Studio Primary
Privacy Policy
Version 2026-09-24 · effective 24 September 2026
Studio Primary · Version 2026-09-24 · Effective 24 September 2026
This Privacy Policy explains how Studio Primary, trading as Studio Primary (KvK 82701237, Eindhoven, The Netherlands) ("we", "us"), processes personal data in connection with the Studio Primary platform at https://app.innertags.com (the "Service") and our public web pages. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and the Dutch Telecommunications Act (Telecommunicatiewet).
Questions and requests: info@studioprimary.com.
1. Two roles: controller and processor
1.1 We are the controller for personal data that we process for our own purposes: the accounts of people who use the Service, security and audit records, acceptance records, communications with us, billing, and visitors and prospects of our public pages (such as the website audit). This Privacy Policy describes that processing.
1.2 We are a processor for personal data that our customers (marketing agencies and other businesses, the "Customer") put into, connect to or have collected by the Service in their workspace, for example the data of their own clients, their clients' website visitors, email recipients, reviewers or social media audiences ("Customer Data"). For that data the Customer (or its client) is the controller and decides why and how it is processed; we process it only on the Customer's instructions under our Data Processing Agreement (https://app.innertags.com/legal/dpa). If your personal data is in a Customer's workspace, please contact that Customer to exercise your rights; we will assist the Customer.
2. What we process, why, and on which legal basis
| Category | Personal data | Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|---|---|
| Account data | name, email address, role, workspace, password (stored only as a one-way bcrypt hash), personal preferences, time zone | creating and managing your account, signing in, providing the Service | (b) performance of the contract with the Customer; (f) legitimate interest in providing the Service to the Customer's users |
| Agency profile | agency name, country, language, time zone, currency, business contact details | configuring the workspace | (b) contract |
| Security and audit data | IP address, browser and device information (user agent), timestamps, sign-in events, password resets, actions taken in the workspace (audit log), error logs | securing the Service, preventing and investigating misuse and fraud, troubleshooting, accountability | (f) legitimate interest in security and integrity; (c) legal obligation (Art. 32 GDPR) |
| Acceptance records | name, email, role, agency, the document versions accepted and their fingerprints, the statement confirmed, date and time, IP address, user agent, related context | proving the conclusion and content of the agreement | (b) contract; (f) legitimate interest in establishing, exercising and defending legal claims |
| Service emails | email address, name, email type, delivery status | invitations, welcome, password reset, security notices, acceptance confirmations and other transactional messages | (b) contract; (f) legitimate interest |
| Connected account data | the name and email address of the Google, Meta, LinkedIn or Reddit account you sign in with, OAuth tokens (encrypted) | connecting the Customer's own third-party accounts on its instruction | (b) contract; for the content of those accounts we act as processor (section 1.2) |
| Support and communications | name, contact details, content of messages | answering questions and support requests | (b) contract; (f) legitimate interest |
| Billing | company and contact details, invoices, payment details | invoicing, administration | (b) contract; (c) legal obligation (tax retention) |
| Website audit prospects | website address, email address and any details you enter in the public website audit, IP address | performing the audit you request, sending you the result and, if you ask for it, following up | (b) steps at your request prior to a contract; (f) legitimate interest in B2B follow-up — you can object at any time |
| Public page visitors | IP address, user agent, pages requested (server logs) | delivering and securing the web pages | (f) legitimate interest |
2.1 We do not sell personal data and do not use personal data for advertising profiles.
2.1a AI processing and training. AI features send the data needed for a request to AI model providers through OpenRouter (section 5). Whether those providers may store that data or use it to train or improve their models depends on their own data policies and on the data-policy settings of the OpenRouter account used — ours for workspaces using platform AI access, or the Customer's own when it uses its own key. An OpenRouter account can be set to exclude providers that train on or retain data; a Customer that wants this guaranteed can use its own key with those settings.
2.2 Automated decision-making. The Service produces automated verdicts and recommendations about advertising, keywords, content and websites. These concern marketing activities, not individuals, and do not produce legal or similarly significant effects on any person within the meaning of Article 22 GDPR.
2.3 You are not obliged to provide personal data, but without account data we cannot give you access to the Service.
3. Google user data (Google API Services)
3.1 When a Customer connects a Google account, the Service requests access to Google services the Customer chooses: Google Ads, Google Analytics, Search Console, Tag Manager, Business Profile and Merchant Center. Depending on the scopes granted, the Service reads advertising account structure and performance (campaigns, ad groups, keywords, search terms, conversions, budgets, bids), analytics and search performance metrics, tag configurations, business listings and customer reviews, and product listings. Where the Customer approves changes, the Service writes changes to Google Ads (such as keywords, negative keywords, budgets, bids and ads).
3.2 This data is used only to provide and improve user-facing features of the Service for that Customer: syncing and displaying data, analysis, diagnostics, recommendations, reports and approved changes. Data may be sent to the AI providers listed in section 5 solely to generate analysis and content for that Customer.
