Privacy Policy

1. Controller and Contact Information

The controller responsible for data processing on this website and through the HeyMetrix application is:

Franco Consulting GmbH
Maria-Theresia-Straße 17
89331 Burgau, Germany
Managing Directors: Kilian Franco and Lukas Kraus
Email: [email protected]
Commercial Register: HRB 210213, Amtsgericht Memmingen
VAT ID: DE358098950

2. Overview of HeyMetrix

HeyMetrix is a SaaS marketing platform operated by Franco Consulting GmbH. It enables users to connect their advertising accounts (Google Ads, Meta Ads, Microsoft Advertising, TikTok Ads) via official APIs, monitor campaigns, receive alerts for budgets and KPI deviations, generate performance reports, and — at the user's request — create and publish new ad campaigns in their connected Google Ads and Meta Ads accounts. All data processing occurs on servers hosted by Hetzner in Germany and the European Union.

3. Legal Bases for Processing

We process personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Art. 6(1)(a) GDPR — Consent: Where you have given explicit consent (e.g., for analytics cookies, connecting an advertising account via OAuth).
• Art. 6(1)(b) GDPR — Contract: Where processing is necessary for the performance of our service agreement with you.
• Art. 6(1)(f) GDPR — Legitimate Interest: Where we have a legitimate interest in processing (e.g., server security logs, fraud prevention), provided your rights do not override that interest.
• Art. 6(1)(c) GDPR — Legal Obligation: Where processing is required to comply with legal obligations (e.g., tax or accounting records).

4. Account Registration and Authentication

To use HeyMetrix, you create an account using an email address and password. Authentication is handled through Appwrite, a self-hosted authentication service running on Hetzner servers in Germany. We store:

• Your email address
• Your name (if provided)
• A securely hashed password (we never store plaintext passwords)
• Session tokens for maintaining your login state

This data is processed on the basis of Art. 6(1)(b) GDPR (contract performance) and is stored for as long as your account exists.

5. Google OAuth and Google User Data

5.1 What Google User Data We Collect

When you connect a Google Ads, Google Analytics, Google Search Console or Google Sheets account to HeyMetrix, you authenticate via Google OAuth 2.0. Through this process, we receive:

• OAuth profile information: Your Google account email address and basic profile information as provided by Google during the OAuth consent flow.
• OAuth access and refresh tokens: These tokens allow us to make authorized API requests to Google APIs on your behalf.
• Google Ads API data: Campaign structures, ad groups, ads, keywords, budgets, performance metrics (impressions, clicks, conversions, costs), account-level settings, and other data retrieved through the Google Ads API.
• Google Analytics (GA4) data: Property information, website traffic metrics, conversion data, audience information, and other read-only analytics data retrieved through the Google Analytics Data API.
• Google Search Console data: The sites your account can access and their Google Search performance (search queries, pages, countries, devices, clicks, impressions, click-through rate and average position), retrieved through the Search Console API when a report shows them.
• Google Sheets data: Only the spreadsheets you pick in Google's file picker: the cells of the tabs you set up as report sources, retrieved through the Google Sheets API. HeyMetrix cannot see any other file in your Google Drive.

Google Analytics, Search Console and Google Sheets data is accessed strictly read-only: HeyMetrix never changes your properties, sites or spreadsheets. For Google Ads, we read your campaign data and — only when you explicitly use the corresponding features — write to your ad account: the Campaign Builder creates new campaigns, ad groups, and ads that you have composed and reviewed, and optional automation rules that you configure yourself can pause campaigns or adjust budgets on your behalf. We never modify your Google accounts beyond the actions you have requested or configured.

