Privacy notice

To run audits and let you sign in, we store the following per user:

• Email address: used to identify your account and to send scheduled reports if you configure them.
• Google sub (opaque identifier): Google's stable user ID, used only to link a session back to a user record.
• OAuth refresh + access tokens for Google Analytics and Google Ads, encrypted at rest with AES-256-GCM. If you link more than one Google account to your user, we store the email address, Google user ID and tokens of each, and which GA4 properties, Tag Manager accounts and Google Ads accounts each one can reach, so the audit reads each account with the Google account that has access to it. Unlinking an account deletes its tokens and that list.
• CMS API credentials (Shopify / WooCommerce / Magento) when configured, AES-256-GCM encrypted at rest. Shopify offline access tokens obtained via the Shopify Partner OAuth flow are stored the same way.
• Audit results: aggregated metrics from your GA4 property (counts, percentages, sample URLs). No individual visitor data is stored.
• Session cookie: an iron-session encrypted cookie identifying your active sign-in. Cleared on logout.
• Share links: each link is a database row with a SHA-256 hash of the token (never the token itself), the property and its name, the link type, who created it, and its expiry. A full client link also stores a frozen copy of the report it shows: the findings and, where Tag Monitor measured them, the consent rates.
• Meta connections: when you connect Meta, the Meta Marketing API access token (AES-256-GCM encrypted at rest), the pixels it can see, and the pixel and ad account you selected.
• Tag Monitor figures: for sites watched by our Tag Monitor service (monitor.newnorth.nl), the measured consent accept rates and tag-health figures, stored with the consent audit result. These are aggregated counts and rates, not visitor-level data. Share links and client emails carry only the consent rates.
• Consent banner screenshots: a consent audit takes a screenshot of the audited website on first visit, with its cookie banner showing, for use in the audit deck. One per tenant and crawled page. It shows the public website, not a visitor.
• Parsed orders from the app: when you upload an order file in the app, only the fields the audit needs (order id, date, value, items, source) are stored, bound to your account and property, for 30 days or your retention window when that is shorter. No customer fields.
• Uploaded order files: a backend order export sent to the transaction audit through our API upload endpoint is stored encrypted, can be read for 24 hours, only for the property it was uploaded for, and is deleted by the next nightly cleanup after that.

When you sign in with Google and authorise the app, we request the following scopes:

• openid email: identifies your account.
• https://www.googleapis.com/auth/analytics.readonly: lets us read your GA4 properties, reports, event names, and configuration so we can produce the audit. No writes are performed with this scope.
• https://www.googleapis.com/auth/analytics.edit: requested only when you click a "Fix in GA4" button, and used only for the change that button names: set the data retention to 14 months, set the property currency to EUR, turn on site search tracking, turn off the scroll, outbound-click and form-interaction enhanced measurement events, or mark purchase or generate_lead as a key event.
• https://www.googleapis.com/auth/adwords: requested when you open a Google Ads tab, so we can compare Google Ads conversion counts with your GA4 and backend numbers and audit the account. We read with it, with one exception: when you click the auto-tagging fix, it turns on auto-tagging for that account.
• https://www.googleapis.com/auth/tagmanager.readonly: requested when you first fetch a container on the GTM tab, so we can audit its tags, triggers and variables. Read-only.

Limited Use. The GA4 Audit Tool's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use the data only to provide the audit features you see in the app, and we transfer it to third parties only as necessary to provide those features. One of those transfers is to our AI provider, Anthropic: audit findings and metrics derived from your Google Analytics and Google Ads data are sent to it to draft the audit deck text and report summaries (see "Third-party processors" below). We do not use the data for advertising, we do not sell it, and we do not use it to train AI or machine learning models. No human reads your data unless you ask us to (for example when New North Digital reviews your audits as part of a service you bought, or you ask for support), we are legally required to, or we need to investigate a security incident.

• Individual visitor data from your GA4 property. We aggregate metrics and discard the row-level data after analysis.
• The order files you upload in the app, and the customer data in them. The file is read in your browser and never sent to us; customer names, emails and addresses stay there. What the audit keeps of it is listed under "What we store".
• Tracking or analytics on this tool itself without your consent. No ad pixels, no marketing tags. Product analytics (Google Tag Manager + GA4) only load after you accept them in the cookie banner (see "Cookies" below).

We use as few cookies as we can get away with. Two categories:

• Essential: the encrypted iron-session cookie that keeps you signed in. Always on; the tool can't function without it. Cleared on sign-out.
• Analytics (optional): Google Tag Manager + GA4 to measure anonymous product usage. Default-denied via Consent Mode v2 for visitors from the EU / UK; loads only after you click "Accept" or enable it in Customize. You can change your mind at any time from the "Cookie preferences" link in the footer.

