Privacy Policy

Last updated: October 20, 2026

I. Definitions

Capitalized terms have the meaning given to them in the Terms of Service, unless this Policy states otherwise.

II. Data controller

1. The controller of personal data processed in connection with the use of the AlertGA4 Service is:

Bettersteps spółka z ograniczoną odpowiedzialnością
ul. Domaniewska 47, 02-672 Warsaw, Poland
KRS: 0001011888 · NIP (Polish tax ID): 5214000359 · REGON: 524154200
Email: kontakt@bettersteps.pl

The Operator has not formally appointed a Data Protection Officer. For all matters relating to personal data protection, please contact kontakt@bettersteps.pl directly.

III. What data we collect

When you sign in with a Google account, we receive and store:

• Basic profile data — your name and email address, used to identify your Account.
• An OAuth access token and refresh token, scoped to https://www.googleapis.com/auth/analytics.readonly — read-only access to Google Analytics (the "Viewer" role). This does not let us change, delete or export the raw event data of your GA4 property beyond the aggregated metrics our checks calculate.
• Data of the GA4 property you choose to monitor — property identifiers and aggregated check results (event counts, the quality score, pass/warn/fail status).
• Configuration you enter yourself — Project names, the event and parameter checks you define, alert thresholds, and the email addresses of alert recipients.
• Billing data — when you purchase a Subscription Plan, the data needed to process payment and issue an invoice, processed in that scope by our payment service provider acting as an independent data controller (card data never reaches our servers).
• Technical data — IP addresses and request timestamps, processed by our infrastructure providers for security, diagnostics and abuse prevention, under their own retention policies.

We do not request any other scope of access to Google APIs, and we never ask for your Google account password.

Data of third parties you name. If you name another person's email address (e.g. a client's or a colleague's) as the alert recipient for a given Project, we process that address solely to send notifications about that Project. You are responsible for having a legal basis to give us that address — see chapter VIII of the Terms of Service.

IV. Purposes and legal bases for processing

We use the data above solely to operate the Service:

• running the daily and manual quality checks configured for your GA4 property;
• calculating your implementation's quality score and showing it in the dashboard;
• sending email alerts (to you and, for per-project alerts, to a configured recipient address) when the score drops below a set threshold, plus a daily combined summary;
• automatically refreshing the Google access token, so scheduled checks keep working without you having to sign in again;
• handling payments and billing for the Subscription Plan you chose;
• handling requests and complaints sent to kontakt@bettersteps.pl.

We do not use your data for advertising purposes, we do not build behavioral profiles from it, and we do not sell it.

The legal basis for processing is:

• performance of the contract to provide the Service (GDPR Art. 6(1)(b)) — for operating the Service and billing;
• our legitimate interest in ensuring security, the Service's correct operation, and pursuing any claims (GDPR Art. 6(1)(f));
• a legal obligation on the Operator (GDPR Art. 6(1)(c)) — to the extent tax and accounting law requires keeping billing records.

V. Who has access to your data

Projects, their configuration and check history are private to the Google account that created them. Other AlertGA4 users — even while signed in — cannot see your Projects, your GA4 data, or your stored Google tokens. Access is enforced at the database level (row-level security), not just in the application's interface.

If you use the public link-sharing feature for a report (the /share/[token] page), anyone holding that link can view the report it contains without signing in. You are responsible for who you give that link to.

VI. Entities processing data on our behalf

To run the Service we rely on trusted providers, to whom we entrust data processing only to the extent necessary to deliver the Service. These are, in particular:

• providers of authentication services and Google API integrations (sign-in, reading your analytics property's data),
• cloud infrastructure providers, including databases and hosting,
• email delivery providers,
• payment service providers.

Each of these providers processes data solely on our documented instructions and is not authorized to use it for its own purposes. Details of the specific providers we use are available on request at kontakt@bettersteps.pl. We will update this Policy if our use of such providers changes materially.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: data read from your GA4 property is used solely for the functions described in this policy, is never used to train machine learning models or for advertising purposes, is never sold or shared with unauthorized third parties, and is accessible only to people who need it to maintain the Service.

VII. Transfers outside the European Economic Area

Some of the providers referred to in Section VI may process data on servers located outside the European Economic Area, including in the United States. Such transfers rely on GDPR-compliant mechanisms — in particular the standard contractual clauses approved by the European Commission (GDPR Art. 46(2)(c)) or European Commission adequacy decisions (GDPR Art. 45). Information about the safeguards applied, and a copy of data transferred to third countries, can be obtained by contacting kontakt@bettersteps.pl.

VIII. Cookies

The Service uses cookies in the following categories:

• Necessary — required for the Service to work, in particular the cookie that keeps a signed-in User's session. Without these, signing in and using the Service is not possible.
• Analytics — used to measure traffic and how the Service is used, set via Google Tag Manager.
• Marketing — used to measure the effectiveness of advertising and to show content matched to the User's interests.
• Functional — remember the User's choices and preferences, including their cookie-consent decision.

Necessary cookies, being required to provide the service the User requested, do not require consent under Art. 173(3)(2) of the Polish Telecommunications Law. Analytics, marketing and functional cookies are installed only after the User consents, via the banner shown on their first visit. Consent can be withdrawn or changed at any time, either in the settings available in the Service's footer ("Cookie settings") or directly in the browser's own settings.

Disabling cookies in the browser will prevent signing in to, and using, the Service.

IX. Retention and deletion of data

We keep Account and Project data for as long as the Account stays active. Deleting a Project immediately and permanently erases its configuration and check history. You can revoke AlertGA4's access to your Google account at any time in your Google account settings. To request complete deletion of your Account and all associated data, write to kontakt@bettersteps.pl. Billing data is kept for the period required by tax and accounting law.

For data with a narrow, predefined purpose, we use shorter, automatic retention periods:

• Check history and sent-alert logs — deleted automatically 40 days after the check ran or the alert was sent; this covers the longest range the app actually uses (trend comparisons and the history shown in the dashboard).
• Contact-form submissions (IP address, solely to limit abuse) — deleted automatically after 7 days.
• Trial cancellation survey responses — deleted automatically after 180 days.

X. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it,
• have inaccurate data corrected,
• erasure of your data ("the right to be forgotten"),
• restriction of processing,
• data portability,
• object to processing based on our legitimate interest,
• lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, UODO), or with your own country's supervisory authority.

To exercise these rights, write to kontakt@bettersteps.pl.

XI. Security

OAuth tokens and Project data are stored in an access-controlled database and are never exposed in the browser beyond what's needed to display your own Projects. All traffic to the Service is encrypted via HTTPS.

XII. Children

AlertGA4 is a business tool and is not directed at, or knowingly used by, anyone under 16 years of age.

XIII. Changes to this policy

If we make material changes to this Policy, we will update the date at the top of this page and, where feasible, notify Users electronically. Continued use of the Service after changes take effect constitutes acceptance of them.

XIV. Contact

Questions about this Policy or your data: kontakt@bettersteps.pl · www.bettersteps.pl