5.2 How We Use Google User Data

Google user data is used exclusively to provide, maintain, and improve the HeyMetrix service for you. Specifically, we use it to:

• Display your Google Ads, Google Analytics, Search Console and Google Sheets data within the HeyMetrix dashboard and your reports
• Monitor campaign performance and trigger alerts for budget overruns or KPI deviations
• Generate performance reports that you request
• Create and publish ad campaigns that you build with the Campaign Builder, in the ad account you selected
• Execute automation rules you have configured (e.g., pausing a campaign or adjusting a budget when a condition you defined is met)
• Maintain your connections to Google services so data stays up-to-date
• Power optional AI-assisted features that can answer questions about your campaign data and summarize performance (see Section 11.4 for details on the AI providers)

Benchmarks. The daily figures of your Google Ads campaigns also feed, as anonymized benchmark data, the industry comparisons and forecasts HeyMetrix shows all its users: without campaign, ad or account names, and only combined with the figures of enough other ad accounts that no number shows a single one. This data is kept after you disconnect. Google Analytics, Search Console and Google Sheets data is not used for benchmarks.

5.3 What We Do NOT Do with Google User Data

We do not sell Google user data to any third party.

Furthermore, we do not use Google user data for any of the following purposes:

• Serving, targeting, or personalizing advertisements
• Training artificial intelligence or machine learning models (note: while our optional AI features process campaign metadata via third-party AI APIs — see Section 11.4 — those providers do not use API data for model training)
• Data brokering or reselling data to third parties
• Assessing creditworthiness or for lending purposes
• Any purpose unrelated to providing the HeyMetrix service to you

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5.4 Who We Share Google User Data With

We do not share, transfer, or disclose Google user data to any third parties except as strictly necessary to provide the HeyMetrix service:

• Hetzner Online GmbH (Germany/EU): Our infrastructure provider where all servers and databases are hosted. Hetzner acts as a data processor under a Data Processing Agreement (DPA) and processes data exclusively within the European Union.
• Vantero (vantero.chat): Our own AI platform, operated by Franco Consulting GmbH — the same legal entity that operates HeyMetrix. It powers optional AI-assisted features within HeyMetrix (AI chat, campaign assistant, voice transcription, and analysis of ad images you upload). When you use these features, limited campaign metadata (such as campaign names, ad group names, and high-level performance indicators) and the content you actively submit are processed via Vantero on servers located in Germany and the European Union (sub-processors include IONOS SE, Germany, and EU-region AI inference providers — see the Vantero privacy policy for the full list). Submitted data is not used for model training.
• OpenAI, L.L.C. (USA): Generates optional AI-written performance summaries (e.g., daily briefing and alert notification emails). For this, limited campaign metadata and aggregated performance indicators may be sent to the OpenAI API. OpenAI processes this data under their API data usage policy, which states that API data is not used for model training and is not retained beyond the duration of the request. This data transfer is protected by Standard Contractual Clauses (SCCs) under Art. 46 GDPR.

We do not transfer Google user data to any other third parties, advertising networks, data brokers, or analytics providers.

5.5 Data Protection Mechanisms for Google User Data

We implement the following measures to protect Google user data:

• Encryption in transit: All data transmitted between your browser, our servers, and Google APIs is encrypted using TLS 1.2 or higher.
• Server-level encryption: All data is stored on servers with disk-level encryption. Database access is restricted to authenticated backend services only.
• Access controls: Access to Google user data is strictly limited to authorized systems and personnel required for service operation. No employee has direct access to your raw Google Ads data.
• Token security: OAuth refresh tokens are stored securely and are only used to obtain short-lived access tokens for API requests.
• EU-only hosting: All data, including Google user data, is hosted on Hetzner servers located in Germany and the European Union.

5.6 Retention and Deletion of Google User Data

We retain Google user data as follows:

• OAuth tokens: Stored as long as your Google account is connected. Immediately deleted when you disconnect it in HeyMetrix, or on request (see Section 5.7).
• Google Ads and GA4 performance data: Retained for the duration of your account to provide historical reporting, including after you disconnect, so that your reports and projects keep their history. Deleted on request (see Section 5.7).
• Google Search Console data: Not stored. A report reads it when it is shown, and keeps the figures it computed for up to 4 hours.
• Google Sheets data: A copy of each tab you set up is kept to serve your reports, and replaced whenever the tab is read again, at most every 15 minutes while reports are viewed. The copy is deleted when you remove the spreadsheet in HeyMetrix, when HeyMetrix can no longer open it, or when the last Google Sheets connection that can read it is disconnected.

