In brief
- Your email is stored in the database for authentication only.
- Your clients' GA4/Meta data is never stored in the database (Redis cache 6-24h maximum).
- Google Analytics 4 (narratiq.fr audience) only loads with your explicit consent.
- Contact: dpo@narratiq.fr, response within 30 days.
Who are we?
NarratIQ is a SaaS analytics and reporting service for freelancers and digital agencies.
Data controller
Matheo Zimmer
Legal form
Sole trader (micro-entrepreneur)
SIRET
10504893800010
Address
10 Rue Carnot, 54550 Pont-Saint-Vincent, France
DPO contact: dpo@narratiq.fr
Data we collect
2.1 Account data
- Email address (unique identifier)
- Name (optional)
- Registration date and login history
- Billing information (processed by Stripe; card numbers never reach us)
2.2 Client data you entrust to us
When you connect your clients' Google Analytics 4 or Meta Ads accounts, NarratIQ accesses only aggregated metrics (sessions, impressions, spend, etc.).
2.3 Technical data
- Access logs (IP address, user-agent, action), retained for 90 days then automatically purged
- Session and authentication cookies (see section 7)
Why we process this data
| Purpose | Legal basis |
|---|---|
| Service provision (dashboard, reports, alerts) | Contract performance (Art. 6.1.b GDPR) |
| Billing and subscription management | Contract performance + legal obligation |
| Transactional emails (reports, alerts, magic link) | Contract performance |
| Security logs and internal audit | Legitimate interest (Art. 6.1.f GDPR) |
| GDPR compliance (DPA, consent history) | Legal obligation (Art. 6.1.c GDPR) |
| narratiq.fr audience measurement (Google Analytics 4) | Consent (Art. 6.1.a GDPR · ePrivacy Directive Art. 5.3) |
Sub-processors and transfers
All our primary data is hosted in the European Union. The US-based services below govern transfers via Standard Contractual Clauses (SCC).
| Service | Role | Location |
|---|---|---|
| Neon PostgreSQL | Primary database | EU · Frankfurt |
| Upstash Redis | Metrics cache (short TTL) | EU · Ireland (eu-west-1) |
| Cloudflare R2 | PDF storage | EU |
| Stripe | Payments (PCI-DSS certified) | EU |
| Resend | Transactional emails | EU |
| Vercel | Application hosting | EU · Frankfurt, Germany (fra1) |
| Vercel Analytics | Cookie-free audience measurement (anonymised server-side) | EU · Vercel Edge |
| Google Analytics 4 | narratiq.fr audience, consent-only | USA (Google SCC) |
| Google (GA4 Data API) | Client analytics data access, read-only | Google DPA · read-only |
| Meta (Marketing API) | Client ad data access, read-only | Meta DPA · read-only |
Retention periods
Your GDPR rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
JSON export of all your data via Settings.
Edit your email or name in Settings.
Account deletion from Settings → Danger zone. Cascade within 72h.
JSON export of all your data via Settings.
Object to any processing based on legitimate interest via dpo@narratiq.fr.
Lodge a complaint with the relevant supervisory authority (e.g. ICO in the UK, CNIL in France) for non-compliant processing.
To exercise your rights: dpo@narratiq.fr. Response within 30 days.
Security and data protection
8.1 Technical protection mechanisms
Encryption at rest
All OAuth tokens (Google, Meta) are encrypted with AES-256-GCM before any storage in the database. The encryption key is stored exclusively as a server environment variable, never in the database.
Encryption in transit
All client-server and server-third-party API communications use TLS 1.3 exclusively. Unencrypted HTTP connections are refused.
Passwordless authentication
NarratIQ uses magic link authentication exclusively. No password is ever stored or transmitted.
User data isolation
Each user can only access their own data. API requests verify identity server-side on every call via the encrypted NextAuth session.
No persistent GA4/Meta storage
GA4 and Meta metrics only pass through a short-TTL Redis cache (6-24h). They are never written to the relational database or permanent files.
Tokens never logged
OAuth access tokens are never included in application logs or Vercel traces. Logs contain only opaque anonymised identifiers.
8.2 Access control and limitation
- Google OAuth scopes are limited to the strict minimum required (read-only GA4 data (analytics.readonly)). NarratIQ never uses write scopes.
- Meta tokens are limited to ads_read permissions only. No write action is requested or executed.
- Access to a client account's data requires that the logged-in user is the owner of that account in NarratIQ (database check on every request).
- Secrets (API keys, master tokens) are accessible only to server processes via encrypted Vercel environment variables, never exposed client-side.
- The database is accessible only from Vercel production servers (private Neon connection string, not publicly exposed).
8.3 Data breach procedure
In the event of a confirmed or suspected personal data breach, NarratIQ commits to:
- 72hNotification to the relevant supervisory authority within 72 hours of discovery (in accordance with Art. 33 GDPR).
- ImmediatelyImmediate revocation of compromised OAuth tokens and invalidation of affected active sessions.
- 48hNotification to affected users within 48 hours if the breach presents a high risk to their rights (Art. 34 GDPR).
- ContactIncident reporting possible at any time via dpo@narratiq.fr or security@narratiq.fr.
Google data: use of sensitive scopes
NarratIQ uses the Google Analytics Data API (GA4) via OAuth 2.0. The information below details exactly how Google data is handled, in compliance with the Google API Services User Data Policy.
Google OAuth scopes requested
https://www.googleapis.com/auth/analytics.readonlyRead-only access to GA4 metrics from your properties (sessions, page views, traffic sources, etc.) to generate your NarratIQ reports.
https://www.googleapis.com/auth/userinfo.emailVerification of your Google identity only. Not stored beyond authentication.
Specific commitments for Google data
Limited use
GA4 data obtained via Google scopes is used exclusively to generate reports and dashboards requested by the authenticated user who owns the relevant GA4 account.
No transfer to third parties
GA4 data is never sold, transferred or shared with third parties. It is not used for advertising, profiling or external machine learning.
No persistent storage
GA4 metrics are never stored in the database. Only an encrypted Redis cache (TTL 6-24h) is used to avoid repeated API calls. It expires automatically.
Immediate revocation
You can revoke access at any time from Settings → Integrations, or directly from your Google account (myaccount.google.com/permissions). Tokens are deleted immediately.
Read-only
NarratIQ never writes to your GA4 properties. Access is strictly limited to reading aggregated metrics. No GA4 configuration changes are possible from NarratIQ.
Encrypted tokens
Your Google OAuth tokens (access token and refresh token) are encrypted with AES-256-GCM before any storage in the database. They are only decrypted at the time of the server-side API call.
Amendments
Any material change will be indicated on this page via the update date and, where possible, notified to active users. The current version is always accessible at this URL.
Current version: 1.3, updated 21 May 2026.