Privacy Policy
Last updated: 15 October 2026
This policy explains how Traceflow ("we", "us"), a product of MIGAMO, handles personal data when you visit traceflow.migamo.es, join the waitlist or use the Traceflow application. We follow the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
1. Who is responsible
Data controller: MIGAMO. Contact for any privacy matter: hello@migamo.es.
When a company uses Traceflow to analyse its own Google Analytics data, that company is the controller of its analytics data and MIGAMO acts as its processor, only following the company's instructions.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Waitlist email address | Contact you about early access, including a confirmation email when you join | Consent (you can withdraw any time) |
| Account data: name, email, Google sign-in identifier | Create and secure your account | Performance of a contract |
| Two-factor authentication factor | Protect access to company data | Contract and legitimate interest (security) |
| Workspace data: company name, team members, roles, invitations, website assignments | Run multi-user workspaces and permissions | Performance of a contract |
| Google Analytics connection: encrypted access tokens, account and property names, selected key events | Show your campaign reports | Performance of a contract |
| Activity log: who changed what and when | Security, accountability and investigation of misuse | Legitimate interest (security) |
| Hashed (one-way scrambled) network address | Limit abuse of public forms; the raw address is not stored | Legitimate interest (security) |
We do not sell personal data, use it for advertising, or make automated decisions with legal effects about you.
3. Google Analytics data (Google API Services)
When an Owner or Administrator connects a Google account, Traceflow requests read-only access (the analytics.readonly permission). We use it only to list the accounts and properties you choose and to fetch aggregated reports (sessions, engagement, key events by campaign, source, medium and content). We never modify your Google Analytics configuration.
Traceflow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is not used for advertising, not sold, not used to train AI models, and not read by humans except with your permission, for security, or where the law requires it.
Access tokens are encrypted at rest. You can disconnect a Google account at any time in Connections, which deletes the stored tokens, or revoke access at myaccount.google.com/permissions.
4. Cookies and browser storage
Traceflow uses no advertising cookies and no marketing pixels. With your consent only, we use Google Analytics to understand how visitors use our website. On your first visit we ask for your choice. "Reject all" is as easy as "Accept all", and nothing optional loads before you agree. You can change or withdraw your consent any time via "Cookie settings" in the footer.
| Name | Category | Purpose | Duration |
|---|---|---|---|
| sb-…-auth-token (local storage) | Strictly necessary | Keeps you signed in | Until you sign out |
| traceflow-consent (local storage) | Strictly necessary | Remembers your cookie choice | Until you clear it or change it |
| traceflow-theme (local storage) | Strictly necessary | Remembers your light or dark mode choice | Until you clear it or change it |
| Google sign-in session | Strictly necessary | Set by Google only when you sign in with Google | Governed by Google |
| Google Fonts | Functional (optional) | Loads our typefaces; shares your IP address with Google. Without consent, system fonts are used. | Per request |
| _ga, _ga_* (Google Analytics cookies) | Analytics (optional) | Counts visits and how our website is used (pages, approximate location, device, campaign links). IP addresses are shortened. Loaded only if you accept analytics; removed if you withdraw. | Up to 2 years |
| Marketing | Optional | Not used today. If added, it will load only with your consent. | — |
See Google's privacy policy for how Google handles font requests and analytics data. Google may process this data outside the EU under the EU–US Data Privacy Framework and standard contractual clauses.
5. Who we share data with
We use carefully selected service providers (processors) bound by data processing agreements (Lovable's Data Processing Addendum, Google's Data Processing Terms and Resend's Data Processing Addendum):
- Lovable (application hosting, database and authentication infrastructure), including its sub-processors for cloud hosting and content delivery.
- Google (sign-in, Google Analytics APIs, Google Fonts and, with your consent, Google Analytics website statistics).
- Resend (sending our emails, such as the waitlist confirmation). Your email address is shared with Resend only to deliver these messages.
Inside a workspace, members can see data according to their role and the websites assigned to them. We disclose data to authorities only when legally required.
6. International transfers
Some providers may process data outside the European Economic Area, for example in the United States. Where this happens, transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
7. How long we keep data
- Waitlist emails: until you ask us to remove them, or at the latest 12 months after early access ends.
- Account and workspace data: while your account is active, then deleted within 30 days of closure unless the law requires longer. Account closure is currently handled on request via hello@migamo.es.
- Google tokens: until you disconnect or your workspace is deleted.
- Analytics reports are fetched live from Google and are not stored permanently.
- Activity logs: kept for 12 months. Abuse-protection counters: kept for 90 days.
8. Security
We use encrypted connections, encryption of credentials at rest, mandatory two-factor authentication for company data, role-based permissions checked on the server and in the database, and audit logging. Traceflow is not currently ISO 27001 certified. No system is perfectly secure; we will notify you and the authorities of any personal data breach as required by law.
9. Your rights
You can request access to, correction of, deletion of, restriction of, or a portable copy of your data, object to processing based on legitimate interest, and withdraw consent at any time. Write to hello@migamo.es; we answer within one month. You may also complain to the Spanish Data Protection Agency (www.aepd.es).
10. Children
Traceflow is a business tool and not intended for anyone under 16.
11. Changes
We will post any changes on this page and update the date above. For significant changes we will notify account holders by a notice inside the application and, once email notifications are available, by email as well.