You can disconnect your Google account at any time on the Connectors page of the HeyMetrix application, which immediately deletes our stored OAuth tokens. You may also revoke access directly from your Google Account permissions page.

5.7 How to Request Deletion of Google User Data

You can request deletion of your Google user data at any time by sending an email to [email protected] with the subject line "Data Deletion Request". Disconnecting your Google account in HeyMetrix deletes the stored OAuth tokens, but not the data imported up to that point.

Upon receiving a deletion request, we will delete all associated Google user data from our systems within 30 days. We will confirm deletion via email. Copies in our backups: see Section 15.

6. Meta (Facebook) Platform Data

6.1 What Meta Data We Collect

HeyMetrix allows you to connect your Meta (Facebook) account via Facebook Login for Business and the Meta Marketing API. Through this process, we receive:

• Profile information: Your Facebook account email address, name, and Facebook user ID as provided during the login flow.
• OAuth access tokens: These tokens allow us to make authorized API requests to the Meta APIs on your behalf.
• Ad account and campaign data: Ad accounts you can access, campaign structures, ad sets, ads, budgets, and performance metrics retrieved through the Meta Marketing API.
• Facebook Pages: The list of Facebook Pages you manage or that are accessible through your Meta Business Manager (name, ID, profile picture), so you can select the Page under which your ad campaigns are published.
• Instagram account information: The Instagram account connected to a selected Facebook Page (ID and username), so ads can be delivered to Instagram placements under the correct identity.

6.2 How We Use Meta Data

Meta data is used exclusively to provide the HeyMetrix service to you. Specifically, we use it to:

• Display your Meta Ads campaign data and performance metrics within the HeyMetrix dashboard
• Monitor campaign performance and trigger alerts you have configured
• Generate performance reports that you request
• Create and publish ad campaigns that you build with the Campaign Builder — including creating campaigns, ad sets, ads, and ad creatives, and uploading the ad images/videos you provide — in the ad account and under the Facebook Page you selected
• At your request, create a Page-Backed Instagram Account for your selected Facebook Page so your ads can be delivered to Instagram placements when the Page has no connected Instagram account
• Execute automation rules you have configured (e.g., pausing a campaign or adjusting a budget)

Benchmarks. The daily figures of your Meta Ads campaigns also feed, as anonymized benchmark data, the industry comparisons and forecasts HeyMetrix shows all its users: without campaign, ad or account names, and only combined with the figures of enough other ad accounts that no number shows a single one. This data is kept after you disconnect.

We never modify your Meta assets beyond the actions you have requested or configured. Our use of Meta Platform Data complies with the Meta Platform Terms and Developer Policies. We do not sell Meta Platform Data and do not use it for advertising, model training, or any purpose unrelated to providing the HeyMetrix service to you.

6.3 Protection, Retention, and Deletion of Meta Data

The same data protection measures, retention policies, and deletion processes described for Google user data in Sections 5.5 to 5.7 apply equally to Meta data. You can disconnect your Meta account at any time on the Connectors page of the HeyMetrix application, which deletes our stored OAuth tokens. You may also remove HeyMetrix's access in your Facebook Business Integrations settings. To request deletion of your Meta data, use the deletion channel described in Section 5.7 or Section 15; we will delete all associated Meta data from our systems within 30 days. Copies in our backups: see Section 15.

