Cookie Policy

This Cookie Policy explains how EGOS Technologies Limited ("we", "us") uses cookies and similar technologies on kongmetrics.com (the "Site") and in the Kong Metrics application at app.kongmetrics.com (the "App"). Read it together with our Privacy Policy, which explains how we use personal data and your rights.

1. Who we are

The controller is EGOS Technologies Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Registered in England and Wales, Companies House number 17154724. ICO registration number ZC212827. Contact: [email protected].

2. What cookies and similar technologies are

A cookie is a small text file that a website stores in your browser. Similar technologies include local storage and session storage in your browser, and scripts that read information from your device and send it to a server. This policy uses "cookies" for all of them. Some cookies are set by us (first party); others are set by the providers we use (third party).

3. One choice for the Site and the App

Your choice is stored in the km_consent cookie on .kongmetrics.com, so it applies to both the Site and the App. We keep it for 12 months. After 12 months, or when we change the list of cookies in a way that needs new consent, we ask you again. Until you choose, only strictly necessary cookies are used and no analytics or advertising script loads.

4. Categories and legal basis

• Strictly necessary: Remember this choice, protect the sites from bots, and in the App keep you signed in, remember your workspace, and run checkout. Always on. The App also remembers a display theme when you select one. Legal basis: No consent is needed to store or read these items: the strictly necessary exemption in PECR regulation 6 and ePrivacy Directive Article 5(3). This exemption covers only the storage on your device. The App display theme is not strictly necessary; for it we rely on a different exception, which the note below the Strictly necessary table explains. For the personal data involved, UK GDPR and EU GDPR need a lawful basis: we rely on contract (Article 6(1)(b)) for sign-in, session, and account items, legitimate interests (Article 6(1)(f)) for security and bot protection items, legitimate interests (Article 6(1)(f)) for your display theme in the App (theme), and legal obligation (Article 6(1)(c)) for your consent record (km_consent).
• Analytics: PostHog product analytics (no session replay), Google Analytics 4 through Google Tag Manager, and Cloudflare Web Analytics. Legal basis: Your consent (PECR regulation 6 and ePrivacy Directive Article 5(3); UK GDPR and EU GDPR Article 6(1)(a)).
• Advertising: Advertising and conversion tags in Google Tag Manager. Legal basis: Your consent (PECR regulation 6 and ePrivacy Directive Article 5(3); UK GDPR and EU GDPR Article 6(1)(a)).
• Session replay: PostHog session recording in the Kong Metrics App, with all text and inputs masked. Needs Analytics. This Site does not use PostHog session recording. Legal basis: Your consent (PECR regulation 6 and ePrivacy Directive Article 5(3); UK GDPR and EU GDPR Article 6(1)(a)).

For the personal data in strictly necessary cookies, our lawful basis under UK GDPR and EU GDPR depends on the purpose. The Strictly necessary table in section 6 shows the basis of each item.

• Sign-in, session, and account items: Contract (Article 6(1)(b)). We need them to provide the App service that you signed up for.
• Security and bot protection items: Legitimate interests (Article 6(1)(f)). Our legitimate interest is to keep the Site, the App, and their users secure.
• Your display theme in the App (theme): Legitimate interests (Article 6(1)(f)). Our legitimate interest is to remember the display theme that you select.
• Your consent record (km_consent): Legal obligation (Article 6(1)(c)). We must be able to show that you gave or refused consent (UK GDPR Article 7(1) and PECR).

Strictly necessary cookies are always on. Analytics, Advertising, and Session replay are off until you turn them on, and "Reject all" is as easy as "Accept all".

5. How to change or withdraw your choice

You can change or withdraw your consent at any time. Withdrawing is as easy as giving consent.

