This privacy policy explains how Metricality handles your personal data when you sign in to the Metricality platform through https://login.metricality.io.

1. Who is responsible for your data

You can only use the Metricality platform because your organisation (our client) gave you access. Your organisation creates your account, decides which applications and data you can access, and decides what the platform is used for. For that, Metricality processes your data on behalf of your organisation. Your organisation is responsible for this processing, and its own privacy statement applies. For questions about your access or about the content you see in our applications, please contact your organisation.

Metricality itself is responsible for how signing in to the platform works and for keeping the platform secure. This privacy policy describes that part.

2. Which data we process

• Account data: your email address, first and last name, and, if you add it, your phone number. Your organisation provides your email address when it invites you; you complete the rest when you register.
• Sign-in data: your password (we only store a secure hash, never the password itself), your two-factor authentication settings and recovery codes, and the date of your last sign-in.
• Security logs: sign-in attempts (successful and failed), account lockouts, sign-outs and similar security events, including the time and your IP address.
• Usage and error data: technical data about how the sign-in pages are used and about errors. Analytics cookies are only used with your consent (see section 6).

3. What we use your data for and on what basis

• Managing your account and access on behalf of your organisation, as agreed with your organisation.
• Signing you in securely and protecting your account and the platform against misuse, for example with two-factor authentication, account lockout after repeated failed attempts and security logs. We do this based on our legitimate interest in a secure platform, and our obligation to protect the data on it.
• Sending you service emails, such as the invitation to register, password reset emails and a notification when someone signs in to your account without two-factor authentication. This notification contains a link to change your password, so you can act quickly if it wasn't you. Basis: legitimate interest in account security.
• Improving the sign-in pages and fixing errors, with analytics cookies only if you consent.

We do not use your data for marketing, we do not sell it, and we do not use it for any purpose other than the ones listed here.

4. Who we share your data with

We only share your data with service providers that help us run the platform, under agreements that oblige them to protect your data:

• Microsoft Azure: hosting, data storage and monitoring (Application Insights).
• Mailjet: sending service emails.

Your organisation can see which of its users have an account and manage their access. We do not share your data with other parties, unless we are legally required to.

5. Where your data is stored and how long we keep it

Your data is stored and processed in data centres within the European Union.

We keep your account for as long as your organisation gives you access to the platform. When your organisation removes your account, or when you delete it yourself, your account data is deleted. Security logs are kept only as long as needed for security and troubleshooting.

6. Cookies

We use cookies that are strictly necessary to sign you in securely. With your consent we also use analytics cookies (Microsoft Application Insights) to understand how our applications are used and to find errors. You can change your choice at any time through Cookie settings at the bottom of every page. Our Cookie Policy lists the cookies we use.

7. Your rights

You have the right to access, correct and delete your personal data, to receive a copy of it, to restrict or object to its processing, and to withdraw your consent at any time.

• Under Manage account → Personal data you can download your data or delete your account yourself.
• For data that your organisation manages, such as your access to applications, please contact your organisation.
• For anything else, contact us at privacy@metricality.io.

If you believe we do not handle your data correctly, please let us know. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your country.

8. Security

We protect your data with appropriate technical and organisational measures, including encrypted connections, hashed passwords, optional two-factor authentication, protection against repeated sign-in attempts and restricted access to our systems.

9. Changes to this policy

We may update this privacy policy when our platform or the law changes. The date below shows when it was last changed. If a change significantly affects how we handle your data, we will let you know.

Contact

Metricality
privacy@metricality.io

This policy is effective as of 4 October 2026.