AskGSC vs nilly

Compare AskGSC and nilly on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

Logo: AskGSC

AskGSC

France· Web Analytics

Needs review

Shortlist AskGSC when a French-operated, hosted MCP layer is enough to query authorized Google Search Console data inside ChatGPT, Claude, or similar assistants. Skip when you need self-hosted control, write access, a site crawler, or first-party web analytics. Consider Plausible Analytics or Piwik PRO for on-site analytics, or a self-hosted GSC MCP when infrastructure ownership is the requirement.

EU-operatedHosted GSC MCPRead-only Google OAuthNo local MCP serverMulti-assistant MCP
Logo: nilly

nilly

Switzerland· Web Analytics

Needs review

Shortlist nilly when you want Swiss-entity, cookieless, ultra-light site analytics with realtime dashboards, city geo, custom events, unlimited sites, and an API—without GA4 consent weight. Skip when you need self-host/open source, enterprise audit packs, or deep marketing-suite analytics; consider Plausible Analytics, Simple Analytics, or etracker instead.

Cookieless trackingSwiss-hosted (claimed)Swiss entitySub-1 kB scriptREST APISaaS only
AskGSC vs nilly: Snapshot
FeatureLogo: AskGSCAskGSCLogo: nillynilly
Country of originFranceSwitzerland
CategoryWeb AnalyticsWeb Analytics
Open sourceNoNo
Self-hostedNoNo
HeadquartersFranceSwitzerland
Legal entityKALYVOX SASULyo GmbH, Europaallee 41, 8004 Zürich (CHE-417.675.763)
Governing lawNot listedSwitzerland (terms)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)MediumMedium
EU-hosted statusPartialNot listed
Hosting / residencyFrench operator; public providers include Lovable (web app hosting), Supabase (auth/DB/backend), Google APIs, Stripe for payments, and Cloudflare in front of the MCP host (mcp.askgsc.app CNAME to askgsc.pages.dev). Exact DB/hosting regions are not disclosed on AskGSC pages.Vendor FAQ: analytics servers in Switzerland (multiple locations). Public site reverse-DNS: KreativMedia/METANET Zürich. Customer-account subprocessors named in privacy policy: Stripe (US payments), Mailerlite (email). Avatars via Gravatar. No full public subprocessor list for backups/monitoring/CDN.
Summary

French hosted MCP connector that gives ChatGPT, Claude, and other assistants read-only Google Search Console analytics for SEO decisions without CSV exports.

Swiss privacy-first web analytics (Lyo GmbH): cookieless, sub-1kB tracking with realtime dashboards, city-level geo, custom events, unlimited sites, and a REST API as a lightweight Google Analytics alternative.

Tags
At a glance: AskGSC vs nilly
At a glanceLogo: AskGSCAskGSCLogo: nillynilly
HQToulouse, FranceZürich, Switzerland (Lyo GmbH)
Legal entityKALYVOX SASU (SIREN 999 458 409)Lyo GmbH (CHE-417.675.763)
Product typeHosted MCP connector for Google Search ConsoleNot listed
Google scopewebmasters.readonlyNot listed
Self-hostNo (hosted SaaS)Not listed
Open sourceNot claimedNot listed
Product modelNot listedSaaS web analytics (not self-hosted)
TrackingNot listedCookieless; no IP/fingerprint claims
Hosting (claimed)Not listedSwitzerland (multi-site)
Commercial modelNot listedTraffic-based plans; trial; no permanent free tier
Live site noteNot listedkandur.one (nilly branding; nilly.io DNS failed at research)
Cookieless trackingNot a site tracker; reads GSC via Google OAuth/APINot listed
Data residency regionsNot published; privacy policy allows non-EEA processing by providers/assistantsNot listed
Key capabilities: AskGSC vs nilly
Key capabilitiesLogo: AskGSCAskGSCLogo: nillynilly
EU-operatedYesNot listed
Hosted GSC MCPYesNot listed
Read-only Google OAuthYesNot listed
No local MCP serverYesNot listed
Multi-assistant MCPYesNot listed
Cookieless trackingNot listedYes
Swiss-hosted (claimed)Not listedYes
Swiss entityNot listedYes
Sub-1 kB scriptNot listedYes
REST APINot listedYes
SaaS onlyNot listedYes

AskGSC

  • Hosted remote MCP for Search Console

    Provides a remote MCP URL (mcp.askgsc.app) that compatible assistants call on demand. No local MCP server, Google Cloud project, or CSV export is required for the standard flow.

  • Eleven read-only GSC analysis tools

    Tools cover overview trends, query/page/country/device search analytics, period comparisons, opportunity signals, URL inspection (last-known indexing), and sitemap checks. None can modify Search Console or the website.