7. Microsoft Advertising Data

7.1 What Microsoft Advertising Data We Collect

HeyMetrix allows you to connect your Microsoft Advertising account. You sign in with your Microsoft account (work, school, or personal) through Microsoft Entra ID and consent to HeyMetrix accessing your Microsoft Advertising accounts. Through this process and the Microsoft Advertising API, we receive:

• Profile information: The email address of the Microsoft account you signed in with. Microsoft also provides your name during sign-in; we do not store it.
• OAuth access and refresh tokens: These tokens allow us to make authorized requests to the Microsoft Advertising API on your behalf.
• Ad account information: The ad accounts your Microsoft login can access (account ID, name, and currency).
• Campaign and performance data: Campaign names and statuses, and daily performance metrics per ad account and per campaign: impressions, clicks, cost, conversions, conversion value, and phone calls. We fetch performance data only for the ad accounts you use in HeyMetrix (in a report, a project, or an alert): when you first use one, we import its last 365 days, and after that we update the data every night.

We do not receive any data about the individual people who saw or clicked your ads; all metrics are daily totals.

7.2 How We Use Microsoft Advertising Data

Microsoft Advertising data is used exclusively to provide the HeyMetrix service to you. Specifically, we use it to:

• Display your Microsoft Advertising performance data in HeyMetrix dashboards and reports
• Monitor performance and trigger alerts you have configured
• Answer your questions about this data in the optional AI assistant (see Section 11.4 for details on the AI providers)

HeyMetrix only reads data from Microsoft Advertising. It does not create, change, or pause anything in your Microsoft Advertising accounts. We do not sell Microsoft Advertising data and do not use it for advertising, model training, or any purpose unrelated to providing the HeyMetrix service to you.

7.3 Protection, Retention, and Deletion of Microsoft Advertising Data

The data protection measures described in Section 5.5 apply equally to Microsoft Advertising data. Your OAuth tokens are stored as long as the connection exists. You can remove the connection at any time on the Connectors page of the HeyMetrix application, which deletes the stored tokens. The account information, campaign names, and performance history imported up to that point remain stored, so that reports built on them keep their history. To have them deleted, use the deletion channel described in Section 5.7 or Section 15; we will delete them within 30 days. Copies in our backups: see Section 15.

Microsoft processes your account and advertising data under its own responsibility, as described in the Microsoft Privacy Statement. Data we import from Microsoft is stored on our servers at Hetzner in Germany and the European Union. When requesting it, we send Microsoft only what the request needs (your token and the IDs of the accounts concerned).

8. TikTok Ads Data

8.1 What TikTok Ads Data We Collect

HeyMetrix allows you to connect your TikTok Ads advertiser accounts through TikTok for Business and the TikTok API for Business. You choose which advertiser accounts to grant HeyMetrix access to. Through this process, we receive:

• Advertiser account information: The IDs of the advertiser accounts you granted, and for each its name and currency. TikTok does not provide your name or email address to us.
• OAuth access token: This token allows us to make authorized requests to the TikTok API for Business on your behalf. It remains valid until the authorization is removed.
• Campaign and performance data: Campaign names and statuses, and daily performance metrics per advertiser account and per campaign: impressions, clicks, cost, reach, video views and completions, likes, comments, shares, follows, and profile visits; per campaign also conversions, conversion value, and purchases. When you connect, we import the last 365 days. After that we update the data every night.

We do not receive any data about the individual people who saw or interacted with your ads; all metrics are daily totals.

8.2 How We Use TikTok Ads Data

TikTok Ads data is used exclusively to provide the HeyMetrix service to you. Specifically, we use it to:

• Display your TikTok Ads performance data in HeyMetrix dashboards and reports
• Monitor performance and trigger alerts you have configured
• Answer your questions about this data in the optional AI assistant (see Section 11.4 for details on the AI providers)

HeyMetrix only reads data from TikTok. It does not create, change, or pause anything in your TikTok advertiser accounts. We do not sell TikTok Ads data and do not use it for advertising, model training, or any purpose unrelated to providing the HeyMetrix service to you.

