Privacy Policy

Studio Primary · Version 2026-10-14 · Effective 14 October 2026

This Privacy Policy explains how Studio Primary, trading as Studio Primary (KvK 82701237, Eindhoven, The Netherlands) ("we", "us"), processes personal data in connection with the Studio Primary platform at https://app.innertags.com (the "Service") and our public web pages. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and the Dutch Telecommunications Act (Telecommunicatiewet).

Questions and requests: info@studioprimary.com.

1. Two roles: controller and processor

1.1 We are the controller for personal data that we process for our own purposes: the accounts of people who use the Service, security and audit records, acceptance records, communications with us, billing, and visitors and prospects of our public pages (such as the website audit). This Privacy Policy describes that processing.

1.2 We are a processor for personal data that our customers (marketing agencies and other businesses, the "Customer") put into, connect to or have collected by the Service in their workspace, for example the data of their own clients, their clients' website visitors, email recipients, reviewers or social media audiences ("Customer Data"). For that data the Customer (or its client) is the controller and decides why and how it is processed; we process it only on the Customer's instructions under our Data Processing Agreement (https://app.innertags.com/legal/dpa). If your personal data is in a Customer's workspace, please contact that Customer to exercise your rights; we will assist the Customer.

2. What we process, why, and on which legal basis

2.1 We do not sell personal data and do not use personal data for advertising profiles.

2.1a AI processing and training. AI features send the data needed for a request to AI model providers through OpenRouter (section 5). Whether those providers may store that data or use it to train or improve their models depends on their own data policies and on the data-policy settings of the OpenRouter account used — ours for workspaces using platform AI access, or the Customer's own when it uses its own key. An OpenRouter account can be set to exclude providers that train on or retain data; a Customer that wants this guaranteed can use its own key with those settings.

2.2 Automated decision-making. The Service produces automated verdicts and recommendations about advertising, keywords, content and websites. These concern marketing activities, not individuals, and do not produce legal or similarly significant effects on any person within the meaning of Article 22 GDPR.

2.3 You are not obliged to provide personal data, but without account data we cannot give you access to the Service.

3. Google user data (Google API Services)

3.1 When a Customer connects a Google account, the Service requests access to Google services the Customer chooses: Google Ads, Google Analytics, Search Console, Tag Manager, Business Profile and Merchant Center. Depending on the scopes granted, the Service reads advertising account structure and performance (campaigns, ad groups, keywords, search terms, conversions, budgets, bids), analytics and search performance metrics, tag configurations, business listings and customer reviews, and product listings. Where the Customer approves changes, the Service writes changes to Google Ads (such as keywords, negative keywords, budgets, bids and ads).

3.2 This data is used only to provide and improve user-facing features of the Service for that Customer: syncing and displaying data, analysis, diagnostics, recommendations, reports and approved changes. Data may be sent to the AI providers listed in section 5 solely to generate analysis and content for that Customer.

3.3 Studio Primary's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4 A Customer can revoke access at any time via "Disconnect" in the Service or at myaccount.google.com/permissions. Tokens are then deleted from the Service.

4. How long we keep personal data

Where we retain data to establish, exercise or defend legal claims, we may keep it longer for as long as that is necessary.

5. Who receives personal data

5.1 We share personal data only as necessary with:

• Hosting: Hetzner, Germany (EU) — hosting of the Service and its database.
• Email delivery: our own mail service at mailer.studioprimary.com for service emails.
• AI processing: OpenRouter, Inc. (United States) and the AI model providers it routes requests to, where a workspace uses AI features with our platform AI access, subject to the data-policy settings of our OpenRouter account (see 2.1a). Where the Customer uses its own AI key, the Customer's own provider receives the data under the Customer's contract and settings.
• Services the Customer connects (Google, Meta, LinkedIn, Reddit, Microsoft Bing, the Customer's own email server and others): data is exchanged with them on the Customer's instruction and under the Customer's own agreement with them.
• Website analytics: Google Ireland Limited and Google LLC, only on our public website and only with your consent (section 8.4).
• Public data services that receive no personal data: weather (Open-Meteo), news services, and public search pages used to find competitors.
• Professional advisers, auditors and insurers, under confidentiality.
• Authorities, where we are legally obliged, and to protect our rights.
• A successor in the event of a merger, acquisition or transfer of our business, subject to this Privacy Policy.

5.2 The current list of sub-processors is maintained in Annex 3 of the Data Processing Agreement.

6. International transfers

Some recipients are established outside the European Economic Area, notably in the United States (including Google LLC for website analytics, section 8.4). Transfers take place on the basis of an adequacy decision (including the EU–US Data Privacy Framework, for recipients certified under it) or the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with supplementary measures where required. You can request a copy of the safeguards at info@studioprimary.com.

