Privacy policy

This policy explains how Dash Forward, trading as Measurebase, handles personal data. It covers the data we hold about our own customers, their team members, and visitors to measurebase.com.

Dash Forward, trading as Measurebase
Denarius 55, 6661 SV Elst (GLD), The Netherlands
Chamber of Commerce (KVK) number: 91017408
Contact: info@measurebase.com

1. Two different roles, two different documents

Measurebase handles personal data in two distinct capacities, and it matters which one applies:

• As a controller — for data about you as our customer: your account, your billing details, your support requests. That is what this policy covers.
• As a processor — for the tracking data that flows through your tagging server, which belongs to your own website visitors. You decide what that data is and why it is collected; we only host the transport layer. That relationship is governed by our Data Processing Agreement, not by this policy.

If you are a visitor to a website that uses Measurebase, we are not the controller of your data. Contact the operator of that website; their own privacy policy applies.

2. What we collect, and why

Account data. Your first and last name, email address, and optionally a phone number. Your password is stored only as a cryptographic hash, never in readable form. If you sign in with Google, we store the identifier Google returns rather than a password. If you enable two-factor authentication, we store the secret and recovery codes needed to verify your codes.

Organization and billing data. Organization name, address, VAT and Chamber of Commerce numbers, billing email, and billing contact name. Payments are processed by Stripe: we never see or store full card numbers. We keep only the identifiers Stripe gives us and non-sensitive display details such as the card brand and last four digits.

Login activity. For each sign-in attempt: the IP address, browser user-agent string, sign-in method, whether it succeeded, and when. This exists so you can spot unauthorized access to your own account, and so we can detect and block credential-stuffing attacks.

Account activity log. A record of significant actions taken in your account — domain changes, plan changes, team invitations, and similar — with who performed them and when.

Support and feedback. The content of support tickets and feedback you send us, including any screenshots you attach and the page you were on when you submitted feedback.

Data from your Google and Meta connections. When an owner or admin of your account connects Google Analytics, Google Ads, Google Tag Manager or Meta, we read the settings and statistics of the accounts you link, to audit your tracking, show your ad performance and, only when you confirm it, apply a fix. What we keep, for how long, and how to delete it is set out in How to delete your data.

Implementation requests. If you ask us to set up your implementation: your name, email address, business type, and whether you want product updates. (The waitlist closed when sign-ups opened to everyone on 23 October 2026.)

Free tracking audit. When you use the free tracking audit, we load up to five public pages of the website you enter, the way a visitor's browser would, and record which scripts, tags and cookies they use. Measurement requests are stopped inside our browser, so nothing is sent to the site's analytics or ad accounts. We store the website address, the result, a small picture of the home page and the report for 30 days, then delete them automatically; you can delete a report earlier from its page. Once a report is deleted, in either way, we keep a short record for our own statistics for 24 months: the website address, the date of the audit and its score. That record holds no report, no link and no IP hash. Anyone with the private link can open the report, so share it with care. To limit abuse we keep a one-way hash of your IP address for 24 hours. If you ask us to email you when your audit is finished, we hold your email address encrypted until that one email is sent, at most 2 hours, and then delete it. Our email provider Postmark delivers it. If you choose to connect Google Tag Manager, Google gives us a read-only access token (tagmanager.readonly) that expires within an hour. You choose the containers; while you choose, we hold the token encrypted for at most 15 minutes. We use it once to read the published version of those containers, keep only the findings and a short summary (container ids, names, version and number of tags), and never store the token or your Google account details. You can remove the permission at any time at myaccount.google.com/permissions. We do not use the audit to contact you and do not collect your email address.

3. What we deliberately do not do

• No cookies and no profiling on measurebase.com without your consent. Until you make a choice, nothing is stored on your device and nothing that can recognise you is collected. Measurement tags do load before you choose, but in a mode where they cannot read or write a cookie and cannot follow you. Cookies and local storage sets out exactly what that mode does and does not do.
• Measurement runs mostly first-party. The tag setup and most of the traffic it generates go through our own website, at measurebase.com/mbt, rather than straight to Google. A few requests do still reach Google's own domains directly; they are named in Cookies and local storage. There are no social media trackers, and no advertising network other than Google's.
• We do not sell personal data, and we do not share it with advertisers or data brokers.
• We do not use your data for advertising or profiling, and we do not use the tracking data flowing through your tagging server for any purpose of our own.
• No automated decision-making that produces legal or similarly significant effects.

