Privacy policy | Revenue Driver Tree

Revenue Driver Tree reads your Google Analytics 4 (GA4) data and shows it to you as a report. This page says what we handle, why, for how long, and who else is involved. It covers this website and the app you sign in to.

In short: your GA4 figures go from Google to your own browser, and are kept only there, encrypted. Our server passes them along and does not store or log them. What we do keep on our side is small: who bought what, and which GA4 accounts and properties it covers, so that access can be switched on and off.

Who we are

The controller of personal data described here is Simon Mortensen, sole proprietor, Simrishamnsgatan 12A, 214 23 Malmö, Sweden. For anything on this page, write to revenuedrivertree@gmail.com.

What this covers

The app works on totals: sessions, orders, revenue and similar figures, split by channel, device and product. It does not read anything about individual visitors to your shop, and cannot change anything in your Analytics account. The personal data we handle is about you, the person who signs in or buys: your Google account id, your payment records, and what your browser sends us when it visits.

The app is for business use. It is not meant for anyone under 18, and we do not knowingly collect data from children.

What we process, why, and for how long

Visiting this website

What	Why, and on what basis	How long
Request logs kept by the host, Vercel: your IP address, the time, the page asked for, the status and your browser's user agent.	To deliver and secure the site. Our legitimate interest (GDPR Art. 6(1)(f)).	1 day (Vercel runtime logs on the Pro plan).
Video: only if you press play on an embedded video, your browser loads it from YouTube (`youtube-nocookie.com`), which then receives your IP address and browser details. Nothing is requested from YouTube before that.	You asked for the video by pressing play.	Under YouTube's own policy.

This site sets no cookies and runs no analytics or advertising code.

Signing in and using the app

What	Why, and on what basis	How long
Your Google account id and a Google sign-in token. The token is encrypted and held in a cookie in your browser, which the page's scripts cannot read. Our server keeps no copy.	To let you sign in and fetch your data. Contract (Art. 6(1)(b)).	Until you sign out, after 12 hours without opening the app, and 7 days at most.
Your GA4 account and property names and ids, each property's currency, and daily totals for the last 25 months: sessions, users, transactions, revenue and items purchased, split by channel, device and new or returning users. The checkout funnel. Products: ids, names and categories with their views, carts, checkouts, purchases and revenue.	To build your report. Contract (Art. 6(1)(b)).	Only in your browser, in IndexedDB, encrypted. Removed when you press Delete local data, when you clear this site's data, or the first time the app is opened more than 30 days after the last fetch. If you never open it again, it stays in that browser until you delete it. Our server holds no copy of the figures. Only the account and property ids in the records below are kept on our side.
Exchange rates: when the properties you chose report in more than one currency, our server asks api.frankfurter.dev for European Central Bank rates. It sends the dates and currency codes only, never your data, cookies or tokens, and never your IP address.	To combine currencies. Contract (Art. 6(1)(b)).	Not stored by us.
Request logs kept by Vercel, which hosts the app: your IP address, the time, the address asked for, the status and your browser's user agent. The address Google sends you back to after sign-in carries a one-time sign-in code. Your Analytics data is not in these logs: it travels in the body of a request or response, not in the address.	To deliver and secure the app. Our legitimate interest (Art. 6(1)(f)).	1 day (Vercel runtime logs on the Pro plan).
If your browser blocks something on these pages, it sends our server a short report. We log the page path, the origin of the blocked address and the rule that blocked it, and nothing else: never the query string, your data, or the report's other contents. Vercel's request logs, above, record the report request like any other.	To keep the app secure. Our legitimate interest (Art. 6(1)(f)).	Kept in the function log, for the same period as the request logs.

Buying access

Access is sold per GA4 account. When paid access is on, we keep these records on our side:

What	Why, and on what basis	How long
One record per paid GA4 account, in Upstash's database: the account id, the plan and when it ends, the Google account id of the buyer, and the buyer's Stripe customer and subscription ids.	To switch access on and off, and to let only the buyer manage billing. Contract (Art. 6(1)(b)).	While the plan runs and for 24 months after it ends, then deleted.
One record per trial, in Upstash's database: the property id, the month the trial covers, when it started and ends, the GA4 account it belonged to, and the Google account id of whoever started it.	To stop a second trial of the same property. Our legitimate interest (Art. 6(1)(f)).	24 months after the trial ends, then deleted. After that the property can be tried again.
Payment details. You enter them on Stripe's pages. We never see them. Stripe tells us that a payment happened, for which plan, and gives us customer and subscription ids.	To take payment, issue invoices and keep accounts. Contract and legal obligation.	We keep invoices and accounting records as long as tax and accounting law requires. Stripe keeps its own records, including the account id and Google account id we send it, under its own retention rules.

Everyone whose Google sign-in can read a paid GA4 account sees that account's plan and end date, and whether they are the one who manages it. They never see the buyer's id.

Writing to us

If you email us, we use your address and what you write to answer you. Contract or our legitimate interest (Art. 6(1)(b), (f)). It is handled by Google (Gmail) and kept for: 12 months after the last message..

How the app is used

The app sends usage events, to see which parts are used, through Google Tag Manager. The tag runs in a separate, sandboxed frame that cannot read the page, your stored data or our server. Consent for analytics and advertising storage is denied from the start, so no analytics cookie is set and the events reach Google without an identifier for your browser. Our legitimate interest (Art. 6(1)(f)).