7. Security

We protect personal data with appropriate technical and organisational measures, including: encryption in transit (TLS); encryption of stored credentials and tokens with AES-256-GCM; one-way hashing of passwords (bcrypt); strict separation between customer workspaces; role-based access; single-use, time-limited reset links; audit logging; append-only acceptance records; restricted administrative access; and regular backups. More detail is in Annex 2 of the Data Processing Agreement. Should a personal data breach occur, we act in accordance with Articles 33 and 34 GDPR.

8. Cookies and similar technologies

8.1 The Service uses only functional cookies and local storage that are strictly necessary to provide the Service you request. These do not require consent under Article 11.7a of the Dutch Telecommunications Act.

8.2 We do not use analytics, advertising or tracking cookies in the Service, and do not load third-party trackers there. Our public website uses Google Analytics only with your consent, as described in 8.4.

8.3 Scripts that the Service lets Customers install on their own websites (such as managed SEO tags) are installed by the Customer, who is responsible for any consent those websites require.

8.4 Cookies and analytics on our website

8.4.1 Where. On our public website — the home page as shown to visitors who are not signed in, the product pages (features, pricing, Google data), sign-up, the free website audit at /audit and the legal pages — we use Google Analytics 4 through Google Tag Manager, and only after you agree in the cookie banner. Until you agree, neither is loaded and nothing is sent to Google. Analytics never runs inside the Service (once you are signed in), on client portals, client reports, pitch, questionnaire or onboarding links, embedded forms, an agency's own audit page, or on any other page that shows a Customer's or its clients' data.

8.4.2 Google Tag Manager. Google Tag Manager is a tool that loads the tags we use on these pages. We load it only after you agree to analytics or marketing cookies. It sets no cookies itself. When it loads, Google receives your IP address and browser information, as with any request to a web server, and may collect limited technical information about how the tags load and run (diagnostics).

8.4.3 Google Analytics 4. Google Analytics is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with its parent company Google LLC (United States). With your consent it records which pages you view, how you arrived (the referring page or campaign), how you interact with the pages, your device type, browser, operating system and screen size, and your approximate location (country, region, city), linked to a pseudonymous identifier stored in a cookie. Google Analytics 4 does not log or store IP addresses: Google uses the IP address only to derive the approximate location and then discards it. We do not send names, email addresses or other directly identifying details to Google Analytics.

8.4.4 Purpose. Understanding how our website is used, so we can improve it. If you also accept marketing cookies: measuring the results of our own advertising; Google may then use the data for advertising purposes, including ad personalisation, under its own terms.

8.4.5 Cookies.

8.4.6 Legal basis. Your consent: Article 6(1)(a) GDPR, and Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet) for placing and reading cookies. Remembering your choice is strictly necessary and needs no consent.

8.4.7 Without your consent. Until you choose, and whenever you refuse everything, Google Tag Manager and Google Analytics are not loaded: nothing is sent to Google, and no analytics or advertising cookies are set or read. Google's consent signals (Google Consent Mode) are also set to "denied" by default, so a tag can never run with more than you agreed to. If you agree to analytics only, the advertising signals stay "denied", advertising data is redacted, and we do not pass click identifiers on through page addresses.

8.4.8 Retention. Google Analytics keeps event data for 14 months, after which only aggregated reports remain. The cookies last as listed above.

8.4.9 Recipients and transfers. Google Ireland Limited processes the analytics data for us under Google's data processing terms; for advertising purposes Google may act as a controller in its own right (policies.google.com/privacy; how Google uses information from sites that use its services). Data may be transferred to Google LLC in the United States, which is certified under the EU–US Data Privacy Framework; Google also relies on the European Commission's Standard Contractual Clauses.

8.4.10 Changing your mind. You can change or withdraw your consent at any time under "Cookie settings" at the bottom of our web pages. Withdrawing stops the measurement at once: Google Analytics is switched off on the open page and its cookies are removed from our website, and from the next page load Google Tag Manager is no longer loaded. It does not affect what was lawfully processed before. We ask again after 12 months, and whenever we change what we ask consent for.

9. Your rights

9.1 You have the right to request access to, rectification of and erasure of your personal data, restriction of processing, data portability, and to object to processing based on legitimate interest (including follow-up of a website audit). Where processing is based on consent, you may withdraw it at any time; for our website's analytics, under "Cookie settings" at the bottom of our web pages (section 8.4).

9.2 Send your request to info@studioprimary.com. We respond within one month; we may ask you to verify your identity. Some rights are limited by law, for example where we must keep acceptance records or invoices.

9.3 You can change your name and password yourself under "Your profile" in the Service.

9.4 You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl, or with the supervisory authority in your country of residence or work.

10. Children

The Service is intended for businesses and is not directed at anyone under the age of 16. We do not knowingly process personal data of children.

11. Changes

We may update this Privacy Policy. Every version is published at https://app.innertags.com/legal with its date and fingerprint. Material changes are announced in the Service or by email.

12. Contact

Studio Primary · Studio Primary Eindhoven, The Netherlands Privacy: info@studioprimary.com · General: info@studioprimary.com KvK 82701237 · VAT NL003719360B48