Data from Google APIs

Measurebase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access. Only after an owner or admin of your account connects them, and only for the accounts you link. From your Google account: your email address, to show who connected. From Google Analytics: the properties and data streams you link, their key events, custom dimensions, data retention setting and links to Google Ads, and daily aggregated report figures for the linked property: sessions, users, page views, events and key events, revenue and purchases, broken down by channel, source, medium and campaign, landing page and page path (without query strings), event, device, browser, country and product. We never read or store user-level data such as client IDs, user IDs or transaction IDs, and you can query these figures from your own AI assistant through the Measurebase MCP server. From Google Ads: the accounts you link, their campaigns, ad groups, keywords, search terms, ads, conversion actions, budgets, status and policy review, daily performance figures, and the click IDs of clicks on your ads. From Google Tag Manager: the containers you link and their tags, triggers and variables. We do not access the personal data of the people who visit your website through these connections.
• Only for the features you use. We use data from Google Analytics, Google Ads and Google Tag Manager only to provide the features you see in Measurebase: the tracking audit, ad performance and click ID matching, alerts, and the fixes you confirm. We do not use it for any other purpose.
• Not for advertising, not sold. We do not use this data to serve ads, we do not sell it, and we do not use it to build profiles or to train AI models.
• No transfer, except where you direct it. We do not share this data with third parties, except when you connect your own AI assistant through the Measurebase MCP server: that assistant then reads your data under the access you approved for it, and you can revoke that access at any time. We also share data where the law requires it or to keep the service secure.
• No human reading. Our staff do not read this data, unless you ask us to and turn on support access, where it is needed for security or abuse investigations, or where the law requires it.
• Read-only by default. We only change anything in your Google accounts when an owner or admin of your account confirms a specific fix, after a preview of exactly what will change.
• Free tracking audit. When you connect Google Tag Manager to the free tracking audit, you choose the containers and we read them once with the read-only tagmanager.readonly permission, only to produce your report; the same commitments apply. While you choose, we hold the access encrypted for at most 15 minutes, and we delete it after the read.
• How we protect it. Access and refresh tokens are encrypted at rest (AES-256) and are never shown in the dashboard. All traffic to and from Google and Measurebase is encrypted with TLS. The data is stored on our servers in the Netherlands, with encrypted backups within the EU, and click IDs are stored only as a one-way hash.
• How long we keep it, and how to delete it. Click ID hashes are deleted after 7 days. Settings and daily figures are kept for as long as the website stays in Measurebase. When you disconnect a connection, we revoke the token at Google and delete it right away. Deleting the website or your account deletes the data read from Google with it, and encrypted backups roll over within 7 days. See How to delete your data.

4. Cookies and local storage

Two cookies are set without asking. Everything else waits for your consent.

The two exempt ones are these. If you switch language using the link in the footer, your choice is stored in a cookie named mb_lang so the site opens in that language next time. It holds nothing but en or nl, it is never read by anyone else, and it is never written unless you actually click the switcher — visiting pages in either language does not set it, and we do not look at your browser's language settings. Separately, when you answer the cookie banner, your answer itself is stored in a cookie named mb_consent, so we do not have to ask again on every page. It holds nothing but your own choice and expires after six months.

A cookie that only remembers a preference you explicitly chose is a user-interface customisation cookie, and a cookie that records a consent decision is necessary to honour that decision. Both are exempt from consent under the ePrivacy Directive and the Dutch Telecommunications Act.

Measurement on this site. We measure how measurebase.com is used, through our own product: a Google Tag Manager container served through our own website at measurebase.com/mbt, from the same EU infrastructure we run for customers. It is the same setup this site sells, used on this site.

The page sets Google Consent Mode v2 to denied for analytics, advertising, advertising user data, advertising personalisation and personalisation storage before any tag is able to load, and that state only changes when you choose it in the banner.

Tags do still load in that denied state, and it is worth being precise about what that means. What they cannot do is read or write a cookie, give you an identifier, or recognise you on a later page, a later visit, or another website. What they can still do is send a signal that a page was viewed, carrying the page address and your IP address, with nothing attached that singles you out. If you choose "Necessary only", or ignore the banner entirely, it stays that way for as long as that choice stands: no analytics or advertising cookie is ever set.

Which domains your browser talks to. Most of this traffic goes to measurebase.com/mbt, which passes it on to our own tagging server. Where it does, your browser never contacts Google at all: our own server forwards the request onward, with none of your cookies attached to it. Some requests still go to Google directly, namely www.googletagmanager.com for part of the tag setup, and www.google.com and pagead2.googlesyndication.com for advertising signals. Google receives your IP address either way, since forwarding a request does not hide where it came from.

The banner offers "Accept all" and "Necessary only" as equally prominent choices, and a "Preferences" panel where the two optional categories can be allowed separately. There are no pre-ticked boxes, and refusing takes exactly as few clicks as accepting. The categories are:

• Necessary. Needed to make the site work and to remember what you choose in the banner. This is the mb_lang and mb_consent pair described above. Always on, and exempt from consent.
• Analytics. Lets us see which pages get visited and how people move through the site. Your browser is given an identifier so that a second visit counts as the same visit rather than a new one, which is what makes this a cookie you get to refuse. We report on totals, not on individuals.
• Marketing. Lets advertising platforms recognise you on other websites as well as this one, so that ads can be targeted to you and so we can see which ad brought you here. Doing that means sharing data with those platforms, who act as controllers in their own right for what they then do with it.

