Legal
Privacy statement
Last updated 25 October 2026
This statement covers this website and the goalmrr app. The controller is AVS Media, Federico Fellinistraat 102, 6515 LV Nijmegen, the Netherlands (KvK 98648225), hello@avs-media.com.
This website#
What this website collects#
Nothing you do not hand over deliberately. There is no analytics, no tracking pixel, no advertising script and no social media plug-in. Fonts, images and animations are served from this website itself, not from a font or video service. When you type your domain in the box on the home page and press Start, the domain travels to the goalmrr app as part of the page address, so the app can show it back to you.
Contact and feature-request forms#
If you use these forms, what you type is used to answer you or to decide what to build. Your email address is optional. Where this website is not connected to a message service, the form opens your email program with the text ready, and nothing is sent until you send it. When it is connected, your message goes to a service run by AVS Media on Cloudflare, and your email address is stored only if you tick the box that allows it.
Search and ask#
Searching this website runs in your browser against an index that was built together with the website. Nothing you type is sent anywhere. If the ask box is connected to our assistant service, the question you ask is sent to that service so it can answer from this website's own pages. The page tells you when that is the case.
Hosting and server logs#
This website is delivered by Cloudflare, Inc. as our processor. To deliver a page Cloudflare necessarily processes your IP address and technical request data (time, page, browser) and may keep them briefly in security logs. Legal basis: our legitimate interest in delivering a secure website (Art. 6(1)(f) GDPR).
The goalmrr app#
Who is responsible#
The controller for goalmrr is AVS Media, Federico Fellinistraat 102, 6515 LV Nijmegen, Netherlands. You reach us at hello@avs-media.com.
What we process and why#
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail address, sign-in records | Create and secure your account | Art. 6(1)(b) GDPR |
| The content you put into the app | Store it and show it to you and the people you share it with | Art. 6(1)(b) GDPR |
| Payment and invoice data | Charge your plan and keep the books | Art. 6(1)(b), (c) GDPR |
| Technical logs (IP address, browser, errors) | Security, abuse prevention, fixing errors | Art. 6(1)(f) GDPR |
| Messages you send to support | Answer you | Art. 6(1)(b), (f) GDPR |
We sell no data and run no advertising trackers.
Who else handles data for us#
We use these processors under data-processing agreements:
| Processor | What for | Where |
|---|---|---|
| Convex, Inc. | database and application back end | US (EU-US Data Privacy Framework) |
| Cloudflare, Inc. | hosting and delivery of the website | EU / US (EU-US Data Privacy Framework) |
| Resend, Inc. | sending sign-in and service e-mails | US (EU-US Data Privacy Framework) |
| Stripe Payments Europe, Ltd. | payments and invoices | EU (Ireland) |
| Mollie B.V. | payments and invoices (alternative checkout) | EU (Netherlands) |
Transfers outside the EEA#
Convex, Inc., Cloudflare, Inc., Resend, Inc. may process data outside the European Economic Area. Such transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses.
How long we keep data#
| Data | Kept | Why |
|---|---|---|
| Account, profile and content | Until the account is deleted | Deleted with your account (after the grace period you chose). |
| Invoices and payment records | 2557 days | Tax law requires us to keep them (7 years). |
| A minimal deletion receipt (no name, no e-mail) | 1095 days | Proves that we honoured your request (3 years). |
| Security and error logs | 30 days | Needed to keep the service secure (30 days). |
Your rights#
You may ask for access, correction, erasure, restriction, a portable copy, and you may object to processing based on our legitimate interest.
- Download all your data yourself: Settings, Your data, Export. You get a ZIP file with your data in JSON files.
- Delete your account yourself: Settings, Your data, Delete my account. It removes your content in this app, cancels your subscription and keeps only a receipt without your name or e-mail.
- Anything else: write to hello@avs-media.com. We answer within one month.
Complaints#
You may complain to a data-protection authority, in the Netherlands the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl).
Age#
goalmrr is for people aged 16 or older.
Changes#
When this policy changes in a way that matters, we publish a new version and tell you in the app.
Your numbers#
goalmrr stores your goals, milestones, products (apps) and posts, each with its own privacy setting (private by default). Revenue numbers are not typed by you: they are read from the payment providers you connect (see below) and stored as an amount with its currency per month, or as the current monthly recurring revenue. You can export everything and delete everything from your account. A deletion waits 14 days, so you can change your mind, and is then final.
Payment provider connections#
When you connect a payment provider you give goalmrr a read-only key (or the provider's equivalent credentials). goalmrr uses it only to read totals: revenue and refunds per month and currency, the current monthly recurring revenue and the number of active subscriptions. We do not read or store your customers' names, e-mail addresses, addresses or payment details. The key is stored encrypted and is never shown again except its last four characters. Disconnecting destroys the key; the numbers it brought stay as history until you remove the connection, which deletes them. We keep a log of connecting, disconnecting and removing, which the owners of the workspace can see.
Legal basis: performing our contract with you (Art. 6(1)(b) GDPR). The connection is optional; without it goalmrr shows no revenue.
What is public#
Only a goal you publish has a public page. It always shows the title, the progress and the milestones; amounts, posts and single numbers show only when you switch them on. It names who verified the revenue and how fresh it is, never your account or your key. If you give your website domain, it becomes the name on the page and on the billboard when you publish. Unpublishing closes the page at once. While a page is published, anyone with the link can open it, and others can copy what it shows.
Legal basis: your consent, which you give by publishing and can withdraw by unpublishing (Art. 6(1)(a) GDPR).
Plans and featured spots#
Payments for plans and featured spots are handled by Stripe or Mollie. We receive the status of the payment, the amount, the plan or spot and an invoice, and keep them for seven years because tax law requires it. We never see your card number. A featured spot stores which page it is for, the term and the dates it runs.
Your own AI#
goalmrr works with your own AI. If you connect your AI assistant over MCP, that assistant reads what your permissions allow and is covered by its own provider's privacy statement. The connection is yours to create and to end.
This website and the app#
We run no analytics, no advertising and no tracking on the website or in the app. The domain you type on the home page goes to the app as part of the page address and is remembered in your browser until your first goal exists. Which things the app keeps in your browser is listed on the cookies page.