Legal
Privacy Policy
Last reviewed: 17 October 2026
This page explains what personal data Metryn processes when you use it, why, who else receives it, and how long we keep it. It covers getmetryn.com and the free scan tool on our Shopify companion site.
Who is responsible
The controller of your personal data is Gonçalo Torres. You can contact us at support@getmetryn.com.
Metryn is operated by Gonçalo Torres, sole trader (trabalhador independente), Portugal. Contact: support@getmetryn.com.
The paid report is sold by Paddle.com Market Limited (company no. 8172165, 30 Old Bailey, London EC4M 7AU) as authorised reseller and merchant of record; its checkout buyer terms apply.
What we process, why, and on what basis
- Running a scan. The web address you submit, the technical result of the scan (score and findings) and the time of the request. Basis: performing the service you asked for (contract / pre-contractual steps, Art. 6(1)(b) GDPR). Providing the web address is necessary to run a scan; without it we cannot scan.
- What the scanner read. So the complete report can show you the facts behind its findings, a scan stores a short snapshot of the page it fetched: the final address (without any query string), the title, the meta description, the first heading, the canonical address, the language, the structured-data types, the number of visible characters, short labels for any Shopify markers the page showed (for example a Shopify header), and the first 500 characters of visible text, with scripts and markup removed. It is capped at about 4 KB per scan, is shown only on the complete report, never on the free result or in the free preview API, and is removed automatically 90 days after the scan. The text comes from a public page; if that page shows personal data in its first 500 characters, that is what would be kept for those 90 days. Basis: our legitimate interest in showing you the evidence behind a finding (Art. 6(1)(f)). We weighed it against the interests of the people named on the page: the text is already public, we keep a short excerpt for a limited time, and it is shown only to the person who asked for the scan. See People named on a scanned page.
- Delivering a paid report. The Paddle transaction id and the scan id, so the right report unlocks after payment, and the email address Paddle gives us for your purchase, used to send you one email with the link to your report. We do not use that email address for marketing. Basis: performing the contract (Art. 6(1)(b)).
- Security, rate limiting and abuse prevention. Your IP address is sent to our server with each scan request. It is used in memory for rate limits, sent to Cloudflare Turnstile to verify the anti-abuse check, and then stored only as a pseudonymised identifier (see below). Basis: our legitimate interest in keeping the service available and preventing abuse (Art. 6(1)(f)).
- Server logs. Our web server keeps access logs (including IP address, requested path, status and timestamp) for security and troubleshooting. As configured, they are rotated and kept for at most 14 days. Basis: legitimate interest (Art. 6(1)(f)).
- Service statistics. Counters of how many visits and scans reach each step (home page visited, scan started, result viewed, buy button clicked, checkout started, purchase completed, report opened, report email sent or failed), recorded on our server without a cookie or device identifier. Counter rows that relate to a scan carry the scan id and the pseudonymised IP identifier described below. If you arrived through a tagged link, the row also carries the utm_source, utm_medium and utm_campaign values from that link (short labels such as the site or campaign name; nothing about you). We also use Umami Cloud for aggregate traffic analytics (pages viewed, referrer, approximate country and device type). Report links and scan ids are removed from what is sent to Umami. Basis: our legitimate interest in understanding and improving the service (Art. 6(1)(f)).
- Monitoring waiting list. Weekly monitoring is not available. On a result page and on the paid report page you can join a waiting list for it. If you do, we store the email address you type, the price you chose (if any), the scanned domain and scan id, which page you joined from, the time of your consent, and the pseudonymised IP identifier. We email you once if weekly monitoring opens within 90 days; after 90 days the address is deleted. We send nothing else and create no account. Giving us the email address is optional; without it you are simply not on the list. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to support@getmetryn.com; we then delete the entry.
- Feedback you send. On /feedback you can send a short testimonial. If you do, we store the name you type (it can be Anonymous), an optional role or site, your text, your email address, the time and version of your consent, and the pseudonymised IP identifier. The email address is never shown; we use it only to confirm, contact you about, or remove your feedback. Nothing is published until you have ticked the consent box and we have read and approved it. If we approve it, your name, role or site and text appear on our home page and pricing page. Only we can read pending entries and the email address. An approved entry is deleted 24 months after approval; a pending or rejected one 90 days after you sent it. Giving us feedback is optional. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to support@getmetryn.com; we then remove it.
- Payment and tax records. Paddle, as Merchant of Record, issues invoices and handles tax. Where we need to keep a record of a sale for accounting or tax purposes, basis: legal obligation (Art. 6(1)(c)).
The pseudonymised IP identifier
We never write your raw IP address to our database. For each scan we store a keyed hash (HMAC-SHA-256 with a secret held on our server) of it, used to limit how many scans one visitor can queue. This hash is pseudonymised personal data, not anonymous data, because we can recompute it for a given IP address. We remove it from the scan record 90 days after the scan, automatically.
