Security and data protection: GDPR, EU hosting, least access
Tracking Whisper keeps its data in the EU (Frankfurt), asks Google and Meta for read-only access first, stores tokens encrypted, separates every agency's data, and publishes a change only after a person approves it, or after an owner or admin turned on autopilot for low-risk changes.
EU hosting
The app's servers, the database and the files people attach are in Frankfurt. Data is read for the work you ask for and is not used to train models.
Least privilege first
Google connections start read-only. Edit and publish access are asked for only from a client's access page, after an owner or admin moved that client up.
- Read: the agent looks and reports
- Read & write: it builds in its own workspace
- Publish: it puts changes live after approval
Read only where it only needs to read
Google Ads, Search Console, BigQuery and Meta are read only in Tracking Whisper. Each one is asked for only when you allow it for an account, and Google Sheets access covers only the spreadsheets a person picks.
Tokens and keys
Google and Meta refresh tokens and the secrets of share links are encrypted with AES-256-GCM, bound to the record they belong to, with the key held outside the database. Everything between your browser, the app, its database and its browser worker travels over an encrypted connection.
Separation and audit trail
Every query is scoped to the signed-in person's agency, and every action of a person or the agent is written to the client's activity log.
Limits on the agent
What the agent may do for a client is limited three times: by the permissions asked of Google, by the tools it is given, and by a check when a tool runs. Text from outside, such as a website, a container or a file, reaches the AI model as data, never as instructions.
- It changes Tag Manager only in a workspace of its own
- A conversation that read a website gets no tool that writes
- Every published version can be rolled back
AI models and GDPR
The AI model that works on a task receives what the task needs: your request, the facts it read and the text of attached files. The model providers are listed as sub-processors with where they process data, which can be outside the EU. On our keys we use their paid API services, under terms that do not let them train on what is sent.
Deleting
A client, the whole agency or a person's account can be deleted from inside the app, with everything that belongs to it. Removing a Google connection erases its token at once and asks Google to take the access back.
Questions
Where is our data stored?
In the EU, in Frankfurt.
Is there a data processing agreement?
Yes. The data processing agreement and the list of sub-processors are published with the terms.
How does Tracking Whisper handle GDPR?
Data is stored in the EU, access starts read-only, and you can delete a client or the whole agency from inside the app. Where a sub-processor works outside the EU, the transfer relies on a safeguard the law provides, such as the standard contractual clauses.
Is our data used to train AI models?
No. Data from Google and Meta is used only for the work you ask for. It is not used for advertising, not sold and not used to train AI models.
Can the agent publish on its own?
Only if an owner or admin turned on autopilot for a client on the Publish level, and then only for builds in which every change is low risk. Without autopilot, every publish waits for a person.
Who can see a client's data?
The members of your agency, and anyone you send a share link to, who sees that one report only. Every agency's data is kept apart from every other agency's.