1. About This Policy

This Privacy Policy explains how we (“MRRTrack”, “we”, “our”) collect, share, and use your personal information when you use our website mrrtrack.com (the “Site”) or subscribe to our services as a customer or provider.

2. Personal Information We Collect and Why

The types of personal information we collect about you and the reasons we process them are as follows:

• Email address, electronic identification data (including when you sign up via Google or Outlook):
  • Why we collect it: To provide our services to our clients (including free trial users), manage access to our services, and enable sharing features.
  • Legal basis for processing: Contractual necessity.
• Identification data, electronic identification data, and internet connection usage data:
  • Why we collect it: To generate business and usage statistics related to our services.
  • Legal basis for processing: Our legitimate interest in understanding our service’s popularity to optimize visibility and user interface.
• Identification data, electronic identification data, and internet connection usage data:
  • Why we collect it: To provide personalized responses to your information requests via chatbot or direct contact.
  • Legal basis for processing: Our legitimate interest in responding to inquiries.
• Email address, identification data:
  • Why we collect it: To manage our relationship with clients and providers (including invoicing and payments).
  • Legal basis for processing: Contractual necessity.
• First and last name, email address:
  • Why we collect it: To send you marketing updates and messages about our services.
  • Legal basis for processing: Consent (unless a legal exception applies, in which case we rely on our legitimate interest to promote our services).
• Any information relevant or potentially relevant to litigation or legal proceedings involving us:
  • Why we collect it: For litigation and legal proceedings.
  • Legal basis for processing: Our legitimate interest in defending our rights and interests in court.

Internal account-journey reporting

For our internal acquisition and account-journey reporting, we associate your recorded first landing URL, campaign parameters and initial referrer with your account, where available. Authorised administrators can review recorded page visits, pricing activity, checkout attempts and payment records with their timestamps. Missing historical activity is not treated as proof that an action did not occur. This internal reporting is separate from optional OpenAI advertising measurement.

Advertising measurement with OpenAI

With your permission, we use the OpenAI advertising pixel and Conversions API to measure registrations, checkout starts and completed payments, and to optimise our advertising. This may involve OpenAI advertising and browser identifiers, event timestamps, purchase amounts and currencies, and a SHA-256 hash of your normalised email address. Hashing does not make these identifiers anonymous.

OpenAI measurement is disabled until you allow it. You can decline or withdraw permission using the "Ad privacy" control on our pages. We also honour Global Privacy Control and Do Not Track signals for this integration. Withdrawing permission stops future OpenAI measurement; it does not retract events already delivered.

We retain local delivery records and checkout attribution for up to 90 days, and your consent record for up to 180 days after its last update. Delivered event payloads are cleared from our delivery queue. OpenAI processes information it receives under its Privacy Policy.

3. YouTube API Services and Public YouTube Data

3.1. Data accessed and stored

MRRTrack accesses public, non-authorized data through the YouTube Data API. Depending on the available result, this may include video IDs and URLs, titles, descriptions, thumbnails, publication dates, channel names and channel IDs, and public statistics such as view, like, comment and subscriber counts. MRRTrack does not currently ask users to connect a YouTube or Google account and does not access private videos, viewing history, account credentials or other authorized YouTube account data.

3.2. How we use and disclose YouTube API Data

We use this public API Data to identify videos and creators that mention, review or link to software products, to organise those results within SaaS product profiles, and to provide creator and reach analytics. Relevant public API Data is displayed to visitors and customers of MRRTrack. We do not sell YouTube API Data as a standalone dataset, download or rehost YouTube videos, or use it to make decisions about sensitive characteristics. Requests to YouTube API Services are processed by Google under the Google Privacy Policy.

3.3. Retention, refresh and deletion

Stored YouTube API Data is refreshed or deleted within 30 calendar days. If a video or other resource can no longer be verified through YouTube API Services, its stored metadata is removed from MRRTrack. Public statistical data is also refreshed or deleted within this period unless YouTube expressly approves a longer retention period for MRRTrack under its additional data-storage policies.

