Privacy Policy

Metrikia is a platform operated by Quantia Limited, a company incorporated in Ireland (company number 819716), registered office Pod 2, The Old Station House, Blackrock, Dublin, Ireland, A94T8P8 ("we", "our", "Metrikia"). This privacy policy explains how we collect, use, and protect your personal data.

We collect the following data:

• Identification data: first name, last name, email, company (names encrypted at rest)
• Connection data: IP address, login logs
• Usage data: interactions with the service
• Advertising data: campaign metrics (via your API connections)
• CRM data: leads, deals, appointments and tasks you manage
• Lead communications: messages and replies exchanged with your leads (encrypted at rest)

Your data is used to:

• Provide and improve our services
• Calculate your performance metrics (CPL, CPA, ROAS)
• Send you service-related communications
• Ensure platform security
• Comply with our legal obligations

Data received from Google

When you connect a Google account to Metrikia, Metrikia receives data through Google APIs, only for the features you use:

• Sign in with Google: your name, email address and Google account identifier, to create your Metrikia account and sign you in.
• Google Ads: the ad accounts you can access, your campaigns, ad groups and ads with their performance figures (spend, impressions, clicks, conversions), the data that links a Google click to its campaign and ad, and the leads submitted through your Google Ads lead forms. Metrikia uses them to show your campaign results, to attribute your leads and sales to the ads that brought them, and to add those leads to your CRM.
• Google Calendar: the list of your calendars, so that you choose the one Metrikia uses, and the events Metrikia creates, updates or cancels in it for the appointments booked in Metrikia (date and time, attendees, the lead's contact details and notes, a meeting link). Metrikia keeps the identifier and the meeting link of each event it creates, and the email address of the connected Google account.
• Google Ads conversion feedback: when you turn it on for a Google Ads source, Metrikia sends the conversions of your leads and sales (time, value, the Google click identifier and the email address hashed with SHA-256) to your Google Ads account through the Google Data Manager API, with the access you granted.

This data is stored with the rest of your account data in the European Union, and the access tokens Google issues for your integrations are encrypted at rest. Metrikia does not sell it. It is shared only with the sub-processors listed in section 4 that run these features, including Diana, the AI assistant described in section 5, when you use it; leads, including those from your Google Ads lead forms, are also sent to the ad platforms for which you turn on conversion feedback. Disconnecting a Google integration deletes its access tokens from Metrikia; to remove Metrikia's access at Google, use the security settings of your Google account.

Metrikia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We never sell your data. We may share data with:

• Technical subcontractors: hosting of the application and databases (Railway, Amsterdam, EU, under a data processing agreement with Standard Contractual Clauses), error monitoring (Sentry, EU data region), transactional email (Resend, United States), AI assistant (Anthropic, United States, under Standard Contractual Clauses), semantic search for the help assistant (OpenAI, United States), payment (Stripe) and tag management on our website (Google Tag Manager). The sub-processors of the data your organization manages in Metrikia are listed, with their role and location, on our Trust page.
• Ad platforms (with consent): Meta (Pixel, conversion data), Google (Analytics, Ads, conversion data), TikTok (Pixel, conversion data). This data is shared only if you accept marketing cookies and is used to measure the effectiveness of our acquisition campaigns.
• Authorities: if required by law

Metrikia uses artificial intelligence to provide analysis and assistance features. In accordance with EU Regulation 2024/1689 (EU AI Act, Article 50) and the GDPR, we inform you of how they work.

5.1 Diana Insights (dashboard analysis)

• How it works: Diana analyzes your aggregated KPIs (spend, leads, ROAS, CPL) to generate 3 to 5 actionable insights on your dashboards
• Data processed: only aggregated metrics from your campaigns. No personally identifiable information (PII) is sent to the AI provider
• Retention: insight requests are not stored server-side. Insights are generated in real-time and not persisted
• Disable: you can disable Diana Insights at any time in Settings > Integrations
• AI classification: limited risk system under Article 50 of EU Regulation 2024/1689

5.2 Diana Support (chatbot)

• How it works: support chatbot that answers your questions from a knowledge base. It does not access your advertising or CRM data
• Data processed: your text messages and conversation history. Stored in database (isolated per organization)
• GDPR rights: the rights of access, rectification and erasure apply to support chat data

5.3 AI subcontractor providers

• Anthropic (Claude): text generation for Diana, including answers about your CRM and analytics data (which may include a lead's first and last name, status, source and notes), lead score explanations, import column mapping on anonymized samples, and ad creative analysis. Your data is not used to train its models.
• OpenAI (embeddings): semantic search in the knowledge base. Data is not used for training (OpenAI API policy)
• International transfers: these providers are based in the United States. Transfers to Anthropic are covered by the Standard Contractual Clauses of its data processing agreement.