3.3 Studio Primary's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3.4 A Customer can revoke access at any time via "Disconnect" in the Service or at myaccount.google.com/permissions. Tokens are then deleted from the Service.
4. How long we keep personal data
| Data | Retention |
|---|---|
| Account data | for as long as the account exists; deleted within 30 days after the account is removed or the Customer's agreement ends, unless retention is required below |
| Workspace data deleted by a user | clients and connections deleted in the Service are kept in a recoverable bin and permanently deleted after at most 6 months |
| Security and error logs | server error details in memory for up to 24 hours; security logs up to 12 months |
| Audit log | for as long as the workspace exists, and up to 12 months after the agreement ends |
| Acceptance records | for the duration of the agreement and 7 years after it ends (limitation periods for contractual claims) |
| Service email log | up to 24 months |
| Billing and invoices | 7 years (Dutch statutory tax retention, Art. 52 General Tax Act) |
| Website audit prospects | up to 12 months after the last contact, unless an agreement follows |
| Backups | overwritten in the regular backup cycle, at most 35 days |
Where we retain data to establish, exercise or defend legal claims, we may keep it longer for as long as that is necessary.
5. Who receives personal data
5.1 We share personal data only as necessary with:
- Hosting: Hetzner, Germany (EU) — hosting of the Service and its database.
- Email delivery: our own mail service at mailer.studioprimary.com for service emails.
- AI processing: OpenRouter, Inc. (United States) and the AI model providers it routes requests to, where a workspace uses AI features with our platform AI access, subject to the data-policy settings of our OpenRouter account (see 2.1a). Where the Customer uses its own AI key, the Customer's own provider receives the data under the Customer's contract and settings.
- Services the Customer connects (Google, Meta, LinkedIn, Reddit, Microsoft Bing, the Customer's own email server and others): data is exchanged with them on the Customer's instruction and under the Customer's own agreement with them.
- Public data services that receive no personal data: weather (Open-Meteo), news services, and public search pages used to find competitors.
- Professional advisers, auditors and insurers, under confidentiality.
- Authorities, where we are legally obliged, and to protect our rights.
- A successor in the event of a merger, acquisition or transfer of our business, subject to this Privacy Policy.
5.2 The current list of sub-processors is maintained in Annex 3 of the Data Processing Agreement.
6. International transfers
Some recipients are established outside the European Economic Area, notably in the United States. Transfers take place on the basis of an adequacy decision (including the EU–US Data Privacy Framework, for recipients certified under it) or the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with supplementary measures where required. You can request a copy of the safeguards at info@studioprimary.com.
7. Security
We protect personal data with appropriate technical and organisational measures, including: encryption in transit (TLS); encryption of stored credentials and tokens with AES-256-GCM; one-way hashing of passwords (bcrypt); strict separation between customer workspaces; role-based access; single-use, time-limited reset links; audit logging; append-only acceptance records; restricted administrative access; and regular backups. More detail is in Annex 2 of the Data Processing Agreement. Should a personal data breach occur, we act in accordance with Articles 33 and 34 GDPR.
8. Cookies and similar technologies
8.1 The Service uses only functional cookies and local storage that are strictly necessary to provide the Service you request. These do not require consent under Article 11.7a of the Dutch Telecommunications Act.
| Name | Type | Purpose | Duration |
|---|---|---|---|
markering_session | cookie (HttpOnly) | keeps you signed in | until sign-out or expiry of the session |
mk_client | cookie | remembers which client workspace you are viewing | up to 1 year |
mk_tz | cookie | shows dates and times in your own time zone | up to 1 year |
| theme and view preferences | local storage | remembers light/dark mode and interface preferences | until cleared |
8.2 We do not use analytics, advertising or tracking cookies, and do not load third-party trackers on the Service or our legal pages.
8.3 Scripts that the Service lets Customers install on their own websites (such as managed SEO tags) are installed by the Customer, who is responsible for any consent those websites require.
9. Your rights
9.1 You have the right to request access to, rectification of and erasure of your personal data, restriction of processing, data portability, and to object to processing based on legitimate interest (including follow-up of a website audit). Where processing is based on consent, you may withdraw it at any time.
9.2 Send your request to info@studioprimary.com. We respond within one month; we may ask you to verify your identity. Some rights are limited by law, for example where we must keep acceptance records or invoices.
9.3 You can change your name and password yourself under "Your profile" in the Service.
9.4 You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl, or with the supervisory authority in your country of residence or work.
10. Children
The Service is intended for businesses and is not directed at anyone under the age of 16. We do not knowingly process personal data of children.
11. Changes
We may update this Privacy Policy. Every version is published at https://app.innertags.com/legal with its date and fingerprint. Material changes are announced in the Service or by email.
12. Contact
Studio Primary · Studio Primary Eindhoven, The Netherlands Privacy: info@studioprimary.com · General: info@studioprimary.com KvK 82701237 · VAT NL003719360B48
Also: Terms of Service · Data Processing Agreement
Questions about this document: info@studioprimary.com