Privacy Policy

MetraClick — a service operated by KohlerCode LLC

Last updated: 27 October 2026

This Privacy Policy explains how KohlerCode LLC ("KohlerCode", "we", "us", "our") collects, uses, shares, retains and deletes personal data in connection with:

  • the MetraClick website at https://metraclick.com,
  • the MetraClick MCP service at https://mcp.metraclick.com (together, "MetraClick"), and
  • the "Sign in with Google" function offered on both.

It applies to visitors of the website, to account holders, and to anyone using a workspace created under an account. MetraClick is the name of the application submitted for verification. KohlerCode LLC is the developer of that application and the controller of the data described here.

1. Who we are and how to contact us

KohlerCode LLC 30 N Gould St, Ste R, Sheridan, WY 82801, United States

Email: hello@kohlercode.com

For privacy requests, write to the same address with the subject line "Privacy request". We answer within 30 days. EU and UK residents may also contact their local data protection authority.

2. The data we collect

We collect only what the service needs to run. The categories are:

  • Account data. Your full name, email address, profile picture URL, Google account identifier and email verification status, received when you sign in with Google; or your email address and a hashed password when you use a MetraClick account.
  • Workspace data. Workspace name, API keys (stored hashed), which tools are enabled, your plan and your quota.
  • Usage data. Which tool was called, when, how many times, by which workspace, and whether the call succeeded. This record is what produces your usage page and your invoice.
  • Content and business data you process through the tools. Page content, CMS pages and articles, CRM records, uploaded or indexed documents, and knowledge-base entries. This data belongs to you and we process it on your instruction.
  • Billing data. Plan, invoices, payment status, billing email and billing country. Card data is entered on our payment provider's page and never reaches our servers.
  • Support data. Messages you send us, and the reply.
  • Technical data. IP address, client type and version, request timestamps, error and security logs.

We do not collect special categories of personal data (health, religion, political opinions, biometric data) and we do not ask you to send them. We do not knowingly collect data about children.

3. What Google user data we access

When you choose "Sign in with Google", MetraClick requests these OAuth scopes only:

  • openid — to identify your account,
  • email — to receive your email address and whether it is verified,
  • profile — to receive your name and profile picture.

From that request we receive and store: your name, your email address, your profile picture URL, your Google account identifier, and your email verification status.

We do not request and cannot access Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, YouTube, Google Ads, Google Analytics or any other Google service. MetraClick does not read, index, scan or store the contents of your Google Account. We use no Google Workspace APIs.

4. How we use Google user data

We use Google user data for these purposes only:

  1. To create your MetraClick account the first time you sign in.
  2. To authenticate you on every subsequent sign-in.
  3. To display your name and picture inside the account area.
  4. To send essential service emails, such as account confirmation, quota warnings and security notices.
  5. To prevent fraud and abuse, including rate-limiting account creation.

We do not use Google user data for advertising, retargeting, profiling, scoring, credit decisions or market research. We do not sell it. We do not use it to train, fine-tune or evaluate AI models. We do not allow humans to read it, except (a) when you ask us to in a support request, (b) where necessary to investigate a security incident, or (c) where the law requires it.

Our use of Google user data is limited to providing and improving the user-facing features of MetraClick. We do not use it for any purpose that is unrelated to those features.

5. Sharing, transfer and disclosure of Google user data

We do not sell, rent, trade or otherwise transfer your personal data or your Google user data to third parties for their own purposes.

We share data only with service providers that process it on our behalf, strictly to operate MetraClick:

  • Hostinger International Limited — server hosting. Our servers are located in Boston, Massachusetts, United States.
  • Google LLC — only as the identity provider that performs Google Sign-In.
  • Our payment provider — for paid plans only: invoicing and payment processing. Card data is handled entirely by them.
  • Our email delivery provider — transactional email only.
  • Our email and support inbox provider — to receive and answer your messages.

Each of these providers is bound by contract to use the data only to deliver its service to us, and not for its own purposes. We do not transfer Google user data to third parties for purposes other than providing or improving MetraClick's functionality.

We may also disclose data when required by law, by valid legal process, or when necessary to protect the rights, safety or property of our users, the public or ourselves. Where we are legally permitted to do so, we will tell you first. If MetraClick or KohlerCode LLC is merged, acquired or sells its assets, data may transfer as part of that transaction and remains subject to this policy.