8.3 Protection, Retention, and Deletion of TikTok Ads Data

The data protection measures described in Section 5.5 apply equally to TikTok Ads data. Your OAuth token is stored as long as the connection exists. You can remove the connection at any time on the Connectors page of the HeyMetrix application, which deletes the stored token. The authorization itself remains listed in your TikTok for Business account until you remove it there. The account information, campaign names, and performance history imported up to that point remain stored, so that reports built on them keep their history. To have them deleted, use the deletion channel described in Section 5.7 or Section 15; we will delete them within 30 days. Copies in our backups: see Section 15.

TikTok processes your account and advertising data under its own responsibility. Data we import from TikTok is stored on our servers at Hetzner in Germany and the European Union. When requesting it, we send TikTok only what the request needs (your token and the IDs of the advertiser accounts concerned).

9. General Data Collection

9.1 Server Log Files

When you visit our website, our hosting provider (Hetzner) automatically collects and stores information in server log files that your browser transmits. This includes:

• IP address (anonymized where possible)
• Date and time of the request
• Requested URL and referrer URL
• Browser type and version
• Operating system
• HTTP status code and data volume transferred

This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in ensuring server security and stability). Log files are automatically deleted after 30 days.

9.2 SSL/TLS Encryption

This website and the HeyMetrix application use SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as requests you send to us or login credentials. You can recognize an encrypted connection by the "https://" prefix in your browser's address bar and the lock icon.

9.3 Contact via Email

If you contact us by email (e.g., at [email protected]), we will store your email address and any information you provide in order to process your inquiry. This data is processed on the basis of Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). We will delete this data once your inquiry has been fully resolved, unless retention is required by law.

10. Cookies

Our website uses cookies. Cookies are small text files stored on your device by your browser. Some cookies are technically necessary for the website to function (e.g., session cookies). Other cookies are used for analytics or marketing purposes and are only set with your explicit consent.

You can manage your cookie preferences at any time through our consent management tool (see Section 11.1 below) or through your browser settings. Disabling cookies may limit the functionality of our website.

Technically necessary cookies are processed on the basis of Art. 6(1)(f) GDPR (legitimate interest). All other cookies require your consent under Art. 6(1)(a) GDPR.

11. Third-Party Services

11.1 Usercentrics Consent Management Platform (CMP)

We use Usercentrics to manage your cookie and tracking consent preferences. Usercentrics stores your consent decisions so that we can respect your choices across sessions. This processing is based on Art. 6(1)(c) GDPR (legal obligation to document consent) and Art. 6(1)(f) GDPR (legitimate interest in lawful data processing). For more information, see the Usercentrics Privacy Policy.

11.2 Google Tag Manager

We use Google Tag Manager to manage website tags. Google Tag Manager itself does not collect personal data. It triggers other tags that may collect data, but Google Tag Manager does not access this data. If tracking has been disabled at the domain or cookie level, it remains in effect for all tracking tags implemented via Google Tag Manager. For more information, see the Google Privacy Policy.

11.3 PostHog Analytics

We use PostHog for product analytics to understand how users interact with HeyMetrix and to improve our service. Our PostHog instance is hosted on EU servers, ensuring that analytics data remains within the European Union. PostHog collects anonymized usage data such as page views, feature usage, and session information. This processing is based on your consent under Art. 6(1)(a) GDPR. For more information, see the PostHog Privacy Policy.

11.4 AI Service Providers (Vantero and OpenAI)

HeyMetrix offers optional AI-assisted features. When you use them, the following data may be processed by our AI service providers, acting as processors on our behalf:

• Vantero (vantero.chat): Our own AI platform, operated by Franco Consulting GmbH — the same legal entity that operates HeyMetrix. It powers the AI chat and campaign assistant, voice-to-text transcription (audio recordings you actively make in the app), and analysis of ad images you upload in the Campaign Builder. Limited campaign metadata (campaign names, ad group names, aggregated performance indicators) and the content you submit are processed via Vantero on servers located in Germany and the European Union (sub-processors include IONOS SE, Germany, and EU-region AI inference providers). Submitted data is not used for model training. For more information, see the Vantero privacy policy.
• OpenAI, L.L.C. (USA): Generates AI-written performance summaries for optional daily briefing and alert notification emails. Limited campaign metadata and aggregated performance indicators are sent to the OpenAI API. Under OpenAI's API data usage policy, data submitted via the API is not used for model training and is not retained beyond the duration of the request. Transfers are protected by Standard Contractual Clauses (SCCs). For more information, see the OpenAI Enterprise Privacy.

