Privacy Policy

Metrik Technologies Ltd. ("Metrik", "we", "us") provides an AI-powered client reporting platform for marketing agencies. For data you provide when you visit our website or register an account, we act as the data controller.

For marketing data that agencies sync from their connected platforms — which may include personal data about the agency's clients or their customers — we act as a data processor on the agency's instructions. The agency is the controller of that data, and its own privacy notices apply to it.

• Account information. Name, email address, password (stored as a salted hash), agency name, profile settings, and two-factor authentication configuration.
• Workspace content. Client records, report configurations, branding assets, and files you upload.
• Synced marketing data. Metrics and dimensions retrieved from integrations you connect (for example campaign performance, spend, and conversion data), together with the OAuth tokens needed to access them, held with strictly restricted access.
• Billing data. Plan, subscription status, and invoice history. Card details are collected and stored by our payment processor, Stripe — we never see or store full card numbers.
• Usage & device data. Log data such as IP address, browser type, pages viewed, feature usage events, and device/session identifiers used for security (for example recognizing trusted devices).
• Communications. Support requests, survey responses, and emails you exchange with us.

We do not knowingly collect special-category (sensitive) personal data through the Service.

• Provide, operate, and secure the Service, including authentication, session management, and fraud prevention;
• Sync and process the marketing data you connect in order to build the reports and dashboards you request;
• Generate AI summaries and insights from your data when you use AI features;
• Process payments, manage subscriptions, and enforce plan limits;
• Send transactional messages (verification, security alerts, billing notices) and — with your consent where required — product updates you can opt out of;
• Analyze aggregate usage to improve performance, reliability, and features;
• Comply with legal obligations and enforce our terms.

• Contract — providing the Service you signed up for, including syncing data and generating reports;
• Legitimate interests — securing the Service, preventing abuse, and improving our product in ways users reasonably expect;
• Consent — optional marketing communications and non-essential cookies, which you can withdraw at any time;
• Legal obligation — tax, accounting, and lawful requests from authorities.

When you use AI features, relevant slices of your workspace data (such as campaign metrics for a reporting period) are processed by our AI infrastructure and vetted model providers acting as subprocessors to generate summaries and insights for you.

• Your data is not used to train our or third parties' foundation models;
• We configure model providers not to retain your content beyond transient processing;
• AI output is stored in your workspace like any other report content and is deleted with it.

We do not sell personal data. We share it only with:

• Subprocessors that host and support the Service — cloud hosting, database and storage providers, Stripe (payments), email delivery, error monitoring, and AI model providers — under data-processing agreements;
• Connected platforms you explicitly authorize, strictly within the scopes you grant;
• Your workspace — team members and, when you share a report, the recipients you choose;
• Authorities or successors when required by law, or in connection with a merger or acquisition (we will notify you of any change in ownership affecting your data).

• Account and workspace data: for the life of your account, then deleted within 30 days of a verified deletion request (ask us for a copy of your data beforehand if you need one);
• Synced marketing data: while the integration remains connected and your account is active;
• Server logs and security events: up to 12 months;
• Billing records: as required by tax and accounting law (typically 7 years).

Backups are purged on a rolling basis within 35 days of deletion from production systems.

We protect your data with industry-standard measures: TLS encryption in transit, salted password hashing, encrypted two-factor authentication secrets, optional two-factor authentication, session and trusted-device management, rate limiting, and role-based access controls. Access to production data is restricted to authorized personnel with a need to know, and we continue to strengthen these controls as the Service evolves.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law. Report security concerns to security@metrik.io.

Depending on where you live (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or receive a portable copy of your personal data, restrict or object to certain processing, withdraw consent, and lodge a complaint with a supervisory authority. We do not discriminate against you for exercising these rights.

You can manage your profile, security, and billing information directly in the app. For access, export, correction, or deletion requests, email privacy@metrik.io — we will verify your identity and respond within the timelines required by law. If your data was synced into Metrik by an agency, we may redirect your request to that agency as the controller and will assist them in fulfilling it.

We may process data in countries other than your own, including the United Kingdom, the European Economic Area, and the United States. Where personal data is transferred out of the UK or EEA, we rely on adequacy decisions or Standard Contractual Clauses, together with technical safeguards such as encryption.

• Essential cookies — authentication (session and refresh tokens), security, and load balancing. These cannot be switched off;
• Functional cookies — preferences such as theme and dismissed banners;
• Analytics — first-party product analytics that help us understand feature usage. We honor opt-outs and do not use third-party advertising cookies.

You can control cookies through your browser settings; blocking essential cookies will prevent sign-in.

The Service is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as our Service and the law evolve. For material changes we will notify you by email or in-app notice before they take effect. The "Last updated" date above always reflects the current version. Earlier versions are available on request.

Metrik Technologies Ltd. · privacy inquiries and data-subject requests: privacy@metrik.io. See also our Terms of Service.