A creator or other data subject may request deletion of YouTube-related data displayed by MRRTrack by contacting us at [email protected] and identifying the relevant channel or video. After reasonable identity and scope verification, we will delete applicable data from MRRTrack as soon as possible and within 7 calendar days. Deletion from MRRTrack does not delete or alter content stored by YouTube; requests concerning content on YouTube must be made through YouTube.

3.4. Future account authorisation

MRRTrack does not currently use YouTube OAuth or Authorized Data. If this changes, this Policy and the consent flow will be updated before launch. Users would also be able to revoke Google account access from their Google security settings.

4. Sharing Personal Data by MRRTrack

We may share your personal information with the following categories of recipients:

• Our third-party service providers who process data on our behalf, including billing and payment services, customer support, website hosting, marketing and newsletters, and data analytics.
• Any competent law enforcement authority, regulatory agency, government agency, court, or third party when we believe disclosure is necessary: (i) to comply with applicable law or regulation, (ii) to assert, exercise or defend legal rights, or (iii) to protect your vital interests or those of another person.
• Our auditors, advisors, legal representatives, and similar agents in connection with advisory services they provide for legitimate business purposes, subject to contractual restrictions on using personal data for other purposes.
• A potential buyer (and its agents and advisors) in connection with any proposed purchase, merger, or acquisition of any part of our business, provided the buyer is informed to use your personal data only for the purposes disclosed in this Policy.
• Any other person with your prior consent to disclosure.

5. Protecting Your Privacy

We will process personal data in accordance with this Policy as follows:

• Fairness: We process personal data fairly, meaning we are transparent about how we process personal data and will comply with applicable law.
• Lawfulness: We process personal data only on lawful bases.
• Purpose limitation: We process personal data for specific, legitimate purposes and not in a way incompatible with those purposes, except as permitted by applicable data protection laws.
• Data minimization: We process personal data adequate, relevant, and limited to what is necessary for the purposes we process it.
• Data accuracy: We take reasonable steps to ensure personal data we hold is accurate, complete, and kept up to date. It is also your responsibility to keep your personal data accurate and inform us of any changes or errors (e.g., change of email address).
• Data security: We use appropriate technical and organizational measures to protect the personal data we collect and process. These measures are designed to provide security proportionate to the risks involved.
• Limited retention: We retain personal data only as long as necessary for the purposes we process it and do not keep data longer than required unless mandated by law.

6. Data Storage, Retention and Deletion

We retain personal data collected from you while we have a legitimate business need to do so (for example, to provide the services you requested or to comply with applicable legal, tax, or accounting obligations). Client data is retained for up to 2 years following the end of our contractual relationship. However, accounting-related personal data is retained for up to 10 years.

When we no longer need to process your personal data for legitimate business needs, we delete or anonymize it. If that is not possible (e.g., because your data is stored in backup archives), we securely store and isolate your personal data from further processing until deletion is possible.

7. International Data Transfers

Your personal data may be transferred to and processed in countries other than the one where you reside. These countries may have different data protection laws and may not offer the same level of protection.

Specifically, our servers are located in France, and our third-party service providers operate within the EU and the United States. This means your personal data may be processed in one of these countries.

However, we have taken appropriate measures to ensure your data remains protected under this Policy. This includes implementing the European Commission’s standard contractual clauses for data transfers with our third-party service providers and partners. Further details are available upon request.

8. Your Data Protection Rights

You have the following data protection rights:

• You may request access to, correction, updating, or deletion of your personal data at any time by contacting us at [email protected].
• In certain circumstances under applicable data protection laws, you may object to processing, request restriction of processing, or request portability of your personal data. You may exercise these rights by contacting us at the email above.
• If we have processed your personal data based on your consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of prior processing or processing based on other legal grounds.
• You may unsubscribe from marketing communications at any time by clicking the "unsubscribe" or "opt-out" link in the emails we send.
• If you have concerns or complaints about how we process your data, we will try to address them. If unresolved, you have the right to lodge a complaint with your local data protection authority.

9. Links to Other Websites

The Site may contain hyperlinks to websites operated by third parties. These websites have their own privacy policies, which we encourage you to review. They govern how personal data is handled when you visit those sites.

We assume no responsibility or liability for the privacy practices of third-party websites. Your use of such sites is at your own risk.

Last updated: September 5, 2026