Privacy policy

This website and the Klyqq service are operated by Digipeak Media. Borgarvägen 16 82453 Hudiksvall Sweden

For any question about personal data, write to legal@digipeak.se.

Klyqq handles personal data in two distinct capacities, and the rules differ between them:

• As controller, for the people who hold a Klyqq account and for visitors to this marketing website.
• As processor, for the visitor data our customers collect through Klyqq about their own websites and advertising. That data belongs to the customer; they decide what is collected and why, and we process it on their instructions.

The public pages require no account. Whether analytics is on before you choose depends on where you are. In the EU, the EEA, the UK and Switzerland nothing is loaded until you accept. Everywhere else analytics is on by default and you can turn it off. To tell the two apart we look up the country of your IP address on our own server, from an offline database, and read your device's time zone in your browser; if either points to Europe, we ask first. Neither result is stored — they are worked out on each visit. A Global Privacy Control signal from your browser is treated as a decline, wherever you are.

When analytics is on, the tags configured for this site — which may include Google Analytics, Google Tag Manager or the Meta pixel — are loaded and will record your visit according to those providers' own terms. Declining loads none of them, deletes the cookies they set, and the site works exactly the same. You can see and change your setting at any time with the round cookie button in the bottom-left corner or "Cookie settings" in the footer. The cookie policy describes this in detail.

Our web server keeps ordinary request logs. If you write to us, by email or through the contact form, we keep that correspondence so we can answer it. The contact form sends your name, email address, company and message to our support mailbox as an email; the website itself stores none of it. To keep bots out, the form is checked by Cloudflare Turnstile, which looks at your IP address and technical details of your browser to tell a person from a bot. It is loaded only on the contact page, under Cloudflare's own privacy terms, and it is not used for advertising or tracking.

Holding an account means we store your email address, a hashed password (never the password itself), and the settings and configuration you create — projects, links, tracking rules, ad-platform connections and cost entries. We process this to provide the service you asked for, and we keep it for as long as the account exists.

Where you connect a Google or Microsoft advertising account, the access credentials for that connection are stored encrypted and used only to import your spend and to upload your conversions. Disconnecting removes them.

Subscriptions are paid through Stripe. You enter your card on Stripe's own payment page, so card details go straight to Stripe and never reach Klyqq. Stripe holds what billing needs: your name and billing address, your VAT number if you give one, the payment method, and the invoices and receipts.

Klyqq itself keeps only a reference to your Stripe customer record, which plan you are on, its status and renewal date, and the result of Stripe's check of your VAT number. We use these to give your account the access it has paid for, and to put right an invoice whose VAT number could not be verified.

Closing your account cancels the subscription and deletes what Klyqq keeps. Invoices and payment records are an exception: Swedish bookkeeping law requires them to be kept for seven years, so they stay with Stripe and in our accounts for that time.

When you connect Google Ads, you grant Klyqq access through Google's own sign-in, and you can see exactly which permissions are asked for before you agree. Klyqq uses that access for three things only: to list the advertising accounts and conversion actions you can choose from, to import your advertising spend, and to send the conversions you have enabled to the account you chose. It does not read anything else in your Google account.

Data received from Google is used only to provide those features to you. It is not sold, not used for advertising, not used to train any AI or machine-learning model, and not shared with anyone except as needed to provide the feature, to comply with the law, or with your agreement. Klyqq's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We treat data received from Google as sensitive data, and the access to your advertising account as the most sensitive of all. It is protected by the measures described under "How we protect data" below. It is sent only over encrypted connections (TLS) and stored in an encrypted database. The credentials that give access to your Google Ads account are encrypted again by Klyqq with AES-256-GCM before they are stored, with the key held apart from the database. Each account's data is separated from every other account's, and access to the production systems is limited to the operator.

You can withdraw the access at any time by disconnecting the account in Klyqq, which deletes the stored credentials, or from your Google account's security settings.

When a customer installs Klyqq on their own website or uses a Klyqq tracking link, the following is recorded about each visit: a randomly generated visitor identifier, the IP address, the country derived from it, the browser's user-agent string, the page address and referring address, the campaign tags in the link, any advertising click identifiers the ad platform appended, and the actions, engagements, sales or refunds the customer chooses to report — including the amount and currency of a sale.

The country is resolved from the IP address using a database held on our own servers, so the address is not sent to a third party for that lookup. The visitor identifier is stored in the visitor's browser and identifies a browser, not a person by name: Klyqq does not collect names, email addresses, phone numbers or payment details from tracked visitors.

For this data the customer is the controller. Their own privacy notice, on their own site, governs why it is collected and on what legal basis, and requests about it are answered by them. We will help them do so.

• Google and Microsoft — when a customer enables conversion upload, the advertising click identifier, the time of the conversion and its value are sent to the advertising account the customer connected, so their bidding can learn from real outcomes.
• Endpoints the customer configures — outgoing webhooks send conversion data to an address the customer chooses. What arrives there is governed by whoever operates it.
• The providers who run the service for us, each processing data only on our instructions and under a written data processing agreement: Replit (application hosting, EU region), Neon (the database, Frankfurt) and SiteGround (the mail that sends invitations, password resets and alerts, and our mailboxes, including messages from the contact form).
• Stripe — payment, invoicing and VAT for Klyqq subscriptions. Stripe processes billing data for us, and for its own fraud prevention and legal duties as a controller under its own privacy policy. It receives nothing from the tracking service.

