Privacy policy

The controller of your personal data is CoreIT Patryk Langer, ul. Witosa 10/1, 44-218 Rybnik, Polish tax ID (NIP) 6423253467 (“we”). For anything about personal data, write to kontakt@goodads.pl.

This policy covers the goodanalytics app (for iPhone, and later in the browser) and the goodanalytics.pl website. goodanalytics is a goodads product.

If you use goodanalytics on behalf of your clients (for example as an agency or freelancer), we process your clients’ data on your instructions, as a processor. The data processing agreement we sign with you sets out the rules.

Account data

Your e-mail address, name, language and time zone. If you sign in with Google, Google shares only your e-mail address and name with us.

Workspace and client data

Client names, which accounts belong to which client, dashboard and report settings, e-mail addresses of report recipients, website addresses for PageSpeed checks and a logo, if you add one.

Google user data

With your consent, we fetch only the data our dashboards and reports need through Google APIs:

• Google Ads – the accounts you can access and data about campaigns and their performance (e.g. impressions, clicks, cost, conversions and conversion value).
• Google Analytics – your GA4 accounts and properties and reports (e.g. users, sessions, traffic sources, events, conversions).
• Google Search Console – your sites and search performance data (queries, pages, clicks, impressions, CTR, average position).
• Google Business Profile – your locations and their performance data (e.g. views, calls, direction requests, website clicks).
• OAuth tokens – access and refresh tokens that let us fetch data without your password.

PageSpeed results

For the website addresses you add, we save PageSpeed Insights results (score, Core Web Vitals, date of the check). This is public data about the website, not data from your Google Account.

Technical data

Server logs: IP address, request time, device and app type, error codes. Logs never contain tokens or the contents of your marketing data.

This version of the policy does not cover other data sources (such as Meta Ads) or payments. We will update it before we add them.

Access

We get access to Google data through OAuth 2.0, only after you sign in with Google and approve the permissions on Google’s consent screen. We ask only for the permissions needed to read data. For Google Analytics and Search Console we use read-only scopes. Google Ads and Google Business Profile offer a single scope that also allows changes – goodanalytics uses it to read data only and never creates, changes or deletes anything in your accounts.

Use

We use Google data only to show you the dashboards, period comparisons and reports you ask for in the app, and to send reports to the people you choose. We do not use it for advertising, profiling, selling or training artificial intelligence models. Our staff do not read your data unless you agree (for example when you report a problem), it is needed for security (for example to investigate abuse) or the law requires it.

Storage

We store data on servers in the European Union. OAuth tokens are encrypted (AES-256-GCM) and never reach the app on your phone. We cache data from the APIs only as long as needed to show your dashboard quickly, and keep historical data (such as PageSpeed history and sent reports) while you have an account or connection. See “How long we keep data” for details.

Sharing

We do not sell Google data and do not pass it to advertisers, data brokers or other companies. We share it only:

• with the people you show it to – members of your workspace and report recipients;
• with providers that run the service for us, only for that purpose: server hosting, database and PDF report generation (servers in the EU): OVHcloud; e-mail delivery (reports, sign-in codes): Resend; DNS, protection and website delivery (CDN): Cloudflare;
• when the law or a valid order from an authority requires it;
• in a merger or sale of the business – the data stays protected by this policy and we will tell you in advance.

Limited Use

goodanalytics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Running your account and providing the service (dashboards, reports, Google connections) – contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention, logs and support – our legitimate interest (Art. 6(1)(f) GDPR).
• Establishing and pursuing legal claims – our legitimate interest (Art. 6(1)(f) GDPR).
• Legal obligations, such as tax rules – legal obligation (Art. 6(1)(c) GDPR).

• Account and workspace data – while you have an account; deleted within 30 days after you delete it.
• Google data – while the connection is active. When you disconnect your Google account we delete the OAuth tokens immediately and the data fetched through that connection within 30 days.
• Server logs – up to 30 days.
• Backups – overwritten within 30 days after data is deleted from the system.

Deleting your account and data

Delete your account in the app settings. You can also write to kontakt@goodads.pl from the address linked to your account – we will delete the account and data within 30 days and confirm by e-mail.

Revoking Google access

You can revoke access at any time: in the app (by disconnecting your Google account) or in your Google Account: Google Account → Security → Third-party apps and services, at myaccount.google.com/permissions.

After you revoke access we can no longer fetch data from Google. Client dashboards and reports that used the connection stop updating, we delete the tokens immediately and the data fetched earlier within 30 days.

• Encryption in transit (HTTPS/TLS) and at rest; OAuth tokens are also encrypted with AES-256-GCM.
• Access control: each workspace sees only its own clients and data, and team members’ permissions depend on their role.
• Minimal access: only people who need it can access production systems.
• Logs without passwords, tokens or the contents of marketing data.
• Regular software updates and dependency reviews.

You have the right to access, correct and delete your data, to restrict its processing, to data portability and to object to processing based on legitimate interest. Write to kontakt@goodads.pl – we reply within one month.

You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (uodo.gov.pl).

We store data in the European Union. If a provider ever processed data outside the European Economic Area, we would protect it with the European Commission’s standard contractual clauses.

The goodanalytics.pl website uses no tracking or analytics cookies and loads no third-party scripts. The app stores on your device only what it needs to keep you signed in.

goodanalytics is a business tool. It is not meant for anyone under 16.

When we change this policy we update the date at the top of the page. We will tell you about important changes in the app or by e-mail before they take effect. This policy is effective from 15 November 2026.