How it works Features Pricing For agencies
Compliance

Privacy Policy

Last updated: September 2026

1. Who We Are

Metric Unlocked is a product of Metric Labs Ltd, a company registered in England and Wales (Company No: 17148182, Registered address: 6 Atlas House, St Georges Square, Bolton, BL1 2HB). We are the data controller for information collected through this service.

We are registered with the Information Commissioner's Office (ICO) under registration reference ZC213107.

For privacy-related enquiries: privacy@metriclabs.uk

2. What Data We Collect

We collect the following categories of personal data:

  • Account data — your name, email address, and password (or Google OAuth token) when you register.
  • Google Ads data — campaign metrics, spend, click and conversion data accessed via the Google Ads API on your behalf.
  • Google Search Console data — search query performance, page rankings, impressions and click data accessed via the Search Console API on your behalf.
  • Meta data — Facebook Page and Instagram Business account metrics including post performance, audience insights, and engagement data accessed via the Meta Graph API on your behalf.
  • LinkedIn data — company page analytics, post performance, follower demographics, and engagement data accessed via the LinkedIn API on your behalf.
  • Usage data — pages visited, features used, and session duration, collected via cookies and server logs.
  • Billing data — handled directly by our payment processor. We do not store your card details.
  • Waitlist data — name and email address if you join our early access list.

3. Legal Basis for Processing (UK GDPR)

We process your data under the following lawful bases:

  • Contract performance — to provide the Metric Unlocked service you have signed up for.
  • Legitimate interests — to improve the platform, prevent fraud, and maintain security.
  • Consent — for marketing communications and non-essential cookies, where you have opted in.
  • Legal obligation — where we are required to retain data by law (e.g. financial records).

4. Google API Services

Metric Unlocked's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We access Google Ads and Search Console data to provide reporting features within the Metric Unlocked dashboard.
  • With your permission, we also send lead outcome signals back to Google Ads — for example, whether a lead you received converted into a customer, or was marked as unsuccessful. This is sent using Google's Data Manager API and is linked only to the Google Ads click identifier (gclid) associated with that lead. We do not send any personal information (such as names, phone numbers, or email addresses) as part of this process — only an anonymous click identifier and an outcome signal. This helps Google's advertising systems understand which ad clicks led to genuine business outcomes, so your advertising can be optimised more effectively.
  • This lead outcome feature is optional and must be separately enabled by you within the platform; it is not active by default.
  • We do not share your Google data with third parties for advertising purposes.
  • We do not use your Google data to serve you ads.
  • We do not allow humans to read your Google data unless you have given explicit permission, or it is required for security or legal compliance.

5. Meta API Services

Metric Unlocked's use of data received from Meta APIs (including Facebook and Instagram) adheres to the Meta Platform Terms and Meta Developer Policies. Specifically:

  • We only access Facebook Page and Instagram Business account data to provide social analytics features within the Metric Unlocked dashboard.
  • We access read-only metrics including post performance, reach, impressions, engagement, and audience demographic data on behalf of users who have explicitly authorised our application.
  • We do not post content, send messages, or take any action on your Meta accounts.
  • We do not share your Meta data with third parties for advertising or any other purposes.
  • We do not use your Meta data to serve you ads or for any purpose beyond displaying analytics within your Metric Unlocked dashboard.
  • We do not allow humans to read your Meta data unless you have given explicit permission, or it is required for security or legal compliance.
  • Meta data is cached for reporting purposes and deleted in accordance with our data retention policy in section 9.

You may revoke Metric Unlocked's access to your Meta accounts at any time via your Facebook Settings under Apps and Websites.

6. LinkedIn API Services

Metric Unlocked's use of data received from LinkedIn APIs adheres to the LinkedIn API Terms of Use. Specifically:

  • We only access LinkedIn Company Page analytics to provide social analytics features within the Metric Unlocked dashboard.
  • We access read-only metrics including post performance, follower demographics, engagement data, and audience insights on behalf of users who have explicitly authorised our application.
  • We do not post content or take any action on your LinkedIn accounts.
  • We do not share your LinkedIn data with third parties for advertising or any other purposes.
  • We do not use your LinkedIn data to serve you ads or for any purpose beyond displaying analytics within your Metric Unlocked dashboard.
  • We do not allow humans to read your LinkedIn data unless you have given explicit permission, or it is required for security or legal compliance.
  • LinkedIn data is cached for reporting purposes and deleted in accordance with our data retention policy in section 9.

You may revoke Metric Unlocked's access to your LinkedIn account at any time via your LinkedIn Settings under Permitted Services.

7. How We Share Your Data

We do not sell your personal data. We share data only with trusted third-party processors necessary to operate the service, including:

  • Brevo — transactional email delivery.
  • Payment processor — for billing and subscription management.
  • Cloud hosting provider — for server infrastructure.

All processors are contractually bound to handle your data in accordance with UK GDPR. Data received from Google, Meta, and LinkedIn APIs is never shared with any third-party processor beyond what is strictly necessary to operate the platform.

8. How We Protect Your Data

We apply the following measures to protect your personal data:

  • Encryption in transit — all connections to our platform are secured via HTTPS, with HTTP requests automatically redirected to HTTPS.
  • Encryption at rest — OAuth access tokens and refresh tokens (including those for Google, LinkedIn, and mailbox connectors) are encrypted at rest using industry-standard AES-256 encryption before being stored in our database.
  • Access control — access to your data is restricted based on role. Organisation owners, members, and agency users have different levels of access, and cross-tenant access attempts are automatically logged and blocked.
  • Two-factor authentication — administrative and organisation-owner accounts are protected by two-factor authentication (2FA).
  • Hosting and infrastructure — our application is hosted on a virtual private server located within the European Union (Netherlands).
  • Backups — our infrastructure is subject to automated backups. The encryption-at-rest controls and retention arrangements for those backups are governed by our hosting provider's applicable security documentation and contractual terms. Backups are retained for a limited period and are automatically deleted thereafter.
  • Data deletion — when an organisation's account is deleted, associated personal data — including connected account tokens, campaign data, and analytics data — is permanently deleted from our systems. Security audit logs may be retained in anonymised form for a limited period for security purposes.

9. Data Retention

We retain your personal data for as long as your account is active. If your account is inactive for 60 consecutive days, your connected platform data (including Google, Meta, and LinkedIn cached data) will be permanently deleted. You may request deletion of your account and all associated data at any time by emailing us.

Billing records are retained for 7 years as required by UK law.

10. Your Rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Object to or restrict certain processing
  • Data portability
  • Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at privacy@metriclabs.uk. We will respond within 30 days.

11. Complaints

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes to This Policy

We may update this policy from time to time. We will notify registered users of any material changes by email. Continued use of the service after changes constitutes acceptance.