Privacy notice

Last updated: 30 October 2026

This notice describes ga4-gsc-mcp, part of the Huskii Marketing MCP Hub and operated by Huskii. It is written for the people who sign in to it: marketers Huskii has given access.

Who can sign in

The server only completes a sign-in for a short list of individually allowed Google accounts, and only when Google has verified the address. No domain is admitted as a whole. Anyone else is shown a refusal that names the address they used; nothing is stored about that attempt, and the Google token issued for it is revoked immediately.

What signing in stores

When you sign in with Google, this server stores your Google user id, name, email address, and the access and refresh tokens Google issues, encrypted in Cloudflare Workers KV and in a Cloudflare Durable Object bound to your session. They are used for one purpose: calling the Google Analytics and Search Console APIs as you, while your session lasts.

What it does not store

Report rows are never persisted. The numbers a report returns, and the rows a Search Console query returns, pass through this Worker to your MCP client and are not written to any store here. Neither is the content of the properties you read.

What it records, and for how long

• Reads: metadata only, meaning who called which tool against which property and when, with no result rows. Retained for 30 days.
• Writes: who changed what, on which resolved target, with the before and after state of the changed fields and the confirmation that authorized it. Retained for 365 days, because a change to a client's analytics configuration must remain explainable long after it was made.

What the record cannot tell you

Where marketers share one Google account, Google's own audit log names that shared account rather than the individual person. This server records the MCP session that made each change, which is a weaker form of attribution than a named Google user. Treat it accordingly.

Legal basis and who processes the data

Huskii is the data controller. The connection to your Google account rests on your consent, given on Google's consent screen and withdrawable at any time. The audit records rest on Huskii's legitimate interest in being able to explain who changed what in a client's analytics configuration. Cloudflare, Inc. hosts this server and stores the session and audit data on Huskii's behalf under its standard data processing terms; Google Ireland Limited and Google LLC provide the APIs and the sign-in. Both may process data outside the European Economic Area; where that happens, transfers rely on the European Commission's Standard Contractual Clauses. Nobody else receives data from this server. These pages load the Space Grotesk font from Google Fonts, so opening them sends your IP address and browser details to Google; the pages set no cookies and use no analytics.

The AI client you connect, for example Claude, is a separate service run by a separate company under its own terms and privacy policy. What you type into it, and what this server returns to it, is handled by that company under that policy, not by this one.

Google API Services User Data Policy

Huskii's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used only to provide the features you request through your MCP client. It is not transferred to third parties except as necessary to provide those features, is not used for advertising, and is not read by humans except with your consent, for security purposes, or to comply with the law.

Your rights

You can ask Huskii what is stored about you, have it corrected or deleted, and object to the processing, by writing to info@huskii.be. You can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit). Revoking the app's access, see below, ends the processing of your tokens immediately; audit records are deleted at the end of their retention period, or earlier on request.

Withdrawing access

You can revoke this server's access to your Google account at any time at myaccount.google.com/permissions. Revoking ends every session immediately. Ask Huskii to remove the stored session records if you want them deleted before their retention period ends.

Contact

Huskii, Sint-Barbarastraat 100, 3590 Diepenbeek, Belgium. VAT BE 0689.570.723. Phone +32 499 61 92 81. Privacy questions: info@huskii.be.