Data Processing Agreement (DPA)

Pursuant to Art. 28 GDPR. Last updated 7 October 2026. This agreement is concluded when you register for MetricPort; a signed PDF copy is available on request (hello@simongrimm.at).

1. Parties

Controller: the customer (owner of the MetricPort workspace). Processor: Simon Grimm, Achstraße 47, 6844 Altach, Austria (see Impressum).

2. Subject matter and duration

Provision of a hosted MCP server and dashboard that reads, analyzes and serves data from Google Search Console, Google Ads and AdSense on the customer’s behalf to the customer and AI clients the customer authorizes. Duration: as long as the customer account exists.

3. Nature and purpose, data categories, data subjects

Retrieval, short-term caching (max. 5 minutes), analysis and display of performance data (queries, pages, clicks, impressions, campaigns, cost, earnings). Storage of OAuth refresh tokens (encrypted), property lists, usage logs, generated reports and alerts. Data subjects: the customer’s users, the customer’s website visitors (aggregated only, no individuals), Google account holders.

4. Processor obligations

Processing only on the customer’s documented instructions (use of the service constitutes the instruction).
Confidentiality of all persons involved in processing.
Technical and organizational measures: token encryption (AES-256-GCM), TLS, access only through authenticated accounts, hosting in Frankfurt (Vercel, Supabase), logging, 90-day log deletion.
Reasonable assistance with data subject requests and impact assessments.
Notification of personal data breaches without undue delay, at the latest 48 hours after becoming aware.
Deletion on termination: disconnecting an account revokes the Google token immediately, account deletion removes all data within 24 hours and from backups within 30 days.

5. Sub-processors

Vercel Inc. (hosting), Supabase Inc. (database), Clerk Inc. (authentication), Stripe Payments Europe Ltd. (payments), Resend Inc. (email, optional), OpenAI LLC (AI summaries, optional, can be disabled). Changes are announced 30 days in advance by email; the customer may object and terminate.

6. International transfers

Transfers to the USA (Vercel, Clerk, Resend, OpenAI) rely on the EU-US Data Privacy Framework or EU standard contractual clauses. The transfer to OpenAI can be disabled by the customer in Settings.

7. Audit rights

The customer may request information on the technical and organizational measures once per year; we answer in writing within 14 days.