6. How we protect your data

We apply technical and organisational measures proportionate to the data we hold:

  • In transit: TLS 1.2 or higher on every connection, with HTTP Strict Transport Security enabled.
  • At rest: credentials for connected services are encrypted with AES-256-GCM, and the encryption key is stored separately from the database.
  • API keys: stored hashed. Only a short prefix is ever displayed back to you.
  • Isolation between customers: each workspace has its own key, its own set of enabled tools and its own usage counters. A workspace cannot read another workspace's data through the API, and the tool layer refuses calls outside the granted set.
  • Least privilege: the application's database account can reach only its own database. Administrative access is limited to named personnel, protected by strong authentication, and logged.
  • Google user data is never logged. It is not written to application logs, not included in usage records, and not passed to AI clients. An AI client receives the result of the tool call it requested — never your identity data.
  • Backups are encrypted and retained on a short rotation.
  • Incident response: if a breach affects your personal data and the GDPR applies, we notify the competent authority within 72 hours and inform affected users without undue delay.

No system is perfectly secure. If you find a weakness, report it to hello@kohlercode.com and we will respond.

7. How long we keep data, and how to delete it

We keep data only as long as it serves the purpose it was collected for:

  • Account and workspace data — while the account is open, deleted within 30 days of closure.
  • Google user data (name, email, picture, account ID) — deleted with the account, within 30 days.
  • Usage records (tool name, timestamp, count) — 24 months, then aggregated or deleted.
  • Server and security logs — 90 days.
  • Invoices and tax records — 10 years, as required by tax law.

How to delete your data:

  1. In the account portal. Workspace settings → "Delete workspace", or Account → "Delete account". Access is disabled immediately and the data is permanently removed within 30 days.
  2. By email. Write from your registered address to hello@kohlercode.com with the subject "Delete my data". We confirm within 5 business days and complete the deletion within 30 days.
  3. To disconnect Google. Visit https://myaccount.google.com/permissions, select MetraClick and choose "Remove access". This stops any future access. To have the data we already stored deleted, use option 1 or 2 above.

Deletion is permanent. Encrypted backups rotate out within 35 days. We may keep the minimum necessary to comply with tax and accounting law, to resolve a dispute, or to prevent fraud and abuse, and only for as long as that purpose requires.

8. Your rights and choices

Depending on where you live, you have some or all of the following rights:

  • Access — a copy of the personal data we hold about you.
  • Correction — fix data that is wrong or incomplete.
  • Deletion — have your data erased, as described in section 7.
  • Restriction and objection — limit or object to certain processing.
  • Portability — receive your data in a machine-readable format, or have it sent to another provider.
  • Withdraw consent — at any time, where processing is based on consent. Withdrawal does not affect processing that already happened.
  • California residents — the right to know, delete, and correct personal information, and the right not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising.

To exercise any of these, email hello@kohlercode.com. We may ask you to confirm control of the email address on the account. We answer within 30 days and tell you if we need up to 60 more days for a complex request.

9. International transfers

Our servers are in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States on the basis of the European Commission's Standard Contractual Clauses, together with the additional safeguards described in section 6. You can request a copy of those clauses by email.

10. Cookies and local storage

MetraClick sets only what is needed to keep you signed in and to protect forms from cross-site request forgery: a session cookie, a CSRF token and a language preference. The account portal also keeps your session token in your browser's local storage.

We do not use advertising cookies, cross-site tracking pixels, Google Analytics, or third-party marketing scripts. If we introduce analytics, we will list the tool here and update this policy before it goes live.

11. Children

MetraClick is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children. If we learn that we hold such data, we delete it. A parent or guardian can contact hello@kohlercode.com to request deletion.

12. Changes to this policy

We publish changes on this page with a new "last updated" date. If a change materially affects how we use your data, we notify account holders by email at least 14 days before it takes effect. If you do not agree, you can close your account before the change applies.

13. Google API Services User Data Policy

MetraClick's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide and improve the features of MetraClick that you can see and use.
  • We do not sell Google user data.
  • We do not use Google user data for advertising, including personalised or retargeted advertising.
  • We do not allow humans to read Google user data, unless you give us explicit permission for a specific request, it is necessary for security purposes such as investigating abuse, or it is required by law.

14. Contact

Questions about this policy, or about the data we hold:

KohlerCode LLC — MetraClick 30 N Gould St, Ste R, Sheridan, WY 82801, United States hello@kohlercode.com