All AI-generated content is clearly identified with a visual indicator in the interface.

Your data is protected by:

• Encryption at rest by the application (authenticated encryption, 256-bit key) of sensitive data: credentials of your connected tools, lead contact details (name, email, phone), messages exchanged with your leads, and the email, name and two-factor secret of user accounts
• HTTPS only in transit: TLS 1.2 or higher, TLS 1.3 whenever the client supports it, HSTS
• Hosting in the European Union (Railway Amsterdam)
• Application secrets stored in an encrypted vault, never in plain text in code or configuration
• Data isolation per organization (multi-tenant)
• Restricted access to authorized employees
• Regular security audits

Under the GDPR, you have the following rights:

• Access (Art. 15): obtain a copy of your data in JSON format
• Rectification (Art. 16): correct your data from your profile
• Erasure (Art. 17): request the anonymization of your personal data. Your data is anonymized (not deleted) to preserve the integrity of your organization's business data
• Portability (Art. 20): export all your data (profile, leads, interactions, appointments, deals, notifications) in JSON format
• Opposition (Art. 21): object to the processing of your data

Organization owners must transfer ownership before requesting account deletion.

To exercise these rights, contact us at: privacy@metrikia.io

Your account data is kept as long as your account exists and is anonymized when the account is deleted. The data your organization manages in Metrikia follows fixed periods, applied automatically: a lead that has not been modified for three years is erased; messages exchanged with your leads are deleted two years after they are created; the IP address and browser user agent recorded with a visit are erased after thirteen months; Diana conversations are deleted twelve months after they start. At the end of the contract, your organization's data is deleted or returned on request; otherwise the periods above apply. Billing records are kept for the period required by accounting law. Login activity is recorded in our hosting provider's logs, which are kept for 30 days. Metrikia also keeps a history of your organization's activity (sign-ins, integrations connected or disconnected, two-factor authentication turned on or off, with the name of the member who acted), which is deleted after 365 days.

Whether you delete your account yourself or an administrator of your organization removes you, your personal data (name, email, preferences) is anonymized, your name is removed from your organization's activity history and your sessions are revoked. If you delete your own account, your connections are deactivated and the leads you own are erased: their contact details and notes are cleared, their interaction messages are replaced with a "[DELETED]" marker, and the erased records are permanently deleted 365 days later. Notes on your appointments and deals are deleted. If an administrator removes you, your connections are transferred to the owner of your organization, the lead interactions you recorded are deleted and your leads stay with your organization. In both cases, your organization's other business data (campaigns, deals) is kept.

Metrikia Companion is a Chrome extension that allows you to capture contact information from LinkedIn and Instagram into your Metrikia CRM account.

9.1 Data collected by the extension

• Profile names (first name, last name) from LinkedIn and Instagram
• Profile URLs on LinkedIn and Instagram
• Job titles (LinkedIn only, if available)

This data is collected only when you click the "Capture" button. The extension never collects data automatically or in the background.

9.2 Data not collected

• Browsing history
• Passwords or credentials
• Personal message content
• Photos, media or financial information
• Data from other websites

9.3 Local storage

• API Key: stored locally via chrome.storage.local (never synchronized)
• Settings: language and preferences via chrome.storage.sync
• Lead cache: captured profile URLs, expires after 7 days
• Offline queue: failed captures stored temporarily for automatic retry

9.4 Data transmission

Captured data is sent exclusively to the Metrikia API (api.metrikia.io) via HTTPS with TLS encryption. No data is sent to third parties. No analytics, tracking or advertising network is used.

9.5 Extension permissions

• storage: local storage of API key, settings and cache
• alarms: automatic retry of failed captures
• linkedin.com / instagram.com: reading profile information on Capture click
• api.metrikia.io: sending leads to your CRM account

9.6 User control

• Disconnect the API key at any time from the extension settings
• Individually disable LinkedIn or Instagram capture
• Uninstalling the extension deletes all locally stored data

For any questions regarding this policy: