can be opened by anyone who has the link, until you stop sharing it.

Technical data. Our hosting provider’s servers record requests (IP address, time, page, browser type) for security and troubleshooting; these logs are kept for up to 30 days.

3. Why we use it, and on what legal basis

• To provide Metrice and your account, and to take payment: necessary for our contract with you (GDPR art. 6(1)(b)).
• To apply plan limits, prevent misuse and keep the service secure (search counting, rate limits, logs): our legitimate interest in a fair and secure service (art. 6(1)(f)).
• To keep accounting records (invoices and payments): a legal obligation (art. 6(1)(c)).
• To answer your messages: our contract with you or, before one exists, our legitimate interest in replying (art. 6(1)(b) and (f)).
• Service emails (account confirmation, password and sign-in changes, snapshot links, changes to your plan or these policies): necessary for the contract. Alert emails about the advertisers you track are part of paid plans; every one has a link to stop them, and you can switch them on or off on the Alerts page. We don’t send marketing emails without your consent.

We don’t sell personal data, show third-party advertising, or use your data to make decisions with legal or similarly significant effects about you by automated means.

4. People named in the ads

Metrice shows ads that ran on Snapchat in the EU, from the public ad repository Snap publishes under the EU Digital Services Act. For each ad, that repository names the advertiser and who paid for it. Usually these are companies; sometimes they are individuals, such as sole traders.

We process this information on the basis of our legitimate interest, and that of our users, in transparency and research about advertising (GDPR art. 6(1)(f)); the source is Snap’s public repository. To protect individuals, we leave out ads that appear to be placed by private individuals, and we hide the payer’s name where it is a person’s own name and the ad is for a business.

If you are named in an ad in Metrice, you have the rights listed below, including the right to object. Write to us through the contact page with a link to the ad, and we’ll review it promptly.

5. Cookies

Metrice uses only cookies that are needed for the service, so we don’t ask for consent and show no cookie banner. We use no analytics or advertising cookies.

Usage statistics. To see how the site is used, we count page views with PostHog, on servers in the EU (Frankfurt), in a mode that stores nothing on your device: no cookie and no other storage. Visits are told apart for one day by a code worked out from your network address and browser; the address and browser are used for that moment and not kept, and the code changes every day. We do not send the words you search for, and we use no session recordings.

If you have an account, we also record a few events against your workspace’s number, without your name or email: signing up, starting a plan, and reaching a limit of your plan. We do this on the basis of our legitimate interest in understanding and improving the service (GDPR art. 6(1)(f)); you can object through the contact page.

• metrice_session: keeps you signed in; expires after 14 days.
• metrice_vid: a random ID to count free searches without an account; expires after 12 months, and the searches it counted are deleted after two days.
• metrice_oauth: protects a “Continue with Google” sign-in; expires after 10 minutes.
• mtr_snapshot: only if you open a snapshot link we sent you: remembers that link so the site can lead you back to your snapshot and keep it when you create an account; expires when the link does, after at most 10 days.

Ad pictures and videos. The pictures and videos of the ads are not stored by Metrice: your browser loads them straight from Snap’s servers, where Snap publishes them. Snap therefore receives what any website receives from a visitor, such as your network address and browser details, and handles it under Snap’s own privacy policy. We send Snap nothing about you or your account.

When you pay or manage billing, you are on Stripe’s pages, which set their own cookies under Stripe’s privacy policy.

6. Who we share it with

We use these service providers, who process personal data for us under data processing agreements:

• Payments and subscriptions: Stripe Payments Europe, Ltd. (Ireland (with transfers to the US under the EU–US Data Privacy Framework and standard contractual clauses))
• Email we send and receive: Google Ireland Limited (Google Workspace) (Ireland (with transfers to the US under the EU–US Data Privacy Framework and standard contractual clauses))
• Sign-in with Google (only if you use it): Google Ireland Limited (Ireland (with transfers to the US under the EU–US Data Privacy Framework))
• Hosting of the website and databases: Amazon Web Services EMEA SARL (Ireland)
• Sending service emails (account and snapshot links): Amazon Web Services EMEA SARL (Amazon SES) (EU)
• Usage statistics: PostHog Inc., PostHog Cloud EU (Germany; its support and some of its own providers may be outside the EU, under standard contractual clauses)

Where a provider transfers data outside the European Economic Area, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses. We may also disclose data where the law requires it, or to protect our rights in a dispute.

Inside your workspace, the other members can see the workspace’s saved items, tracking and snapshots.

7. How long we keep it

• Account data and what you keep in Metrice: while your account exists. You can delete your account yourself on the account page; it is deleted at once.
• Searches by visitors without an account: two days. Searches by a workspace: 90 days.
• Sign-in sessions: 14 days. Server logs: up to 30 days.
• Messages to us: 24 months after the conversation ends. Notifications in your account: 180 days.
• Invoices, payments and records of withdrawals and refunds: as long as accounting and tax law requires (in Cyprus, 6 years).

8. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its use, to receive it in a portable format, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Write to contact@metrice.io or use the contact page; we reply within one month.

You can also complain to a data protection authority, in particular where you live or work. Ours is the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).

9. Security

Connections are encrypted, passwords are stored only as salted hashes, sign-in links and sessions are stored as hashes, and access to production systems is restricted. Accounts are for people aged 18 and over; Metrice isn’t meant for children.

10. Changes to this policy

We’ll update this policy when what we do changes, and tell account holders about important changes by email or in Metrice. The date at the top shows when it last changed.