Open cookie preferences

You can also use "Cookie preferences" in the footer of every Site page, or in the account menu and on the sign-in page of the App. We do not load an analytics or advertising tool until you consent to its category. When you withdraw a category, we stop the tool, tell Google Tag Manager your new choice, delete the cookies and browser storage that we can reach from our own domains, and then reload the page so that the tool's code no longer runs. If your browser blocks the cookie that saves your choice, we stop the tool on the open page but do not reload it, because a reload would read your old choice. As an extra safeguard, our pages also try to block requests to the hosts of tools that you have not allowed; this safeguard cannot cover every way in which a browser can send a request. Cookies that third parties set on their own domains (for example .doubleclick.net) can only be deleted through your browser settings.

6. Cookies we use

The tables list each cookie or storage item with its provider, purpose, expiry, and where it is used. "Expiry" is how long the item stays in your browser; it is not how long the provider keeps the data. Names with <…> or * stand for a family of names.

Strictly necessary

Note on the display theme (theme): The App stores this item only when you choose Light or Dark in its Theme menu. The menu tells you there that this choice is saved on your device. The App uses the item only to show the appearance that you chose. This item is not strictly necessary. The item has no expiry. To object, choose System in the Theme menu: the App deletes the item, stops reading it, and follows your device setting. You can also clear the site data for app.kongmetrics.com in your browser. In the UK, we rely on the PECR exception for appearance settings that you request, because the menu tells you about the storage and choosing System is a simple, free way to object. (ICO guidance on the exceptions). For visitors in the EU, we rely on Article 5(3) of the ePrivacy Directive for a preference that you request: you get information at the control and make an informed choice to save the preference, as Article 29 Working Party Opinion 04/2012 (section 3.6) describes. (Opinion 04/2012).

Analytics

Cloudflare Web Analytics also runs only after Analytics consent. Its script sets no cookie and uses no browser storage, but it reads page-load performance data from your browser and sends it to Cloudflare, so we treat it as Analytics.

Advertising

Session replay

In the App, PostHog records sessions with all text and inputs masked, and only when you allow both Analytics and Session replay. Our cookie inventory found no separate cookie or storage item for it; it uses the PostHog items in the Analytics table. This Site does not use PostHog session recording.

Some third-party items appear only in certain cases: Google advertising cookies when advertising or conversion tags run, and Cloudflare cf_clearance when you pass a security challenge.

When you choose Sign in with Google in the App, Google may use its own account and security cookies, including SID and HSID on Google domains. Google controls its own account-security processing. See how Google uses cookies.

7. Third parties and international transfers

• Google (Google Tag Manager, Google Analytics 4, advertising tags): Analytics and Advertising. We use Google Consent Mode v2: Google analytics and advertising storage start as denied and change only with your choice. For Sign in with Google in the App, see the Google notice in section 6. See how Google uses cookies.
• PostHog (product analytics; session replay in the App): Analytics and Session replay. Data is sent to PostHog's EU hosting (eu.i.posthog.com).
• Cloudflare (content delivery, security challenges, Turnstile bot protection in the App, and Web Analytics): strictly necessary, except Web Analytics, which is Analytics.
• Paddle (checkout in the App, as our Merchant of Record): strictly necessary for payment. Paddle may set its own cookies in the checkout; we have not verified their names, so they are not in the tables. See Paddle's Privacy Policy.

Google and Cloudflare can process data outside the UK and the European Economic Area, including in the United States, under their published terms and transfer safeguards. Section 9 of our Privacy Policy describes international transfers.

8. Browser controls

You can block or delete cookies and site data in your browser settings, and most browsers let you block third-party cookies. If you block all cookies, we cannot save your choice; we then apply it to the open page only and ask again on the next page. Blocking strictly necessary cookies can stop sign-in and checkout in the App from working. Help pages: Chrome, Firefox, Safari, Edge.

9. Changes to this policy

We update this policy when the cookies we use change. The "Last updated" date at the top shows the latest version. If a change needs new consent, the banner asks you again.

10. Contact and complaints

For questions about cookies or your data, contact [email protected] or write to EGOS Technologies Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to your local data protection authority.