Privacy Policy
This policy explains how the Digital Footprints Reporting platform (“the platform”) collects, uses, stores, shares and deletes information. It covers the platform at reports.digital-footprints.co.uk and the separate hosted copies we run for other agencies on digital-footprints.co.uk subdomains. Our main website has its own privacy policy.
1. Who we are
Digital Footprints is a trading name of Tamacre Limited, a company registered in Scotland (company number SC373186), 6th Floor, 19 Waterloo Street, Glasgow, G2 6AY. We build and run the platform.
Agencies use the platform to make marketing performance reports for their clients. When an agency runs its own hosted copy, that agency decides which clients and accounts to add, and it is responsible for its clients' data. We host and process that data on the agency's behalf.
Questions or requests: hello@digital-footprints.co.uk.
2. What the platform does
The platform pulls marketing numbers from the services an agency connects: website analytics, search performance, social media pages, backlinks, news coverage and CRM leads. It turns them into monthly branded reports, which the agency reviews and then shares with its client by link or through a client portal.
3. Information we collect
Account and sign-in information
- Agency users: the username and a hashed password (we never store the password itself).
- Client portal users: the name and email address the agency invites, plus when that person last signed in.
- A session cookie that keeps you signed in. It is strictly necessary for the platform to work. We do not use advertising or analytics cookies on the platform.
Information from accounts you connect
The platform only reads data. It never posts, edits or deletes anything in a connected account.
| Service | Access we ask for | What we read |
|---|---|---|
| Google (sign in with Google) | Your Google email address; read-only Google Analytics (analytics.readonly); read-only Search Console (webmasters.readonly) |
The list of Analytics properties and Search Console sites you can access, so you can choose one for each client. Then, for those chosen properties and sites only: aggregated traffic figures (such as sessions, users, channels and top pages) and search figures (such as clicks, impressions, average position and top search queries). |
| Facebook and Instagram (Facebook Login) | pages_show_list, pages_read_engagement, read_insights, instagram_basic, instagram_manage_insights |
Your name and Facebook user ID, the Pages you choose to share and their linked Instagram business accounts. For those Pages and accounts: follower counts, reach, engagement and post-level performance. |
| HubSpot (private app token) | Read contacts (crm.objects.contacts.read) |
How many new contacts were created in the report period, grouped by traffic source. We store counts only, not the contacts themselves. |
| Ahrefs (API key) | Read access to the agency's own Ahrefs account | Backlink, keyword and competitor figures for each client's website. |
We store the access tokens and keys these services give us, so reports can refresh each month without you signing in again.
Information you upload or type in
This covers client names, websites, brand colours and logos, exports you upload (for example LinkedIn or Analytics CSV files), and the commentary you write or approve for a report.
Report activity
When a report is opened, we record that it was viewed, when, and how (by share link or portal). For a portal sign-in, we also record which email viewed it. This lets the agency see whether its client has read the report.
4. How we use information
- To build, show and share the reports the agency asks for.
- To fill the dropdowns that let you pick the right Analytics property, Search Console site, Page or Ahrefs project for each client.
- To draft report commentary (see section 6).
- To keep the platform secure, fix problems and support you.
We do not sell data, use it for advertising, or build profiles of individuals. Connected-account data is used only to give the agency the reports it asked for.
5. Google user data
The platform's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google Analytics and Search Console data only to build the reports the agency asks for. We do not use it for anything else.
- We do not sell Google user data. We do not use or transfer it for advertising, retargeting, credit checks or lending.
- We do not use Google user data to train or improve general-purpose AI or machine-learning models, ours or anyone else's.
- We share Google user data only as needed to provide the reports, as described in section 6, or when the law requires it.
- Our staff do not read Google user data unless you ask us to help with something, we need to for security, or the law requires it. The figures appear inside reports that the agency itself creates and shares.
6. Who we share information with
We use a small number of service providers to run the platform. Each one gets only what it needs.
- Our AI writing provider helps the platform draft report commentary from the period's figures and coverage. Its terms do not allow it to train its models on what we send.
- Serper runs Google News searches for client brand names, to find press coverage.
- Our hosting provider runs the server where the platform, its database and the reports are stored.
- Google, Meta, HubSpot and Ahrefs receive our requests for the data you asked us to read, using the access you gave.
Reports themselves are shared only by the agency: through a share link it creates, or through a portal invite it sends. Anyone who has a share link can open that report.
We may disclose information if the law requires it, or to protect the rights, safety or property of our users or ourselves. Some of these providers are based outside the UK, for example in the US. Where data leaves the UK, we rely on the safeguards UK data protection law allows, such as the UK International Data Transfer Addendum or the UK–US data bridge.
7. How we keep information safe
- Access tokens and keys are stored only on our server and are never put in reports or share links. The platform is served over HTTPS only.
- Passwords for client systems kept in the agency vault are encrypted with a key held outside the database.
- Only signed-in agency admins can manage connections. Portal users see only their own company's reports.
- Each hosted copy has its own separate database, files and settings.
8. How long we keep information
- Access tokens: until you disconnect the account or the agency's account is closed.
- Reports and the figures behind them: while the agency's account is active, so it can compare month on month. The agency can delete a client, and that client's reports, at any time.
- Portal users: until the agency removes them.
- When an agency's account closes, we delete its copy's data within 30 days, unless the law requires us to keep it.
9. Disconnecting and deleting your data
You can remove our access and delete your data at any time.
Disconnect from inside the platform
Sign in, go to API keys in the side menu, and choose Disconnect next to Google or Facebook. We revoke the token with Google or Facebook straight away and delete it from our database.
Remove access from Google or Facebook
- Google: visit myaccount.google.com/connections and remove “Digital Footprints Reporting”.
- Facebook: go to Settings & privacy → Settings → Business integrations, then remove the app. This stops our access straight away. To have us delete what we already stored, email us as described below.
Ask us to delete everything
Email hello@digital-footprints.co.uk with the subject “Data deletion request”. Tell us the email address or account you connected, and which platform address you used. We will confirm, then delete the stored tokens and all data we collected through that connection within 30 days, and tell you when it's done.
10. Your rights
Under UK data protection law, you can ask to see, correct, delete or move your personal data. You can also object to or limit how we use it. If you are a client of an agency that uses the platform, it is usually quickest to ask that agency first. You can also contact us directly. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.
11. Legal basis
We process data to perform our contract with the agency, on the agency's instructions about its own clients, and for our legitimate interest in running a secure, reliable service. Connecting a Google, Facebook, HubSpot or Ahrefs account is always your choice, and you can undo it at any time.
12. Children
The platform is a business tool. It is not meant for anyone under 18.
13. Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how we use connected-account data, we'll tell the agencies using the platform before it takes effect.