Open cookie preferences

• Audit results: default 180 days, configurable per tenant from 30 to 1825 days. Older rows are auto-pruned by a daily cron. Quarterly reviews and their memos follow the same window.
• Activity log: 90 days, except four entries the report scheduling reads back, which are kept 400 days: report sent, period skipped, skipped because nothing changed, and email opened. "Email opened" comes from a tracking pixel in scheduled report emails; it records the schedule, the time and the mail client's user agent.
• Property Health / Consent Mode caches: 30 days.
• Google OAuth tokens: stored until you request account deletion, or until they go unused for 180 days, when the nightly cron deletes them and you grant access again on your next sign-in. Meta connections: stored until you disconnect Meta in the app or request account deletion, and deleted the same way after 180 days unused. Signing out deletes neither, so scheduled reports keep working. Revoking the grant in your Google or Meta account stops a stored token from working.
• CMS credentials and Shopify offline tokens: stored until you request account deletion. Uninstalling the Shopify app also deletes that shop's connection.
• Consent banner screenshots: 30 days, or your tenant's audit-retention window if that is shorter.
• Uploaded order files (API upload endpoint): readable for 24 hours, deleted by the nightly cleanup after that (so at most about 48 hours).
• Tag Monitor figures: kept with the audit results they belong to, on the same retention.
• Session cookie: 7 days from sign-in. Every request re-checks your account, so removing a user ends their access within a minute.
• Share links: by default 30 days for a summary link and 120 days for a full report, at most 400 days, and never longer than your tenant's audit-retention window. You can revoke a link at any time from the Share menu. Once the retention window has passed, the nightly cron deletes the frozen report and revokes the link.

• You: full access to your own audits and stored credentials.
• Other users in your tenant: if you're part of a shared tenant (e.g. an agency workspace), other members can see audit results but not OAuth tokens or CMS credentials.
• Recipients of share links you create: anyone who opens a link you generated sees a read-only report for that one property until the link expires or is revoked. They do not see other properties or the tenant list.
• NND administrators: limited operational access for support and audit-trail review (security events, schedules, CMS connections). Tokens and credentials remain encrypted; admins do not see plaintext values.
• Google: the audit reads from GA4, Google Ads and Tag Manager via official APIs using your OAuth grant. It writes only when you click one of the fixes listed under "Google user data" above. Google's privacy policy applies to data flowing through their APIs.

We rely on the following lawful bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)): for the core audit service, including storing your account, running audits against your GA4 / Google Ads / CMS data, and rendering results.
• Legitimate interest (Art. 6(1)(f)): for operational security (rate-limit + audit-log retention), error monitoring, and aggregated anonymous benchmarks computed across all audited stores. You can object (see “Your rights”).
• Consent (Art. 6(1)(a)): for the optional monthly digest email. Toggle off in Subscriptions to withdraw at any time.
• Legal obligation (Art. 6(1)(c)): to retain audit logs of security-relevant actions (e.g. cron auth failures) for a reasonable period.

We use the following sub-processors to deliver the service. All access is bound by data-processing agreements; none use your data for their own purposes.

• Vercel Inc. (USA): application hosting, edge network, function execution. Vercel may process limited request metadata (IP, user agent) to operate the platform.
• Neon Inc. (USA; our database runs in AWS eu-central-1, Frankfurt): managed Postgres database. All persistent data (user records, audit results, encrypted credentials) is stored here. Application code runs on Vercel in Frankfurt as well; Vercel's edge network and logs are global.
• Resend (USA): transactional email delivery for scheduled reports and the monthly digest, only when you opt in.
• Sentry (USA, with EU residency available): server-side error monitoring. We deliberately scrub OAuth tokens and CMS credentials before reporting; payload metadata may still include user-agent and request shape.
• Anthropic PBC (USA): the Claude API, which writes text from audit results. What it receives, per feature:
  • Audit deck: the client or property name and, per slide, the findings and metrics we measured for that area (titles, details, counts, percentages, dates, and the tag, account or page references a finding cites). Order reconciliation findings can include a few example order numbers with their order value. It drafts the diagnosis and action points.
  • Quarterly report draft: the property name, the period, finding titles and the change in critical and warning counts. The draft goes into our internal preparation email and a person edits it before anything reaches a client.
  • Diagnosis and knowledge tools used by our team: the question or situation they type and, when they diagnose a specific property, its property ID and display name, audit scores, top findings, order reconciliation totals, and the free-text notes people wrote when dismissing findings. Answering general tracking questions and checking public product changelogs sends no client data.
  We never send OAuth tokens, CMS or Meta credentials, uploaded order files, screenshots, customer details or visitor-level data. Before any text leaves, we cut query strings from URLs and mask email addresses, phone numbers, IP addresses and long token-like strings, including in typed questions and dismissal notes. Anthropic processes these requests under its commercial API terms.
• Google LLC: Google Analytics, Google Ads, and identity (OAuth). The audit reads from your own Google account via your authorised grant; Google's privacy policy applies to data flowing through their APIs.

Several of the processors above are headquartered in the United States. Where transfers of personal data outside the EEA occur, they are protected by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. Your stored data itself stays in the EU (database and application compute in Frankfurt); transfers are limited to what a given processor needs, such as an email address for delivery, an error report for monitoring, or audit findings for the AI provider to draft text from.

You can:

• Sign out any time via the sidebar. This clears your session cookie. Your stored OAuth tokens remain so scheduled reports keep working; revoke at Google Account → Third-party apps to break the audit's ability to read GA4.
• Request account deletion by emailing hello@newnorth.nl. We delete the user row and all dependent rows within 14 days; CASCADE deletion in the schema removes audit history, schedules, OAuth tokens, CMS credentials, and Shopify offline tokens.
• Request a copy of your data via the same address. We respond within 30 days per GDPR.
• Shorten your tenant's retention window: ask and we'll adjust your tenant row, which cascades to the next daily prune.
• Lodge a complaint with a supervisory authority. If you're in the EU, the Dutch supervisory authority is Autoriteit Persoonsgegevens; in other EU member states your local DPA applies. You can also raise the issue with us first via the contact below; we'd like the chance to resolve it.

New North Digital, the Netherlands. Questions, deletion requests, or data-protection concerns: hello@newnorth.nl.