Changing your mind. Withdrawing consent is as easy as giving it. Once you have answered the banner, a "Cookies" button stays in the bottom-left corner of every page; it reopens your choices, already showing what is currently allowed, so you can change any category at any time. You can also reopen it from here. Clearing your browser cookies has the same effect, and the banner will simply ask again.

The dashboard at dashboard.measurebase.com uses your browser's local storage for one purpose: keeping you signed in and remembering which account you are viewing. This is strictly necessary to deliver a service you have asked for, so it does not require consent under the ePrivacy Directive or the Dutch Telecommunications Act. It is not a tracking identifier, it is never read by any third party, and clearing your browser storage simply signs you out.

Separately, Measurebase's product handles cookies on your behalf — features like Cookie Keeper extend the lifetime of your own first-party cookies on your own website. Those are your cookies on your domain, set under your responsibility as controller, and are covered by the DPA rather than this policy.

5. Legal bases for processing

Under Article 6 GDPR we rely on:

• Performance of a contract (Article 6(1)(b)) — creating and running your account, providing the Service, billing you, and providing support.
• Legitimate interests (Article 6(1)(f)) — securing the platform, keeping login and activity records, preventing fraud and abuse, and improving the product. We have weighed these interests against your rights and consider them proportionate given how limited the data is.
• Legal obligation (Article 6(1)(c)) — retaining invoices and related records for the period Dutch tax law requires.
• Consent (Article 6(1)(a)) — product updates, where you asked to receive them. You can withdraw consent at any time, and doing so does not affect processing that already happened.

6. Who else processes this data

We keep the list of third parties deliberately short. Each is bound by a written data processing agreement.

Provider	Purpose	Location
TransIP B.V.	Hosting for our infrastructure and databases	The Netherlands
Stripe Payments Europe, Limited	Payment processing and invoicing	Ireland (some processing by Stripe affiliates outside the EEA, under Chapter V safeguards)
AC PM, LLC (Postmark)	Sending account, alert, and support emails	United States, under Standard Contractual Clauses

We may also disclose personal data where we are legally required to — for example in response to a valid order from a competent authority. We will not do so voluntarily, and will tell you unless legally prohibited from doing so.

7. International transfers

All infrastructure that stores your account data and the data flowing through your tagging server runs in the Netherlands. It does not leave the European Union in the ordinary course of providing the Service.

The one routine exception is transactional email: our email provider is US-based, so the email address a message is sent to, and the content of that message, reach the United States. That transfer is covered by the Standard Contractual Clauses incorporated into their data processing addendum. Alert emails describe the event, not your visitors' data.

8. How long we keep it

• Account, login activity, and account activity logs — for as long as your account exists. Deleting your account removes them from our production systems, subject to short-lived residual copies in encrypted backups — the nightly rotation overwrites those within seven days.
• Invoices and financial records — seven years, as Dutch tax law requires. This obligation survives account deletion.
• Support tickets and feedback — for as long as your account exists, so that support history stays useful to both of us.
• Implementation requests: for as long as we need them to handle your request and follow up, and at most 12 months. If you asked for product updates, your email address is kept for that until you unsubscribe.
• Free tracking audit: reports for 30 days, the hashed IP address for 24 hours, and a short record of the website address, audit date and score for 24 months.
• Request logs (your visitors' data, processed on your behalf) — from 3 days on the Free plan up to 30 days on Business (3/7/14/21/30 days for Free/Solo/Growth/Scale/Business), then automatically and permanently deleted. Visitor IP addresses are anonymized at the point of capture (the last part of the address is discarded before anything is written to disk), the underlying server access logs are deleted within 72 hours, and beyond these windows only anonymous daily statistics — counts, with no personal data — are kept. See the DPA.

9. How we protect it

• Two-factor authentication is available on every account, and we encourage it.
• Sign-in endpoints are rate-limited. Sessions expire on a schedule and are revoked automatically when you change your password, reset it, or disable two-factor authentication.
• Connections are encrypted in transit with TLS. Sensitive credentials are encrypted at rest.
• Our staff cannot look inside your account unless you let them. Support access is off by default; you turn it on yourself from your profile settings. When enabled, access is a temporary, single-use session that cannot change billing or delete anything, and every session is recorded in your own activity log.

10. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent where processing is based on it.

Many of these you can exercise yourself from the dashboard: your profile page lets you correct your details, review your login history, and delete your account; your settings page lets you export data and manage your organization details. For anything else, email info@measurebase.com and we will respond within one month.

To delete what we keep from a Meta, Google Analytics, Google Ads or Tag Manager connection, see How to delete your data.

If you believe we are handling your data improperly, we would like the chance to put it right first. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the supervisory authority where you live or work.

11. Children

Measurebase is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

If we change this policy in a way that materially affects you, we will notify account holders by email before the change takes effect. The "last updated" date at the top always reflects the current version.

13. Contact

Questions about this policy, or about how we handle your data, go to info@measurebase.com. We have not appointed a Data Protection Officer, as we are not required to; your questions reach us directly.