No OAuth tokens or login credentials are ever sent to AI providers. This processing is based on Art. 6(1)(b) GDPR (contract performance — providing the service feature you initiated).

11.5 Trello (Optional Integration)

You can optionally connect your Trello account to HeyMetrix to attach Trello cards to campaign builds. If you do, we store an OAuth token for your Trello account and access the boards and cards you select. Provider is Atlassian Pty Ltd / Atlassian Inc. (USA); transfers are safeguarded by Standard Contractual Clauses (SCCs). The token is deleted when you disconnect Trello, or on request (see Section 15). This processing is based on Art. 6(1)(b) GDPR. For more information, see the Atlassian Privacy Policy.

12. International Data Transfers

Our primary data processing occurs within the European Union (Hetzner servers in Germany; Vantero AI processing on servers in Germany and the EU). Some third-party services (Google Tag Manager, OpenAI, Atlassian/Trello) may transfer data to servers in the United States. Where such transfers occur, they are safeguarded by the EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs), or other appropriate safeguards under Art. 46 GDPR.

13. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You have the right to request information about whether and which personal data we process about you.
• Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): You have the right to request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request restriction of processing under certain conditions.
• Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interests at any time.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise any of these rights, please contact us at [email protected].

14. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. The specific retention periods are:

• Account data: Retained for the duration of your account. Deleted within 30 days of a deletion request (see Section 15).
• Advertising data (Google Ads, Google Analytics, Meta Ads, Microsoft Advertising, TikTok Ads): Retained for the duration of your account, including after you disconnect the respective platform, so that reports keep their history. Deleted within 30 days of a deletion request (see Section 15).
• Backups: Copies in our backups are not edited; they are deleted automatically on the backups' normal schedule, within eight weeks at the latest, and are used only to restore the service.
• Anonymized benchmark data (Sections 5.2 and 6.2): Kept, also after a deletion request; it can no longer be linked to you or your account.
• OAuth tokens: Deleted immediately upon disconnecting the respective platform, or on request.
• Server log files: Automatically deleted after 30 days.
• Email correspondence: Retained until the inquiry is resolved, then deleted unless legal retention applies.
• Billing and tax records: Retained for up to 10 years as required by German commercial and tax law (§ 147 AO, § 257 HGB).

15. Account and Data Deletion

You can request deletion of your HeyMetrix account and all associated data at any time by emailing [email protected] with the subject line "Data Deletion Request". Upon such a request:

• All stored OAuth tokens are deleted
• All advertising data associated with your account (Google Ads, Google Analytics, Meta Ads, Microsoft Advertising, TikTok Ads) is deleted
• Your account information (email, name) is deleted
• All campaign data, reports, and monitoring configurations are deleted

This process is completed within 30 days of your request. Copies in our backups are not edited; they are deleted automatically on the backups' normal schedule, within eight weeks at the latest, and are used only to restore the service. Data that must be retained for legal reasons (e.g., billing records) will be retained for the legally required period and then deleted. Anonymized benchmark data (Sections 5.2 and 6.2) is kept; it can no longer be linked to you or your account.

16. Children's Privacy

HeyMetrix is a business tool designed for professional use. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users of material changes via email. The current version is always available on this page.

18. Contact

If you have questions about this Privacy Policy or our data processing practices, please contact us at:

Franco Consulting GmbH
Maria-Theresia-Straße 17
89331 Burgau, Germany
Email: [email protected]