Privacy Policy

Effective date: 21 October 2026

1. Who we are

Fanalytics (www.fanalytics.app) is operated by Metsander.nl, based in the Netherlands.

Our role. For your account data and the technical data in section 2, Metsander.nl is the data controller. For the content you put into Fanalytics and the results we produce from it (prompts, brands, AI answers, and the Search Console data of a site you link), we work on your behalf: if that content contains personal data, you or the company you work for is the controller and Metsander.nl is the processor. We then process it only to provide the service to you. Business customers can ask us for a data processing agreement (verwerkersovereenkomst).

Contact: sander@metsander.nl

Using Fanalytics is also subject to our Terms of Service.

2. What we collect

Account data

• Your email address and a hashed version of your password. We never store your password itself.
• Account status and role, such as whether your email is verified and your access level.
• When you signed up and when you last used Fanalytics.

Data you create in Fanalytics

• The groups, prompt sets, prompts, brands and schedules you set up.
• The answers AI services give to those prompts, and what we derive from them: brand mentions, citations, sentiment and similar analysis.
• Your settings, such as which reports you receive by email.

Fanalytics is built for questions about brands and markets, not about individual people. Prompts are sent to the AI services in section 5. Do not put other people's personal data, or sensitive data such as health, financial or identity details, into prompts, brand names or other fields. You are responsible for the content you enter.

API keys you add

If you add your own keys for AI or data services, we store them encrypted and use them only to run the requests you set up.

Technical data

• A login cookie that keeps you signed in (see section 7).
• Your IP address, briefly, to limit repeated login attempts and protect the service. We store it only as a one-way hash in short-lived counters, not in readable form.
• Server error logs, which may contain the page you requested and when.

3. How we use your data

• To run your account and the features you use, including scheduled runs and reports.
• To send you service emails: account verification, password resets and the reports you are subscribed to. You can unsubscribe from reports at any time.
• To keep the service secure and working, and to fix problems.

We do not sell your data, use it for advertising, or build profiles of you.

Legal basis (GDPR). We process account and product data because it is needed to provide the service you signed up for. We process security data based on our legitimate interest in a safe, working service. We connect to your Google account only with your consent, which you can withdraw at any time.

4. Google user data

Connecting a Google account is optional. It is used for two features, each of which you turn on yourself.

Google Sheets

Sends weekly figures from Fanalytics to Google Sheets.

• What we access. Your Google account email address, the Google Sheets files that Fanalytics creates for you, and any folder or spreadsheet you choose yourself in Google's file picker (Google's drive.file permission). We cannot see, open or change any other file in your Google Drive.
• How we use it. We use your email address to show which Google account is connected. We use the file permission to create the spreadsheets you ask for and to write your Fanalytics figures into them. Nothing else.
• Storage. We do not copy the contents of your Google files to our servers.

Google Search Console

Compares how a website performs in Google Search with how AI services mention and cite it, so you can see which pages rank but are not cited by AI, which are cited but do not rank, and which topics have no page at all. Linking a site is optional: we only ask for this permission when you connect a Google account for Search Console, and nothing is fetched until someone links a site.