Retention
| Data | How long |
|---|---|
| Pseudonymised IP identifier on a scan | 90 days, then removed automatically |
| Web server access logs (raw IP address) | Up to 14 days |
| Scan that was never paid for: address, result and findings (short evidence snippets, no page content) | 12 months after the scan, then deleted automatically; deleted earlier on request |
| Paid scan: address, result and findings (the report) | 24 months after the purchase, then deleted automatically. The permanent report link then stops working. Deleted earlier on request |
| Page snapshot on a scan (title, description, first 500 characters of visible text) | 90 days, then removed automatically |
| Purchase email address and report-email details | Cleared 24 months after the purchase; cleared earlier on request where the law allows |
| Payment record (transaction id, status, date; no card data) | Kept as our sales record, without the email address, after the purchase email is cleared. Kept for the period that Portuguese tax and accounting law requires for sales records; the exact period is confirmed with our accountant. It is not set by the retention periods above |
| Pseudonymised IP identifier on a funnel counter | 90 days, then removed automatically |
| Server-side funnel counters (event name, scan id, time) | Kept; after the identifier is removed they identify no one |
| Monitoring waiting-list entry (email, consent) | 90 days, then deleted automatically; deleted earlier on request |
| Published feedback (name, optional role or site, text, email, consent) | 24 months after we approved it, then deleted automatically; removed earlier on request |
| Feedback not approved yet, or rejected | 90 days after you sent it, then deleted automatically |
Who receives your data
| Provider | What it does | Role |
|---|---|---|
| Paddle.com Market Limited (Paddle) | Merchant of record for the paid report: payment, taxes, receipts. We never see or store card details. | Independent controller of your payment data |
| Resend | Sends the one report-delivery email (recipient address and message content). | Processor |
| Cloudflare | Turnstile anti-abuse check on the scan and waiting-list forms (receives the check token and your IP address; may use browser storage for that check). Also DNS for our domain. | Processor |
| Umami (Umami Cloud) | Aggregate traffic analytics (pages viewed, referrer, approximate country and device type). It sets no cookies. Report links and scan ids are removed from what is sent. | Processor |
| Hostinger | Hosting: the server and storage on which Metryn runs. | Processor |
| Shopify | Runs our companion site only (not getmetryn.com). | Operates that site; see below |
We do not sell your personal data and we do not use advertising trackers, session replay or device fingerprinting.
International transfers
Some of these providers are based outside the European Economic Area or may process data there (Paddle is in the United Kingdom; Resend, Cloudflare and Umami are US companies). We do not claim a transfer mechanism on a provider's behalf: each provider relies on its own transfer safeguards, described in its own policy: Paddle, Resend, Cloudflare, Umami, Hostinger. Write to support@getmetryn.com if you want to know more.
People named on a scanned page (GDPR Art. 14 notice)
If you are named on a web page that someone scanned with Metryn, this is how we got your data and what we do with it. Source: the public web page itself, fetched by our scanner. Purpose: to show the person who requested the scan the evidence behind a finding. Basis: legitimate interest (Art. 6(1)(f)). What we keep: a short excerpt (title, description, first heading, first 500 characters of visible text) for 90 days, shown only on the complete report. We do not notify each person named on a scanned page individually, because that would be disproportionate for a short, public, temporary excerpt. You can ask us to delete it, or object, at support@getmetryn.com; tell us the web address.
People we contact by email (business contacts found publicly)
Occasionally we write to a website owner or agency to tell them about a specific technical finding on their site. Source: a business contact address published on their own website. Purpose: that one message, and keeping a record so we do not write again after you ask us to stop. Basis: legitimate interest (Art. 6(1)(f)). What we keep: your address, your website and the finding, in a prospecting list, for 12 months or until you ask us to delete it. Your rights: access, correction, erasure and objection. To opt out, reply to the message or write to support@getmetryn.com; we then add you to a suppression list so we do not write to you again.
Cookies
Metryn sets one strictly necessary first-party cookie per scan you start or pay for, named metryn_scan_ followed by the scan id. Its value is a keyed hash of that id, it is httpOnly and SameSite=Lax, and it expires after 30 days. Its only purpose is to prove that this browser started the scan, so that it can open the report you paid for and cancel your own queued scan; without it, someone who only has the scan address sees the free preview. It carries no tracking or advertising data, and we do not use it for analytics. Our anti-abuse check (Cloudflare Turnstile) loads on pages that have a scan or waiting-list form, and checkout (Paddle) loads only after you click to buy; both are provided by third parties and may use browser storage as described in their policies. Our analytics (Umami) is cookieless.
Your report link
A paid report is available to anyone who has its link. The link is a long random address that works without a login, and we email it to the buyer. Treat it like a password: if you share it, the person you shared it with can open the report. Reports are asked not to be indexed by search engines, but we cannot control what others do with a link you give them. If a link was exposed and you want it disabled, contact us. A paid report and its link are kept for 24 months after the purchase. After that the report is deleted and the link stops working, so download the PDF if you want to keep a copy. The address of a scan result page alone does not open an unlocked report: that needs the emailed link, or the browser that started the scan.
What we don't do
- We never see or store your card details — payment is handled entirely by Paddle.com, our Merchant of Record.
- We do not persist the full HTML of any site we scan.
- Findings store only short technical evidence snippets. The only page text we keep is the 500-character snapshot described above, for 90 days.
- We do not sell your personal data.
- We do not make decisions about you by automated means that have legal or similarly significant effects. The scan score describes a website, not a person.
Free scan on our Shopify companion site and embedded widgets
If you use the free website scan on our Shopify companion site, or in the embedded widget on another website that we have listed for it, your browser sends the web address you type, your IP address and a Cloudflare Turnstile anti-abuse token directly to our scan service at getmetryn.com. We process them for the same purposes, on the same legal bases and with the same retention as described above. The Shopify store, or the website that hosts the widget, is operated by someone else and has its own privacy policy. The widget sends us only what is listed here and does not read anything else from the page it sits on.
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to object to processing based on legitimate interest, and to receive the data you provided in a portable format. To exercise any of these, email support@getmetryn.com. We may ask you to show which scan or purchase you mean, for example the scanned domain or the report link, because we do not hold an account for you. We reply within one month.
You also have the right to lodge a complaint with a supervisory authority. In Portugal this is the CNPD: https://www.cnpd.pt.
Contact
Gonçalo Torres
support@getmetryn.com
See also our Terms & Conditions and Refund Policy.