Privacy summary for the ITK product

Who we are

ITK is run by ITK Reporting Ltd (company number 17065635), registered office 143 Longford Road, Neath, Wales, SA10 7HH. ITK Reporting Ltd is responsible for the personal data described on this page. For any privacy question or request, email jordan@itk-uk.com.

What data the product stores

ITK stores account details needed for authentication, tenant assignment, reporting, integrations, and billing reconciliation. This may include names, email addresses, agency and client records, integration metadata, report content, and subscription records.

Connected platform data

ITK connects to Meta (Facebook and Instagram Ads), Google, Shopify, and WooCommerce only when you choose to connect them. We store the access token each platform gives us, and the data we read with it, so we can build your reports.

From Meta we read, with read-only access: your ad account names, IDs, and currency; the names and IDs of your campaigns, ad sets, and ads; and daily impressions, clicks, spend, conversions, and conversion value. We use this only to show your results and write your reports in ITK. We never create, change, or pause ads, and we never read personal data about the people who see your ads.

How we share data

We do not sell, rent, or trade your data, including data obtained through connected Google or Meta integrations, to third parties. We share this data only with Anthropic, the provider of the Claude AI model, solely to generate the reports and insights you see within ITK. Anthropic does not use data sent through the API to train or improve its AI models. We do not share, transfer, or disclose Google user data for any purpose other than providing and improving the core functionality of the ITK platform.

How we protect data

Data in transit is encrypted using industry-standard TLS/SSL. Data at rest, including data from connected Google integrations, is stored using Supabase, which provides encryption at rest and row-level security to restrict access on a per-account basis. Access to this data within ITK is limited to the systems and processes required to deliver the service, and is protected by authentication and access controls.

Data retention and deletion

We retain data from connected integrations, including Google and Meta, for as long as your account remains active, in order to provide our reporting and analytics services. When you disconnect an integration we delete its access token and revoke our access at the platform, so we stop collecting anything further. You choose what happens to the data already collected: the disconnect screen offers to delete it, and if you do not ask us to, we keep it so your existing reports still work and so reconnecting carries on where you left off. You can delete it later at any time by disconnecting again and choosing to delete, or by contacting us. If your ITK account is deleted, all associated data, including Google user data, is deleted.

Core processors

The application currently depends on Supabase for authentication and database services, Stripe for paid billing flows, Resend for transactional email where enabled, and Anthropic's Claude for AI-generated report sections when configured.

Public promise on privacy

The public site does not make unsupported claims around certifications, sector-specific compliance, or bespoke data processing terms. If you need those assurances before rollout, handle that as part of the commercial onboarding process.