• What we access. Read-only access to Search Console (Google's webmasters.readonly permission): the list of sites you have access to, and the search performance figures of the one site you link to a group in Fanalytics. Those figures are search queries, pages (and which page shows for which query), clicks, impressions, click-through rate and average position. We cannot add, remove or change anything in Search Console, and we do not read sites you have not linked.
• How much and how often. Once a week, for the last 28 days and for the country of the group, we fetch at most the 1,000 pages and 10,000 search queries with the most impressions.
• How we use it. We match those pages and queries against the AI answers in the same group: which of your pages AI services cite, and which tracked prompts and AI search queries are about the same topic. Queries that contain your own brand name are left out. To find queries about the same topic, the query text (not the figures) is sent to Google's Gemini API, which turns it into a numeric representation (an "embedding") that we compare. The searches that match no tracked prompt are also sent, as text only, to the Gemini API to tell a question apart from a search for one specific name. To tell what kind of page each of your pages is (for example a list of offers or an article), its address and the searches it shows for are sent to the Gemini API once, without figures. The result is a weekly overview per page and per topic, and a list of searches that none of your tracked prompts covers yet.
• Who sees it. The overview belongs to the group the site is linked to, so everyone with access to that group sees it, including people the group is shared with. Linking a site therefore shows its search figures to those people. Only you, the group owner, or someone with edit rights on the group can link or unlink a site. Before linking, that person confirms they may share the site's search data with the group; once it is linked, everyone with access to the group gets an email saying which site was linked, by whom and what we read, before the first weekly fetch.
• Storage. The search performance figures as fetched from Google are deleted after 7 days. What we keep is the weekly overview derived from them (per page and per topic: its category, position band and the matching queries), for as long as the group exists, so you can follow changes over time. Embeddings of query text are kept per site and deleted when a query has not appeared for 8 weeks. The page type of each of your pages (for example "article") is kept, like the page types of the pages AI answers cite.

For both features

• Tokens. The access tokens Google gives us are stored encrypted.
• Sharing. We do not share, sell or transfer Google user data to anyone except as described above. We do not use it for advertising, and we do not use it to train AI or machine learning models.
• Removal. Disconnecting the Google account in Fanalytics revokes our access and deletes the stored tokens. Unlinking a Search Console site stops the weekly fetch and deletes the figures and embeddings we still hold for it; the weekly overviews already made stay with the group unless you ask us to delete them. You can also remove access at any time in your Google account permissions. Spreadsheets we created stay in your Drive, because they are your files.

Fanalytics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share data with

Only the service providers we need to run Fanalytics, and only what they need for their part:

Some of these providers are based outside the European Economic Area. Where that is the case, the transfer is covered by the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

If you share a group or dashboard with someone else in Fanalytics, they can see that data. You choose who.

If the business changes hands. If Fanalytics or Metsander.nl is merged, acquired or sold, or goes bankrupt, your data may pass to the new owner as part of that. The new owner must keep to this policy or one that protects your data at least as well, and we will tell you by email.

6. How long we keep data

• Account and product data: for as long as your account exists. When you ask us to delete your account, we delete it and the data that belongs only to you.
• Login sessions: up to 30 days, or until you log out.
• Rate-limit counters: a few minutes.
• Google access tokens: until you disconnect the Google account.
• Search Console figures as fetched from Google: 7 days. Weekly overviews derived from them: as long as the group exists. Query embeddings: until a query has not appeared for 8 weeks.
• Backups: removed in the normal backup rotation after deletion.

7. Cookies

We use only cookies that are needed for the site to work:

• ofo_session: keeps you logged in. Expires after 30 days or when you log out.
• A short-lived session cookie while you connect a Google account, to check that the request came from you.
• A few tools remember your last-used settings in a cookie on your own device.

We do not use analytics, advertising or tracking cookies.

8. Security

• All traffic uses HTTPS.
• Passwords are hashed. API keys and Google tokens are encrypted.
• Access to data is limited to your account, the people you share it with, and administrators who run the service.

Data breaches. If a security incident affects personal data, we report it to the Dutch data protection authority within 72 hours of discovering it whenever the law requires that, and we tell you without undue delay if it is likely to put your rights at high risk. For content we process on your behalf (see section 1), we tell you without undue delay, so you can meet your own obligations.

9. Your rights

Under the GDPR you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• limit or object to how we use it;
• send it to you in a portable format.

Email sander@metsander.nl. We reply within one month. You can also complain to the Dutch data protection authority, Autoriteit Persoonsgegevens.

10. Browser extension

The Fanalytics browser extension stores its data on your own device. It only sends conversation data to Fanalytics when you turn sharing on in its settings, and it does not use analytics or ads.

11. Children

Fanalytics is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.

12. Changes

If we change this policy, we update this page and the effective date at the top. We also tell account holders by email before the change takes effect if it changes what data we collect, what we use it for, who we share it with (for example a new service provider in section 5) or how long we keep it. Changes that only make the text clearer are published on this page without an email.