  • Read-only Google OAuth scope

    Uses https://www.googleapis.com/auth/webmasters.readonly plus identity scopes for sign-in. Users can revoke access from Google account connections; AskGSC states it does not sell Google user data or train its own models on it.

  • Works across multiple MCP clients

    Documented integrations include ChatGPT, Claude, Notion AI, Cursor, Claude Code, and Codex using one hosted MCP server rather than a separate connector per assistant.

  • Trial then limited free access, optional Pro

    A card-free trial starts when Search Console is connected. After the trial the account can remain on a limited free allowance; Pro is an express paid subscription for fuller tool access. Plan figures belong on the vendor pricing page.

nilly

  • Sub-1 kB cookieless tracking script

    Vendor documents a client script under 1 kB with no cookies, no IP tracking, and no fingerprinting for site visitors. Suited to teams that want aggregate traffic metrics without analytics cookie banners; still get counsel for your jurisdiction and CMP setup.

  • Realtime dashboard with geo, tech, and campaigns

    Dashboards cover live visitors, overview metrics, top pages, referrers, UTM campaigns, geography from continent to city, and device/browser/OS breakdowns—enough for content and acquisition decisions without a full product-analytics suite.

  • Custom events, CSV export, and email reports

    Define custom events for conversion-style actions, export statistics as CSV, and receive email reports. Fits operators who need lightweight conversion signals and offline analysis rather than session replay or multi-step funnels.

  • REST API for stats, websites, and account

    Documented API endpoints (Bearer API key) manage stats queries (pageviews, visitors, referrers, events, geo, devices, and more), websites, and account objects—useful for internal dashboards or automations on traffic-based plans that include API access.

  • Unlimited websites on traffic-based plans

    Public pricing model is pageview-tier SaaS with unlimited websites per account and a short free trial—not a permanent free tier. Good for agencies or multi-brand operators who outgrow per-site free plans elsewhere; confirm current tiers on the vendor site.

Assurance & compliance: AskGSC vs nilly
Assurance & complianceLogo: AskGSCAskGSCLogo: nillynilly
Independent security / no-logs audit
Not found

No public independent audit PDF or report linked from the site.

Not found

No public third-party audit report found for tracking claims.

ISO 27001
Not found
Not found

No vendor ISO 27001 certificate published on product site (underlying Swiss host DCs may be certified separately).

SOC 2 / SOC 3
Not found
Not found
GDPR / EU data protection
Vendor claimed

French controller; GDPR rights section and CNIL reference on privacy policy. Confirm DPA for B2B.

Vendor claimed

Swiss entity; privacy policy includes GDPR rights language; cookieless visitor tracking claimed. Confirm DPA for B2B.

US CLOUD Act exposure (indicative)
Partial

EU entity / no known US parent, but Google, Supabase, Stripe, Cloudflare/Lovable, and user-selected US AI assistants appear in the public data path. Not legal advice.

Partial

Swiss operator, no known US parent, Swiss-claimed analytics hosting; US SaaS subprocessors Stripe (payments) and Gravatar (avatars) on customer path. Not legal advice.

Data processing agreement (B2B)
Not found

No public DPA download found; ask vendor.

Not found

No public DPA download found; request from vendor.

EU AI Act
Partial

AskGSC is an MCP data gateway to user-selected AI assistants rather than a published generative model. AI Act obligations may still matter for how connected assistants are used; confirm with counsel.

Not applicable

Web analytics product; not marketed as an AI system.

Swiss Made Software / Swiss Web labelsNot listed
Vendor claimed

Cited on About and Swiss Union member page as recognition/labels—not a security audit.

Considerations & known limitations: AskGSC vs nilly
Considerations & known limitationsLogo: AskGSCAskGSCLogo: nillynilly
US-group cloud and SaaS in the data path
Medium

Privacy policy names Google, Supabase, Lovable, and Stripe; MCP DNS uses Cloudflare Pages. Search Console results also flow to the AI client you connect. Teams with strict EU-only subprocessor rules need a written region and subprocessor schedule.

Medium

Stripe (payments) and Gravatar (avatars) are US-group services. Visitor metrics are claimed Swiss-hosted and non-personal, but account/billing data is not Switzerland-only end-to-end.

No public independent audit or cert package
Medium

ISO 27001, SOC 2, and independent security audits were not found on public pages. Security claims rest on vendor documentation (encrypted refresh tokens, read-only scope).

Not listed
Depends on Google Search Console data quality
Low

Vendor docs note GSC data may be delayed, aggregated, or incomplete, and average position is not a real-time ranking. AI interpretations remain the user's responsibility.

