Privacy Policy

Kong Metrics is operated by EGOS Technologies Limited ("we," "us," or "our"), the controller of your personal data. We operate the website kongmetrics.com (the "Marketing Site") and the application at app.kongmetrics.com (the "Service"). This Privacy Policy describes how we collect, use, and share information when you use our Marketing Site and Service.

By using our Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials via Google OAuth. We do not store your Google password. We only request the minimum OAuth scopes required to access your Google Search Console data.

1.2 Google Search Console Data

When you connect a Google Search Console property, we access and store search analytics data including queries, pages, clicks, impressions, click-through rates, and average positions. This data is used solely to provide you with analytics, insights, and recommendations within the Service.

1.3 Public Content of Your Website

To label your pages (for example product, category or article), the Service may fetch public pages of the websites you connect. We fetch only URLs that Google Search Console reports for your property, identify ourselves with an honest user agent, respect robots.txt, and read only the page title, headings, meta description and the beginning of the visible text. We do not log in to your website or read pages that are not public.

1.4 Payment Information

Payment processing is handled by Paddle, our Merchant of Record. We do not store your credit card number or payment details directly. Paddle processes your payment and provides us with transaction identifiers, subscription status, and billing history. Please review Paddle's Privacy Policy for details on their data handling practices.

1.5 Usage Data

We may collect information about how you interact with the Service, including pages visited, features used, and actions taken. This helps us improve the product and user experience.

1.6 Marketing Site

The Marketing Site (kongmetrics.com) and the Service use optional analytics and advertising technologies only after you enable the relevant category through our cookie consent banner. PostHog, Google Analytics 4 through Google Tag Manager, and Cloudflare Web Analytics are controlled by the Analytics category. Google advertising and conversion tags are controlled by the Advertising category. Before you grant consent, no optional tracking scripts are loaded and no analytics or advertising data is collected. See Section 7 and our Cookie Policy for details and instructions for changing your preferences.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Generate analytics dashboards, insights, and recommendations
Classify search queries and pages with automated AI tools (for example brand or non-brand, search intent, question, page type) so you can filter and analyze them. These labels describe search terms and web pages; they are not used to make decisions about individuals.
Suggest brand rules and query or URL groups when you request an AI suggestion
Process payments and manage your subscription
Send transactional emails (account confirmations, billing receipts, security alerts)
Respond to support requests
Detect, prevent, and address technical issues or abuse
Understand Marketing Site and Service usage and diagnose errors when Analytics consent is enabled
Measure advertising and identify company-level interest when Advertising consent is enabled

We do not sell your personal data. We do not use your Google Search Console or Analytics data for advertising purposes.

3. Data Sharing and Third Parties

We share your information only in the following circumstances:

Paddle: Payment processing, invoicing, and tax compliance
Infrastructure providers: Cloud hosting and data storage (EU-based)
Cloudflare: Content delivery and network security for the Marketing Site, the Service, and the Admin, and consent-based performance measurement (Cloudflare Web Analytics)
AI service providers: To provide the AI features of the Service, we send the minimum data a task needs to these processors:
- TypeSafe AI, Inc. (United States): classification of search queries and page text (labels such as brand, intent, question and page type). With a search query we can also send your site's domain, the brand and product-line names you enter in the site settings, and the title or path of the page that gets the most clicks for that query, so the label fits your site. TypeSafe acts as our processor under a data processing agreement, does not train or fine-tune models on our input, and does not disclose it to third parties other than its own service providers.
- OpenRouter (United States): AI suggestions you request, such as brand rules and query or URL groups. The request contains your site's domain and its top search queries.
PostHog: Consent-based product analytics and error diagnostics for the Marketing Site and the Service, and consent-based session replay in the Service
Google: Consent-based tag management and audience measurement through Google Analytics 4 (Analytics), and advertising reporting and remarketing (Advertising)
Legal requirements: When required by law, regulation, or legal process
Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice

We do not share your search analytics data with any third party for their own purposes. AI service providers process it only to return results to us.

4. Data Retention

We retain 16 months of Google Search Console history backfilled, as available from Google. Account information is retained for as long as your account is active. Labels we create for your queries and pages are stored with your analytics data and deleted with it. AI service providers keep the data we send them only as long as their data processing terms allow for providing their service.

Your subscription includes the full feature set. If you add or remove a property, billing changes follow the timing described on the Pricing page. If you delete your account, we will handle personal data and analytics data according to our retention practices and applicable legal obligations.

5. Data Security

We implement industry-standard security measures to protect your data:

Encryption in transit using TLS 1.3
Encryption at rest for stored data
OAuth tokens with minimal required scopes (no password storage)
Regular security audits and vulnerability assessments
Role-based access controls for internal systems

While we strive to protect your data, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us immediately at [email protected].

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

6.1 GDPR (European Economic Area)

Access: Request a copy of the personal data we hold about you
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Request your data in a structured, machine-readable format
Restriction: Request restriction of processing
Objection: Object to processing based on legitimate interests

6.2 CCPA (California)

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

7. Cookies and Tracking

Our Cookie Policy lists every cookie and browser-storage item we know of, with its provider, purpose, expiry, and whether it is used on the Marketing Site or the Service.

