Privacy Policy

• Legal entity: Splitlight Ltd
• Companies House registration: 16318475
• Registered office: Silverstream House, 45 Fitzroy Street, London W1T 6EB, United Kingdom
• ICO registration: Splitlight Ltd is registered with the UK Information Commissioner’s Office as a data controller; our registration reference is available on request.
• Privacy contact: privacy@splitlight.co.uk

Website visitors: IP address (briefly, for security/rate-limiting), browser/OS/referrer and pages viewed (analytics), and anything you submit via our contact or demo-request forms (name, email, company, message).

Lens agency users: your name, work email, and authentication metadata (managed by our auth provider Clerk); product usage telemetry used to operate and improve Lens; and billing identifiers (we store a Stripe customer ID only — never card numbers).

Splitlight CMS users: basic identity and contact details, authentication identifiers, roles, account preferences, and access-management records, as explained in the CMS section below.

Data you connect to Lens: when an agency user connects a client’s advertising or analytics account, we receive an OAuth refresh token, an external account/channel identifier, a display name, and aggregated daily reporting metrics for that account. We do not collect individual end-user, click-level, or audience-segment data.

This section covers people signing in to Splitlight CMS to manage a website, including installations hosted on a client’s domain. CMS sign-in is separate from the advertising and analytics connections available in Lens.

What Google shares and why

If you choose Google sign-in, Google provides your Google account identifier, name, email address, and profile picture, where available, to our authentication provider, Clerk. We use these details to authenticate you, link you to your CMS account, display your identity, and let authorised administrators manage your access. We do not receive your Google password.

This sign-in connection requests only basic identity permissions (OpenID, email, and profile). It does not request access to Gmail, Google Drive, Google Analytics, Google Ads, or other Google reporting services, and it cannot read your emails or files. Signing in to the CMS does not connect a Lens data source.

Storage and access

Clerk manages the authentication account and sessions. The CMS stores a linked authentication identifier, your name, email, profile-picture URL, role, and preferences in Convex. It also records your last CMS access and account-management information, such as invitation status, access expiry, removal or restoration dates, and the administrator responsible. Content and revision records may identify the person who created or changed them.

Authorised administrators of the client’s installation can view user and access information to manage their team. Splitlight personnel may access it when needed to operate, support, or secure the service. Clerk, Convex, and Vercel process the information needed to provide authentication, storage, and hosting; configured backup providers may hold recovery copies. The providers and international transfers are described below.

We do not sell Google sign-in data, use it for advertising, or use it to train AI or machine-learning models. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including applicable Limited Use requirements.

Who is responsible

For a client-operated CMS installation, the client decides who can use its CMS, their roles, and why their information is needed. The client is normally the data controller for those user records; Splitlight processes them on the client’s instructions to provide and support the CMS. The client’s privacy notice explains its lawful basis and any additional processing. Splitlight is the controller for its own business contact, contract, billing, and support records.

You can remove the Google connection through your Google Account settings. This prevents future use of that connection but does not itself delete an existing CMS profile, Clerk account, or retained records. To request access, correction, or deletion, contact the client’s CMS administrator or privacy@splitlight.co.uk. We work with the relevant client to handle the request. The retention section below explains archived accounts, access history, and backups.

Each integration uses read-only access and is used solely to display metrics inside your Lens workspace. We do not create, modify, pause, or delete anything in your connected accounts.

• LinkedIn Ads. Using the LinkedIn Marketing Developer Platform r_ads and r_ads_reporting scopes, we read ad-account metadata (account name, currency, campaign IDs and names) and campaign-level reporting metrics (impressions, clicks, spend, conversions) for the date ranges you select. We do not access LinkedIn Lead Gen Form data, member profile data beyond your own sign-in profile, or any other LinkedIn data outside these scopes.
• Meta Ads (Facebook/Instagram). Using ads_read and business_management, we read your ad accounts and campaign/ad-level performance metrics (impressions, clicks, spend, conversions, revenue). We do not post, manage campaigns, or read personal profile content.
• Google Ads. Using the Google Ads API (read-only), we read account, campaign, and ad performance metrics.
• Google Analytics 4. Using analytics.readonly, we read aggregated site metrics (sessions, users, pageviews, conversions) by date and traffic source.
• Google Search Console. Using webmasters.readonly, we read organic search clicks, impressions, CTR, and average position for your verified sites.
• Google Business Profile. Using business.manage, we read review ratings, counts, and related metrics for your locations.
• YouTube. Using yt-analytics.readonly and youtube.readonly, we read channel metadata and aggregated channel analytics (views, watch time, subscribers, likes, comments) for channels you own or manage.
• TikTok Ads. Using the TikTok Business API reporting scopes (read-only), we read advertiser metadata and campaign/ad performance metrics.

