Privacy Policy

Kong Metrics ("we," "us," or "our") operates the website kongmetrics.com (the "Marketing Site") and the application at app.kongmetrics.com (the "Service"). This Privacy Policy describes how we collect, use, and share information when you use our Marketing Site and Service.

By using our Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials via Google OAuth. We do not store your Google password. We only request the minimum OAuth scopes required to access your Google Search Console data.

1.2 Google Search Console Data

When you connect a Google Search Console property, we access and store search analytics data including queries, pages, clicks, impressions, click-through rates, and average positions. This data is used solely to provide you with analytics, insights, and recommendations within the Service.

1.3 Payment Information

Payment processing is handled by Paddle, our Merchant of Record. We do not store your credit card number or payment details directly. Paddle processes your payment and provides us with transaction identifiers, subscription status, and billing history. Please review Paddle's Privacy Policy for details on their data handling practices.

1.4 Usage Data

We may collect information about how you interact with the Service, including pages visited, features used, and actions taken. This helps us improve the product and user experience.

1.5 Marketing Site

The Marketing Site (kongmetrics.com) uses optional analytics and marketing technologies only after you enable the relevant category through our cookie consent banner. PostHog is controlled by the Analytics category. Google Tag Manager and Google Analytics 4, Microsoft Clarity, and Apollo Website Visitor Tracking are controlled by the Marketing category. Before you grant consent, no optional tracking scripts are loaded and no analytics or marketing data is collected. See Section 7 for details and instructions for changing your preferences.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate analytics dashboards, insights, and recommendations
• Process payments and manage your subscription
• Send transactional emails (account confirmations, billing receipts, security alerts)
• Respond to support requests
• Detect, prevent, and address technical issues or abuse
• Understand Marketing Site usage and diagnose errors when Analytics consent is enabled
• Measure advertising, understand session behavior, and identify company-level interest when Marketing consent is enabled

We do not sell your personal data. We do not use your Google Search Console or Analytics data for advertising purposes.

3. Data Sharing and Third Parties

We share your information only in the following circumstances:

• Paddle: Payment processing, invoicing, and tax compliance
• Infrastructure providers: Cloud hosting and data storage (EU-based)
• PostHog: Consent-based product analytics and error diagnostics for the Marketing Site
• Google: Consent-based tag management, audience measurement, advertising reporting, and remarketing through Google Analytics 4
• Microsoft Clarity: Consent-based heatmaps, session replay, and interaction analytics
• Apollo: Consent-based company-level website visitor identification and marketing attribution
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice

We do not share your search analytics data with any third party for their own purposes.

4. Data Retention

We retain your search analytics data according to your plan's data retention limit (16 months to 5 years). Account information is retained for as long as your account is active.

If you change plans, access to historical data and paid workflows follows the limits of the plan on your account after the change takes effect. If you delete your account, we will handle personal data and analytics data according to our retention practices and applicable legal obligations.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit using TLS 1.3
• Encryption at rest for stored data
• OAuth tokens with minimal required scopes (no password storage)
• Regular security audits and vulnerability assessments
• Role-based access controls for internal systems

While we strive to protect your data, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us immediately at security@kongmetrics.com.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

6.1 GDPR (European Economic Area)

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request restriction of processing
• Objection: Object to processing based on legitimate interests

6.2 KVKK (Turkey)

If you are a resident of Turkey, you have rights under the Personal Data Protection Law (KVKK, Law No. 6698), including the right to learn whether your data is processed, request information about processing, learn the purpose of processing, know third parties to whom your data is transferred, request correction of incomplete or inaccurate data, request deletion or destruction, and object to automated processing outcomes.

6.3 CCPA (California)

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at privacy@kongmetrics.com. We will respond within 30 days.

7. Cookies and Tracking

7.1 Marketing Site (kongmetrics.com)

The Marketing Site uses a cookie consent banner that allows you to control which optional tracking technologies are active. No Analytics or Marketing scripts are loaded until you enable the corresponding category. You can change or withdraw your consent at any time by clicking "Cookie Preferences" in the site footer.

We use the following categories of cookies and tracking technologies:

• Essential: Required for basic site functionality. These cannot be disabled.
• Analytics (PostHog): Helps us understand how visitors interact with our pages. PostHog collects anonymized usage data including pages visited, referral sources, browser type, and general geographic region. PostHog also captures unhandled JavaScript errors and unhandled promise rejections (error message, stack trace, source location) so we can identify and fix bugs; console errors and personal user input are not collected. PostHog data is processed in the European Union (eu.i.posthog.com). PostHog may set cookies for session identification.
• Marketing (Google Tag Manager and Google Analytics 4): Used to measure marketing performance and advertising effectiveness. When this category is enabled, Google Tag Manager loads Google Analytics 4 with Google Signals active. This enables cross-device tracking, demographics and interest reporting, and the creation of remarketing audiences for Google Ads. Data is transmitted to Google domains including googletagmanager.com, google-analytics.com, and stats.g.doubleclick.net. You can disable this at any time by declining the Marketing category in the cookie banner.
• Marketing (Microsoft Clarity): Used to understand how pages render and how visitors interact through clicks, scrolling, heatmaps, and session replay. Clarity may use cookies and similar identifiers after Marketing consent is granted. We send Clarity's current Consent V2 signal before it loads. Microsoft processes this data according to the Microsoft Privacy Statement.
• Marketing (Apollo Website Visitor Tracking): Used to identify company-level interest in Kong Metrics. Apollo receives an anonymous visitor identifier, page URL, referrer, UTM campaign parameters, and network information used to derive the visiting company. Contact-level identity resolution is not enabled. Apollo stores its anonymous identifier and queued events in browser storage only after Marketing consent. Apollo processes this data according to the Apollo Privacy Policy.

If you enable the Marketing category, Google, Microsoft Clarity, and Apollo may set cookies or browser-storage identifiers and process the data described above for their stated purposes. We do not sell your personal data. Your consent preferences are stored locally in your browser. When you withdraw Marketing consent, we reset Clarity consent, clear known Apollo browser-storage values, and reload the page so those trackers are no longer present in the document.

7.2 Service Application (app.kongmetrics.com)

The Service application uses essential session cookies required for authentication and functionality. We do not use advertising or third-party tracking cookies in the application.

8. Children's Privacy

Our Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will take steps to delete it.

9. International Data Transfers

Core Service data is hosted on secure infrastructure in the European Union, and Marketing Site analytics sent to PostHog is processed in the EU. When you enable Marketing consent, Google, Microsoft, and Apollo may process the disclosed Marketing Site data outside the EU, including in the United States, under their published privacy terms and applicable transfer safeguards. Where required, we rely on appropriate safeguards in accordance with GDPR requirements.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

• Email: privacy@kongmetrics.com
• Website: kongmetrics.com