We do not sell personal data, and we do not use one customer's tracked data for any purpose other than serving that customer.

Klyqq is hosted in the European Union. The application runs in Replit's European region, and the database is with Neon in Frankfurt, Germany, so the tracking events, accounts and configuration are both stored and processed inside the EU.

Replit and Neon are United States companies. Their staff or systems may in exceptional cases reach the data from outside the EU, for example to keep the service running or to answer a support request. That possibility is covered by the Standard Contractual Clauses adopted by the European Commission, which form part of our agreements with them.

Billing data is handled by Stripe's European company in Ireland and may be transferred to Stripe in the United States. Stripe covers that transfer through its certification under the EU–US Data Privacy Framework and the Standard Contractual Clauses.

Uploading conversions to Google or Microsoft transfers the advertising identifiers, the time and the value of a conversion to those companies, who process data outside the EU under their own safeguards. A customer who does not want that transfer can leave conversion upload switched off; everything else in the product continues to work.

The measures below apply to everything we hold, and most strictly to the data that would do the most harm if it leaked: access to advertising accounts, passwords and tracked visitors' IP addresses.

• Encryption in transit. All traffic between your browser and Klyqq, and between Klyqq and Google or Microsoft, is sent over HTTPS (TLS). The production database only accepts encrypted connections.
• Encryption at rest. The database provider encrypts the stored data and its backups. On top of that, the credentials that give access to a connected Google or Microsoft advertising account are encrypted by Klyqq itself, with AES-256-GCM, before they are written to the database, so a copy of the database alone is not enough to use them. The encryption key is kept apart from the database, in the hosting platform's secret store. Without that key Klyqq refuses to store such credentials at all, rather than store them unprotected.
• Passwords are stored only as a salted bcrypt hash. Nobody, including us, can read a password back.
• Access control. Every account's data is separated by the server on every request, so one customer can never see another's. Repeated failed sign-ins are slowed down and blocked. Access to the production systems is limited to the operator. We do not look at a customer's data except to answer a support request they made, to investigate a security problem, or where the law requires it.
• Secrets such as keys and passwords for the services we use are kept in the hosting platform's secret store, never in the code.
• Keeping less. Tracked visitors' IP addresses and user-agent strings are erased after 90 days, error reports stay on our own server, and deleted data is gone from backups within seven days, as described below.

If a breach affecting personal data occurs, we will notify the affected customers and, where the GDPR requires it, the supervisory authority without undue delay.

Deleting something removes it from the service immediately. It can still exist for a short while in the database's point-in-time restore history — a rolling window of seven days, kept so that a failure or a mistake can be undone. We do not read that history for any other purpose, and once the window passes the data is gone from it too. Deletion is therefore immediate in the product and complete within seven days.

Tracking events are retained while the customer's account is active, because attribution reporting is inherently historical — a sale is compared against a click that may be months old. A customer can delete individual events, all events from an IP address, or an entire project at any time, and deletion is immediate and permanent. Closing an account removes its data.

The two most identifying fields do not last that long. IP addresses and user-agent strings are erased from tracking events after 90 days, automatically and permanently, while the rest of the event — the campaign tags, the country already derived from the address, the sale — is kept for reporting. Attribution needs the history; it does not need to keep knowing which address the visit came from, so it stops.

For the data we hold as controller, the legal grounds under Article 6 of the GDPR are:

• Performance of a contract — account data, and everything needed to deliver the service to the person who signed up for it, including taking payment for it.
• Legal obligation — keeping invoices and payment records for as long as bookkeeping law requires.
• Legitimate interests — ordinary server request logs, and the error reports described below, in order to keep the service secure, available and working. We keep these to the minimum that serves that purpose.
• Consent — the analytics and marketing tags on this public website for visitors in the EU, the EEA, the UK and Switzerland, which load only if you accept them and which you can withdraw at any time from the cookie settings. Withdrawing is as easy as giving it, and the site works the same either way. For visitors elsewhere the same tags run by default under our legitimate interest in understanding how the site is used, and you can object to it at any time in the same place.

For data processed on a customer's behalf through the tracking service, the legal basis is the customer's to determine and to state in their own privacy notice. We process it on their documented instructions under a data processing agreement.

When something goes wrong — in our servers or in your browser while using the app — an error report is recorded so we can find and fix it. It contains the technical detail of the failure: the error, where in the code it happened, and the page or background task that was running. It is not used to build a profile of anyone and is not used for analytics.

These reports go to error-tracking software that Digipeak Media runs on its own server. No third-party monitoring provider receives them, so nothing about the failure leaves our own infrastructure.

Under the GDPR you may request access to your personal data, correction of it, deletion, restriction of processing, portability, and you may object to processing. You may also complain to a supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY).

If your data reached Klyqq because you visited a website that uses it, address your request to that website's operator; they hold the relationship and decide what is collected. If you cannot identify them, write to us and we will help.

If this policy changes materially we will update the date at the top. Where the change affects what the cookie banner covers, we will ask for your choice again rather than assume the previous answer still applies.