Privacy policy
NoFlatline watches the conversions that a company's ads and reports depend on, and alerts that company's team when one stops being tracked. This policy explains what data that involves, why, and for how long. It is written to be short and exact.
1. Who we are
NoFlatline is run by Perri Giovanni, a sole trader registered in Italy (ditta individuale), Parma, Italy, Partita IVA IT03133680342. For anything in this policy, write to hello@noflatline.com. "We" in this policy means Perri Giovanni trading as NoFlatline.
2. This website
This website sets no cookies, runs no analytics and loads nothing from third parties: fonts are served from our own domain. Our host, Cloudflare, processes the technical data any web request carries (such as your IP address and browser type) to deliver the page and protect the site from abuse. We do not use that data to identify or profile you.
If you email us, we keep your message and address to reply and, if you join the pilot, to work with you. We keep that correspondence for up to 3 years after our last contact.
3. The NoFlatline service
3.1 Whose data
NoFlatline is a business service. Our customers are companies. We process two kinds of data:
- Account data about the people at a customer who use NoFlatline: name, work email, and the Slack channel or email address alerts go to. We are the controller of this data.
- Data from the customer's connected tools, read only with read-only access the customer grants. We process this on the customer's behalf, under a data processing agreement, as their processor.
3.2 What we read from connected tools
- Ad platforms (such as Google Ads and Meta): conversion action names and settings, conversions per hour per conversion action, which campaigns bid on each conversion and their bid strategy, the platforms' own tag and event diagnostics, change history, and, only if the customer turns on "spend at risk", daily spend for those campaigns.
- Analytics tools (such as Google Analytics 4 and Mixpanel): hourly counts of the events the customer chooses to watch, and event names.
- The customer's website: a crawl of public pages and the public Google Tag Manager container, to detect which tracking tools are installed.
- Release information, only if the customer connects it (such as GitHub): deploy times and, on our premium plan, the changed lines of a pull request that touch tracking.
3.3 What we never read or store
- Personal data about the customer's own users or website visitors: no user IDs, emails, profiles or session data.
- Revenue. Conversion value is read only if the customer turns on value checks; it is compared in memory and we store only the percentage change, never amounts.
- Ads, creative, audiences, keywords or billing details.
We never change anything in a connected tool. Access is read-only and enforced by each tool's own permissions. The only things we write are alerts and reports, to the places the customer chooses.
3.4 Google user data
NoFlatline's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the monitoring and alerts described here. We do not sell it, use it for advertising, or use it to train general AI models.
Nobody at NoFlatline reads your Google data, except when you ask us to (for example, to answer a support question about a specific alert), when it is needed for security, such as investigating abuse, or when the law requires it. Our software reads it only to run the monitoring.
You can remove our access at any time: disconnect the tool in NoFlatline, or remove NoFlatline from your Google Account at myaccount.google.com/permissions. In Google Ads you can also remove NoFlatline's manager link under Admin, then Access and security, then Managers. When access is removed, we delete any stored access keys straight away.
3.5 AI explanations
To explain why a conversion broke and suggest a fix, we send the minimum evidence to an AI model: the changed lines of code that touch tracking, the Tag Manager tags and triggers that changed, and counts or percentages. Never personal data, never revenue. We use Anthropic's Claude through its commercial API, which does not train on API data by default. We do not store what we send; we keep the resulting explanation with the alert. Customers can switch AI off, and alerts then use rule-based explanations only.
4. Why we process it, and on what basis
- To provide the service a customer signed up for: performance of a contract (GDPR and UK GDPR article 6(1)(b)), and as the customer's processor for data from connected tools.
- To keep the service secure and reliable, including monitoring our own checks: our legitimate interest (article 6(1)(f)).
- To meet tax and accounting obligations: legal obligation (article 6(1)(c)).
5. How long we keep it
- Hourly counts: 13 months, so the service can learn yearly patterns such as bank holidays.
- Alerts and their "real break or false alarm" labels: for as long as the account exists.
- Access tokens: encrypted, and deleted the moment a tool is disconnected.
- When an account closes, we delete its data within 30 days, except anonymised labels (for example "a sign-up conversion broke after a Tag Manager change") that help keep alerts accurate and cannot be linked back to the customer.
- Invoices: as long as Italian tax law requires.
6. Who else handles data
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the website and the service, stores data, forwards email sent to hello@noflatline.com | Data stored in the EU; edge network worldwide |
| Anthropic, PBC | AI explanations, minimum data only (section 3.5) | United States, under the Standard Contractual Clauses in Anthropic's data processing terms |
| Slack Technologies and Microsoft | Deliver alerts to the channel the customer chooses | As set by the customer's own workspace |
| Google Ireland Limited | The inbox (Google Workspace) that email to hello@noflatline.com is delivered to | Google's data centres, including outside the EU, under the Standard Contractual Clauses in Google's data processing terms |
Where data leaves the EU or the UK, we rely on the EU–US Data Privacy Framework and its UK Extension or on Standard Contractual Clauses. We never sell data.
7. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw any consent. For data we process for a customer, we pass your request to that customer and help them answer it. Write to hello@noflatline.com; we reply within one month.
You can also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali) or, in the UK, the Information Commissioner's Office.
8. Changes
If we change this policy in a way that matters, we update the version and date above and tell customers by email before the change takes effect.