The events record steps and actions: screens opened, tabs, date ranges, currencies, filters, and how far through a guided tour you got. They never name a property, an account or a product, and never carry a figure from your data. A traffic-source name your business chose is sent asREDACTED. No advertising code runs.

Google Analytics keeps these events for 14 months (the GA4 property's data-retention setting)..

Google data and Limited Use

When you sign in with Google, the app asks for read-only access to Google Analytics (https://www.googleapis.com/auth/analytics.readonly) and for the openid andemail sign-in scopes. We use them as follows.

Analytics read-only: to read your GA4 account and property names and the figures listed above, so the app can show them to you.
openid and email: to identify your sign-in to our server. The app does not read or keep your email address, and does not ask for your profile. It recognises its own administrators by their Google account id.

We use Google user data only to show it to you in the app. No person at Revenue Driver Tree reads it: it passes through our server to your browser and is not stored or logged there. We do not use it for advertising, we do not sell it, we do not use it to train machine-learning models, and we do not pass it on to anyone except as needed to provide the report you asked for, to follow the law, or as part of a sale of the business, after telling you.

Revenue Driver Tree's use and transfer of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

If we ever change how we use Google user data, we will tell you and ask for your agreement to the updated policy before the new use begins. You can see and remove the app's access at any time atmyaccount.google.com/connections. Removing it ends the app's access to your Analytics data.

Cookies and browser storage

This site sets no cookies. The app uses only what it needs to work, so it does not ask for consent.

A cookie holding your encrypted sign-in (__Host-session). It is HttpOnly, Secure and SameSite=Strict, and lasts as described above.
IndexedDB, in your browser, for your stored GA4 figures, encrypted with a key tied to your Google account that our server gives the page only while you are signed in. Signed out, nobody using that browser can read them. Which property ids and months are stored, and when, is kept unencrypted.
localStorage for which help tours you have seen, and sessionStorage to remember what you were doing while a sign-in is under way. Neither holds Analytics data.

On a shared or public computer, press Delete local data when you finish and sign out of your Google account.

Who else receives data

Google: sign-in and the Analytics Admin and Data APIs, and Tag Manager and Analytics for the usage events described above. Google's handling is covered byGoogle's privacy policy.
Vercel: hosts the app and runs its server functions, and hosts this website, and keeps request logs.
Stripe: takes payment and holds the payment details. We send it the GA4 account id and your Google account id so a purchase can be matched, and it gives us customer and subscription ids. Stripe keeps its own copy of what we send it, under its own retention rules.Stripe's privacy policy.
Upstash: stores the access and trial records. It holds no Analytics data.
api.frankfurter.dev: exchange rates, called by our server only. No personal data.
YouTube: only if you press play on a video here.
Google (Gmail) (email) and our accountant, who receives invoice records.

These companies act for us as processors, or, for Google and Stripe, for their own purposes as well. We do not sell your data and do not share it for advertising.

Where data is processed

We are based in Sweden, and most of the companies above are in the United States, so your data may be processed in either, and in other countries where those companies run their services. Where the law requires a safeguard for such a transfer, for example for people in the EU, the EEA, the United Kingdom or Switzerland, we rely on the EU-US Data Privacy Framework where the company is certified, and on the European Commission's standard contractual clauses where it is not. You can ask us for a copy of the safeguard that applies.

Your rights

You can ask us for access to your personal data, to correct it, to erase it, to restrict how we use it, to receive it in a portable form, and to object to processing that rests on our legitimate interest. Where we rely on your agreement, you can withdraw it. Write torevenuedrivertree@gmail.com. We answer within one month.

If you live in a US state with a privacy law, such as California, Colorado or Virginia, you can ask us what personal information we hold about you, for a copy of it, and to correct or delete it. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of, and we do not treat you differently for asking. Elsewhere, we give you the same rights where we can.

Some of this you can do yourself, at once.

Delete local data in the app removes your stored figures from that browser and revokes the sign-in at Google.
Sign out ends the sign-in and revokes it at Google.
Records on our side (access, trial and payment records) can be deleted on request, except where the law makes us keep them, such as invoices. Deleting a paid-account record ends that account's access.

If you think we handle your data wrongly, please write to us first. You can also complain to the data protection authority where you live, or, in the United States, to your state's attorney general. Where we are based, that is the Swedish Authority for Privacy Protection (IMY, imy.se).

How we protect it

Your stored figures are encrypted in your browser (AES-GCM) with a key tied to your Google account.
The page never receives a Google token. The server holds it, encrypted, in a cookie the page's scripts cannot read. The app does not put it in a web address, your history or the page.
The server passes your GA4 data along and does not store or log it.
No third-party scripts run on the page that holds your data.
A strict content security policy limits what the page can load and where it can send things.

Other things to know

You do not have to give us any of this, but without the Google sign-in, and without the records of a purchase, we cannot give you the app or its paid access.
We make no decisions about you by automated means that have legal or similar effects.
The site and the app do not track you across other websites, so a Do Not Track or Global Privacy Control signal changes nothing: there is nothing to opt out of.

Changes to this policy

We update this page when the app or the law changes, and show the date at the top. For a change that matters to you, such as a new use of your data, we tell you before it applies. If the change affects how we use Google user data, we ask for your agreement first.

Contact

Simon Mortensen, sole proprietor, Simrishamnsgatan 12A, 214 23 Malmö, Sweden.revenuedrivertree@gmail.com.