7.1 Marketing Site (kongmetrics.com)

The Marketing Site uses a cookie consent banner with equal "Accept all" and "Reject all" buttons and a "Manage preferences" option. No optional script loads before you make a choice. Google Tag Manager loads when you enable Analytics or Advertising, with Google Consent Mode v2 set to denied before it starts. We do not load a tool until you consent to its category. As an extra safeguard, the page also tries to block requests to the hosts of tools that you have not allowed; this safeguard cannot cover every way in which a browser can send a request. You can change or withdraw your consent at any time by clicking "Cookie preferences" in the site footer. Your choice is stored for 12 months in the km_consent cookie on .kongmetrics.com and applies to both the Marketing Site and the Service.

We use the following categories of cookies and tracking technologies:

Strictly necessary: Required for sign-in, security, and to remember your consent choice. These cannot be disabled. PECR regulation 6 and ePrivacy Directive Article 5(3) do not require consent to store them; for the personal data involved, our lawful basis under UK GDPR and EU GDPR is:
- Sign-in, session, and account items: Contract (Article 6(1)(b)). We need them to provide the App service that you signed up for.
- Security and bot protection items: Legitimate interests (Article 6(1)(f)). Our legitimate interest is to keep the Site, the App, and their users secure.
- Your display theme in the App (theme): Legitimate interests (Article 6(1)(f)). Our legitimate interest is to remember the display theme that you select.
- Your consent record (km_consent): Legal obligation (Article 6(1)(c)). We must be able to show that you gave or refused consent (UK GDPR Article 7(1) and PECR).
The other categories below rely on your consent (UK GDPR and EU GDPR Article 6(1)(a)).
Analytics (PostHog): Helps us understand how visitors interact with our pages. PostHog collects pseudonymous usage data, linked to a random identifier rather than your name, including pages visited, referral sources, browser type, and general geographic region. If you sign in to the Service, PostHog links this identifier to your user ID, so your earlier Marketing Site visits can be connected to your account (see Section 7.2). PostHog also captures unhandled JavaScript errors and unhandled promise rejections (error message, stack trace, source location) so we can identify and fix bugs; console errors and personal user input are not collected. PostHog data is processed in the European Union (eu.i.posthog.com). PostHog may set cookies for session identification. PostHog does not record sessions on the Marketing Site.
Analytics (Google Tag Manager and Google Analytics 4): Used to measure visits to the Marketing Site. Google Tag Manager and Google Analytics 4 load through a path on our own domain, and Cloudflare forwards these requests to Google. Before Google Tag Manager loads, we set Google Consent Mode v2 to denied for analytics and advertising storage and then apply your choice. Data is transmitted to Google domains including googletagmanager.com and google-analytics.com.
Analytics (Cloudflare Web Analytics): Cloudflare, which delivers our sites, measures page-load speed and counts page views. Its script sets no cookies and uses no browser storage, but it reads performance data from your browser, so it loads only after you enable Analytics (see the Cloudflare Web Analytics documentation).
Advertising (Google): Used to measure marketing performance and advertising effectiveness. With Advertising consent, Google Analytics 4 uses Google Signals, which enables cross-device tracking, demographics and interest reporting, and the creation of remarketing audiences for Google Ads, and advertising and conversion tags may run. Data is transmitted to Google domains including stats.g.doubleclick.net.

If you enable the Advertising category, Google may set cookies or browser-storage identifiers and process the data described above for their stated purposes. We do not sell your personal data. When you withdraw consent, we stop the tools of the withdrawn category, send the new choice to Google Consent Mode, delete the PostHog and Google cookies and browser storage that we can reach on our own domains, and then reload the page so that the tools' code no longer runs. Cookies that a provider sets on its own domain can only be deleted in your browser settings.

7.2 Service Application (app.kongmetrics.com)

The Service asks for your consent before any non-essential tracker runs, with the same categories and the same km_consent choice as the Marketing Site. Without consent it uses only strictly necessary cookies and storage: the sign-in session, sign-in and invitation handoffs, bot protection (Cloudflare Turnstile), your selected workspace, pending operations, Paddle checkout, and your consent choice. It also remembers a display theme on your device only when you choose Light or Dark in its Theme menu; choose System to delete it. The Cookie Policy states the conditions and the exception that we rely on for this item. With Analytics consent it loads PostHog product analytics, Google Analytics 4 through Google Tag Manager (loaded through our own domain, as described in Section 7.1), and Cloudflare Web Analytics. When you are signed in, PostHog links these analytics to your user ID, so your visits to the Marketing Site and the Service can be connected. With Advertising consent it allows advertising and conversion tags in Google Tag Manager. With Analytics and Session replay consent, PostHog records Service sessions with all text and inputs masked. You can change your choice from "Cookie preferences" in the account menu or on the sign-in page.

8. Children's Privacy

Our Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will take steps to delete it.

9. International Data Transfers

Core Service data is hosted on secure infrastructure in the European Union, and Marketing Site analytics sent to PostHog is processed in the EU. For AI features, the AI service providers listed in Section 3 process the data we send them in the United States. For these transfers we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) included in their data processing terms. When you enable Analytics or Advertising consent, Google and Cloudflare may process the disclosed data outside the UK and the EU, including in the United States, under their published privacy terms and applicable transfer safeguards. Where required, we rely on appropriate safeguards in accordance with GDPR requirements.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Controller: EGOS Technologies Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Company number: 17154724 (registered in England and Wales)
ICO registration number: ZC212827
Email: [email protected]
Website: kongmetrics.com