Privacy Notice
Last updated: 30 October 2026
Who is responsible for your data
This service, the Huskii Marketing MCP Hub (the "Service"), is operated by Huskii. Huskii is the data controller for the personal data described below within the meaning of the General Data Protection Regulation (GDPR).
Huskii
Sint-Barbarastraat 100
3590 Diepenbeek
Belgium
VAT BE 0689.570.723
Email: info@huskii.be
Telephone: +32 499 61 92 81
What the Service does
The Service is a Model Context Protocol (MCP) server. It lets an AI client, such as Claude, work with Google Tag Manager on your behalf. You sign in with your own Google account and grant the Service permission to use the Google Tag Manager API. From then on, the Service can read and change exactly the Tag Manager accounts and containers your own Google account already has access to, and nothing beyond that.
What personal data we process
| Data | Why | Where it is kept |
|---|---|---|
| Your Google account identifier, email address and display name | To identify your session and show you which account is connected | Cloudflare KV, for as long as the authorisation lasts |
| Google OAuth tokens (an access token and a refresh token) | To call the Google Tag Manager API as you, without asking you to sign in for every action | Cloudflare KV and a Cloudflare Durable Object, encrypted in transit and at rest by Cloudflare |
| Operational logs (which tool was called, when, and whether it succeeded) | To debug problems and to keep a record of changes made to Tag Manager containers | Cloudflare Workers logs |
What we do not do
- We do not store the contents of your Google Tag Manager accounts, containers, tags, triggers or variables. That data passes through the Service in response to your requests and is not retained.
- We do not sell, rent or share your personal data with third parties for their own purposes.
- We do not use your data for advertising or profiling.
Legal basis
- Consent for the connection to your Google account. You grant it on Google's own consent screen and can withdraw it at any time, see "Your rights" below.
- Legitimate interest for operational logging, so that Huskii can run the Service reliably and can establish who made a change to a Tag Manager container.
Google API Services User Data Policy
Huskii's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely, data obtained through Google APIs is used only to provide the features you request through your MCP client. In particular:
- We do not use, transfer or sell this data to create, train or improve any machine learning or artificial intelligence model, whether generalised or personalised.
- We do not use it for advertising.
- We do not allow humans to read it, except where you have given explicit permission, where it is necessary for security purposes such as investigating abuse, where the law requires it, or where the data has been aggregated and anonymised.
- We do not retain Tag Manager content beyond what is needed to answer the request that asked for it.
Note that the AI client you connect, for example Claude, is a separate service run by a separate company under its own terms and privacy policy. Data you send to it is governed by that policy, not by this one. Choose your MCP client accordingly.
Who processes data on our behalf
- Cloudflare, Inc. hosts the Service and stores the authorisation data described above.
- Google Ireland Limited / Google LLC provides the Tag Manager API and the sign-in flow.
Both may process data outside the European Economic Area. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses.
How long we keep it
Authorisation data is kept until you disconnect, whichever comes first:
- You revoke access from your Google Account permissions page.
- You call the
gtm_remove_sessiontool from your MCP client, which deletes the stored authorisation for your account. - Google expires the token on its own, for example when you change your Google password or when Google revokes it for security reasons.
Operational logs live in Cloudflare Workers Logs and are kept for three days, the retention of our Cloudflare plan, after which they are discarded automatically.
Who can sign in
The Service only completes a sign-in for verified Google accounts that Huskii has individually allowed. Anyone else is shown a refusal that names the address they used; nothing is stored about that attempt, and the Google token issued for it is revoked immediately.
Security
- All traffic to and from the Service uses HTTPS.
- Tokens are held in Cloudflare's storage rather than in application code or in the source repository.
- The Service requests only the Google permissions it needs to operate the Tag Manager tools it exposes.
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, and to data portability. To exercise any of these, contact us at info@huskii.be.
You can withdraw the Service's access to your Google account yourself at any time, without contacting us, at myaccount.google.com/permissions.
If you believe we have handled your data improperly, you may lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be.
Children
The Service is a professional tool and is not directed at children. We do not knowingly process the personal data of anyone under 16.
Changes to this notice
We may update this notice as the Service develops. The date at the top reflects the most recent change. Material changes will be communicated to the people using the Service.
Contact
Questions about this notice or about how the Service handles data: info@huskii.be, or by post at the address above.