Not listed
Very new legal entity
Low

KALYVOX appears in the French registry as created in January 2026. Expect limited public operating history and incomplete legal placeholders (retention periods, mediator contact) on some policy pages.

Not listed
Brand/domain transition (nilly.io vs kandur.one)Not listed
Medium

Product still branded nilly, but the live marketing/API host is kandur.one; nilly.io did not resolve in DNS during research. Verify tracking domains, docs, and status before production cutover.

Thin public assurance packNot listed
Medium

No public ISO 27001/SOC 2, independent security audit, or DPA page found. Fine for many SMB shortlists; friction for regulated enterprise questionnaires.

No self-host or open-source editionNot listed
Low

Cannot run on your own infra or audit server code from a public repo. Hard limit for sovereignty programs that require self-host.

Small independent operatorNot listed
Low

Founder-owned Swiss GmbH without VC narrative—positive for independence, but buyers should assess support SLAs, roadmap continuity, and single-vendor concentration.

Fit

AskGSC

Best fit when

  • Founders and SEO operators who already decide inside ChatGPT, Claude, Notion AI, or coding agents
  • Teams that need recurring GSC questions (period compare, losing pages, low CTR) without CSV exports
  • Buyers who want read-only Google access and a hosted MCP URL rather than running their own server
  • Organizations that prefer a French contracting entity for a lightweight SEO analysis connector

Poor fit when

  • Needs to write to Search Console, request indexing, or edit the website through the connector
  • Requires self-hosted MCP, custom tool code, or fully controlled token storage and regions
  • Looking for cookieless first-party web analytics instead of Google search performance data
  • Procurement blocked without a public DPA, ISO 27001, or independent audit package

Consider instead when

  • When: You need first-party site analytics rather than Google Search Console metrics

    Consider: Plausible Analytics or Piwik PRO

    Different data source: on-site collection vs Google search reports

  • When: You must operate the MCP stack and credentials yourself

    Consider: Self-hosted Google Search Console MCP

    AskGSC's own compare pages frame this as higher setup for more control

  • When: Manual one-off analysis is enough

    Consider: Google Search Console UI and CSV exports

    No third-party MCP or assistant data path

nilly

Best fit when

  • Privacy-conscious SMBs and indie sites replacing GA4 with aggregate metrics only
  • Teams that want Swiss legal entity and Swiss-located analytics servers
  • Operators running many sites who benefit from unlimited websites on traffic tiers
  • Builders who need a simple REST API for pageviews, referrers, geo, and events
  • Sites prioritizing minimal JS weight and fewer analytics consent prompts

Poor fit when

  • Organizations that must self-host or review open-source analytics code
  • Buyers needing published ISO 27001/SOC 2 or a full public DPA/subprocessor pack
  • Marketing teams requiring session replay, heatmaps, or advanced e-commerce/ad sync suites
  • Enterprises that need SSO/SCIM, formal SLAs, and large-vendor assurance paperwork as table stakes

Consider instead when

  • When: You want open-source and/or self-host privacy analytics with a larger community

    Consider: Plausible Analytics or Pirsch Analytics

    nilly is proprietary SaaS only.

  • When: You want another European cookieless SaaS with a simple product story

    Consider: Simple Analytics

    Dutch peer; compare geo depth, API, and residency claims side by side.

  • When: You need deeper marketing, shop, and tag/consent analytics for EU enterprises

    Consider: etracker

    German suite-oriented alternative; heavier than nilly's lightweight dashboard.

  • When: You depend on free unlimited scale and Google ads/ecosystem integration

    Consider: Google Analytics (GA4)

    Different privacy and residency tradeoffs; not a sovereignty shortlist.

Open questions for due diligence

AskGSC

  • Will KALYVOX sign a B2B DPA and publish an authoritative subprocessor list with regions?
  • Which Supabase and Lovable regions host AskGSC production data today?
  • Are ISO 27001, SOC 2, or independent penetration-test reports available under NDA?
  • What exact retention applies to technical logs and backups (privacy page still has placeholders)?

nilly

  • Will Lyo GmbH sign a B2B DPA and provide a current full subprocessor list (including backups, monitoring, CDN)?
  • Is analytics data retained only on Swiss hosts, or are any DR/replicas outside Switzerland?
  • What is the durable public domain for tracking scripts and API (kandur.one vs nilly.io) for the next 12 months?
  • Are there enterprise features (SSO, roles, retention controls, MSA/SLA) beyond self-serve traffic plans?
  • Can the vendor provide any independent security assessment under NDA?