Privacy Policy

Two Spouts Analytics (“Kite”, “we”, “us”) is a web and advertising analytics service at analytics.hexgeta.com. This policy explains what we collect, why, who we share it with, and how to have it deleted. It covers three groups of people: account users, visitors to websites that use our tracker, and the ad and search accounts our users connect.

1. Account users

When you sign up or are invited to Kite we collect:

• Your name, email address and a password (stored hashed by our authentication provider).
• The sites, settings, goals, reports and notes you create in the app.
• Basic usage and error logs needed to run and secure the service.

We use this to provide the service, keep your account secure, and contact you about it.

2. Visitors to websites that use the Kite tracker

Our customers add a small script to their websites to measure traffic. For those visitors the tracker collects the page URL, referrer, browser and device type, screen size, country and city (derived from the request), and any events the website chooses to send (for example a form submission or a button click).

• No cookies. The tracker does not set cookies. It uses the browser’s session storage only for the current visit.
• IP addresses are not stored. An IP address is combined with the browser user agent and a site-specific salt into a one-way visitor identifier and then discarded. Where a site enables privacy mode, that salt rotates daily so visitors cannot be recognised across days.
• The website owner, not Kite, decides what is measured on their site and is responsible for telling their visitors. Questions about a specific website’s analytics should go to that website first.

3. Connected ad and search accounts

Users can connect Google Ads, Google Search Console, Meta (Facebook and Instagram) Ads, Microsoft Advertising and TikTok Ads. When you connect an account you authorise us, through that platform’s own sign-in, to read your campaign, ad, audience, conversion and search performance data and, where you use those features in Kite, to create or change campaigns, audiences and conversion settings on your behalf.

• Access tokens are stored encrypted and are only used for the accounts you connected.
• We use platform data only to show you reports, insights and recommendations and to carry out changes you ask for. We do not sell it, use it to advertise to anyone, or share it with other customers.
• Data received from Meta and Google APIs is handled in line with the Meta Platform Terms and the Google API Services User Data Policy, including its Limited Use requirements.
• You can disconnect an account at any time in Kite, or revoke access from the platform itself.

4. Service providers

We use these providers to run Kite. Each processes data only to provide its service to us:

• Vercel (hosting) and Supabase (database and authentication).
• ClickHouse (analytics event storage).
• Resend (transactional email).
• OpenAI and Anthropic (the AI-generated insights and recommendations in the app). Only the data needed for the specific request is sent, and it is not used to train their models under our agreements with them.

Some of these providers are located outside your country, including in the United States. We rely on their contractual and security commitments when data is transferred.

5. Retention

We keep account data for as long as your account is active. Analytics and ad performance data is kept while the site or connected account remains in Kite so historical reports keep working. When you delete a site, disconnect an account or close your account, the related data is deleted within 30 days, apart from backups, which roll off on their normal schedule, and anything we must keep by law.

6. Security

Data is encrypted in transit, platform tokens are encrypted at rest, and access to each site’s data is restricted to the members of that site’s organisation. No system is perfectly secure, but we work to protect your data and will tell affected users about any breach as required by law.

7. Your rights and data deletion

You can ask to access, correct, export or delete your personal data, or object to how we use it. To delete data:

• Connected accounts (including Facebook / Meta): disconnect the account in Kite under the site’s Ads or Integrations settings, or remove the “Kite Analytics” app in your Facebook settings under Apps and Websites. Then email us to have the data already imported from that account deleted.
• Your Kite account: email us from the address on the account and we will delete it and its data.
• Website visitors: because we do not store IP addresses or set cookies, we usually cannot link analytics data to a specific person. Contact the website owner, or email us with the site and details and we will help where we can.

Email michael@twospouts.com with “Data deletion” in the subject. We confirm deletion requests within 30 days. You may also complain to your local data protection authority.

8. Children

Kite is a business tool and is not directed at children under 16.

9. Changes

We may update this policy. Material changes will be announced in the app or by email, and the date at the top will change.

10. Contact

Questions about privacy: michael@twospouts.com.