In every case the data flow is one-way: from the provider → Lens → your client-facing dashboard.

For client-controlled CMS user records, the client determines and explains its lawful basis; Splitlight processes those records on its instructions. We use our own business contact and support records to provide services and respond to requests (contract or legitimate interests, as applicable), and retain records required by law to meet our legal obligations.

• Website analytics: 14 months.
• Lens account data: for the life of your account, deleted within 30 days of an account-deletion request.
• Connected reporting metrics: a rolling 3-year window, then automatically deleted.
• Lens data-source OAuth tokens: deleted immediately when you disconnect a data source.
• Billing records: 7 years (UK statutory requirement).

CMS accounts and access history

Active CMS records are kept while the account is needed for the client’s installation. Removing or expiring access archives the user: it prevents access to protected CMS functions but keeps the profile and access-management history so an administrator can identify the former user and, where appropriate, restore access. Archived users are not automatically erased after a fixed period; the client determines when they are no longer needed and requests or performs deletion.

Permanently deleting an archived CMS user removes the CMS profile and its local invitations. A minimal access-block record (email, authentication identifier, and deletion date) remains to prevent a later sign-in from recreating access without a new invitation. These records do not expire automatically; their continued need is considered when handling a deletion request. CMS deletion does not automatically delete the separate Clerk identity. A request for full account erasure must therefore cover both systems.

Authorship references in content or version history may remain separately from the profile. The client determines whether to remove or anonymise them, taking account of content history, security, and any legal requirement to retain particular records. Access-block records are kept to enforce an access restriction until a new authorised invitation supersedes the restriction or a review establishes that the record is no longer needed.

CMS backups

Deleting a live record does not immediately remove copies from existing backups. Backup retention depends on the client’s installation. For installations using our managed database-backup schedule, daily database backups are retained for seven days and encrypted off-site database exports for 90 days. Other configured schedules are available from the client or our privacy contact.

Manual recovery or configuration archives have separate retention and do not necessarily expire automatically. If they contain account information, they must also be considered when handling an erasure request. Backup copies are used for recovery and security, with access restricted to authorised operators. We coordinate deletion requests with the client, including retained copies and any records restored from a backup.

We use the following providers, each under a data-processing agreement. The providers used depend on the product and client installation; using Google to sign in to the CMS does not share your sign-in data with the Lens advertising integrations:

Data may be transferred between the UK, EU, USA, and other locations used by the configured providers. Where required for international transfers, we use appropriate safeguards, including the UK International Data Transfer Agreement or UK Addendum and the EU Standard Contractual Clauses. For a client-operated CMS, contact the client or our privacy contact for the providers and storage locations used by that installation.

• Lens OAuth refresh tokens are encrypted at rest (AES-256-GCM) with a per-deployment key; plaintext tokens are never stored.
• All traffic is encrypted in transit (TLS 1.2+).
• Lens enforces row-level access control: an agency can only ever see its own data.
• CMS operations require an authenticated account with an appropriate role. Archived and expired accounts are excluded from protected CMS operations.
• We do not currently hold SOC 2 / ISO 27001 certification and will update this section if that changes.

Lens and Splitlight CMS use strictly-necessary cookies for authentication and session security (set by Clerk). Our own websites may also use basic site analytics. We do not use Google sign-in data for advertising or cross-site tracking. Where required, non-essential cookies are set only with your consent. A client-operated website may have its own analytics or marketing tools; these are separate from CMS Google sign-in and are explained in that client’s cookie and privacy notices.

Under UK/EU GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, to withdraw consent where processing is consent-based, and to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint). To exercise any right, email privacy@splitlight.co.uk; we respond within 30 days.

Lens and Splitlight CMS are business products not directed at anyone under 18, and we do not knowingly collect their data.

We will post any updated policy here with a new “Last updated” date and email registered Lens users at least 14 days before material changes take effect.

privacy@splitlight.co.uk · Splitlight Ltd, Silverstream House, 45 Fitzroy Street, London W1T 6EB, United Kingdom