Privacy Policy

1. Introduction

TrackOG is an affiliate and performance marketing tracking platform operated by Kytra Tech Private Limited (“TrackOG”, “we”, “us”, “our”), a company incorporated under the laws of India.

Advertisers, affiliate networks, agencies and publishers use TrackOG to record clicks and conversions, measure campaign performance, detect invalid traffic, and settle payouts between partners.

This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, read with the Information Technology Act, 2000 and the rules made under it.

TrackOG currently operates in India. Our customers are located in India, and our services are offered to businesses in India.

This Policy does not describe the practices of our customers, of the advertisers and publishers they work with, or of the websites and applications where their advertisements appear. Those parties operate under their own privacy policies.

2. Our role

The law distinguishes between the party that decides why and how personal data is processed, and the party that processes it on their behalf. Our role changes depending on whose data is involved.

For visitors to trackog.com, our blog and TrackOG Academy, and for account holders and users of TrackOG Panel — that is, our customers’ own staff — we act as a Data Fiduciary. In these cases we decide what is collected and for what purpose, and the obligations set out in this Policy apply directly to us.

By contrast, for the clicks, conversions and tracking events we process on behalf of our customers — data relating to the end users of our customers’ campaigns — we act as a Data Processor.

Where we act as a Data Processor, our customer is the Data Fiduciary. They determine what is collected and for what purpose, they are responsible for giving notice and obtaining consent, and we process only on their documented instructions under a written contract, as required by Section 8(2) of the DPDP Act.

3. Information we collect

3.1 Information you give us

At registration: full name, business email address, phone number, company name, company website, country and time zone.

Account credentials: a username and password. Passwords are stored using industry-standard hashing. We cannot read your password and no member of our team can retrieve it.

Billing information: billing contact details, GSTIN or equivalent tax identifier, and transaction records.

When you contact us: your name, contact details, the content of your message, and the history of the support interaction.

3.2 Collected automatically when you use the platform

• Login timestamps and IP address
• Device type, operating system and browser
• Actions taken within TrackOG Panel, recorded in audit logs
• Feature usage, session duration and error events

We use this for security, abuse prevention, support, billing accuracy and diagnosing faults.

3.3 Website and Academy

• Pages viewed, referral source and session duration
• Cookie identifiers
• Newsletter subscription status
• Academy enrollment, course progress and certification records

3.4 Tracking data processed for our customers

When an end user interacts with a campaign tracked through TrackOG, we collect the following on our customer’s instruction:

• IP address, which may be masked or truncated depending on the customer’s configuration
• Device and browser information — operating system, browser, device model, language and screen settings
• Advertising identifiers such as GAID or IDFA, where the end user has not limited ad tracking
• Approximate geographic location — country, region and city, derived from IP address. We do not collect GPS-precision location
• Click and session identifiers generated by us to link a click to a later conversion
• Referring URL, campaign parameters and sub-IDs passed by our customer
• Conversion event data reported by the advertiser, such as event type, timestamp, order value and currency
• Signals used to detect invalid traffic, including click timing patterns, user-agent consistency and network characteristics

We do not collect through the tracking layer: names, email addresses, postal addresses, payment card details, or government identifiers. Our customer agreements prohibit passing such data into tracking parameters. Where it reaches us in error, we work with the customer to remove it.

3.5 Sensitive information

Passwords are collected solely so you can access the platform, stored hashed, and never used or accessed by us or our partners for any other purpose.

Financial information. Card and banking details are handled directly by PCI DSS compliant payment providers. We do not store full card numbers or bank account credentials. Where bank details appear on an instrument sent to us for payment, they are not recorded or processed beyond applying the payment to your account.

4. How we use information

We use the personal data described above to run TrackOG and meet our obligations to customers and to the law.

Operating the platform. Account, usage and tracking data are used to provide and operate TrackOG — recording clicks and attributing conversions, detecting and blocking invalid traffic and fraud, and generating the reports and analytics our customers rely on. Account and conversion data are used to calculate and process payouts between our customers and their partners.

Running the business relationship. Account and billing data are used for billing, invoicing and subscription management. Account, usage and support data are used to provide support and resolve issues you raise with us.

Security and integrity. Usage data and IP addresses are used to secure accounts, detect unauthorised access, and maintain the audit trails required under applicable law.

Product development. Aggregated usage data is used to improve the product. This analysis is carried out at an aggregate level and is not used to make decisions about individual users.

Communications. Contact data is used to send you service notifications relating to your account, and — where you have consented — marketing communications about our services.

Legal obligations. We process whatever data is required to meet our legal, tax and regulatory obligations, including retention of financial records and responding to lawful requests.

We do not use end-user tracking data to build advertising profiles for our own purposes. We do not sell personal data.

5. Consent and withdrawal

Where we act as Data Fiduciary, we process personal data on the basis of your consent, obtained through a clear standalone notice at the point of collection. Consent is free, specific, informed, unconditional and unambiguous, and limited to the data necessary for the stated purpose. We do not use pre-ticked boxes or bundled consent.

You may withdraw your consent at any time, and doing so is as easy as giving it:

• In the platform: Account Settings → Privacy → Manage Consent
• By email: [email protected], subject line “Withdraw Consent”
• Marketing only: the unsubscribe link in any marketing email
• Through a Consent Manager registered with the Data Protection Board of India

Processing carried out before withdrawal remains lawful. If the data was necessary to provide the service, we may be unable to continue providing it, and we will tell you before you confirm. Withdrawal does not affect processing we are legally required to continue, such as retaining tax records.

We may also process personal data without separate consent in the limited circumstances permitted under Section 7 of the DPDP Act, including compliance with a legal obligation or court order, and response to a medical emergency.

6. Minor

We will never knowingly collect any Personal Data and personal information about individuals under eighteen (18) years of age. If TrackOG obtains actual knowledge that it has collected personal information about an individual under eighteen (18) years of age, that information will be immediately deleted from our platform.

7. Cookies and tracking technologies

On our own websites

We use cookies and similar technologies on trackog.com, our blog and TrackOG Academy for:

• Essential purposes — authentication, session management and security. These cannot be disabled.
• Analytics — understanding how the site is used.
• Marketing — measuring the effectiveness of our own campaigns.

You can manage non-essential cookies through our cookie banner or your browser settings.

On our customers’ campaigns

We may set a click identifier in the end user’s browser, or use server-to-server methods that do not rely on browser storage at all. Which method applies is configured by our customer.

Your controls

• Block or delete cookies through your browser settings
• Enable “Limit Ad Tracking” on iOS or “Opt out of Ads Personalisation” on Android
• Reset your advertising identifier through your device privacy settings
• Contact the business whose advertisement you interacted with to exercise your rights

Disabling cookies will not stop you from seeing advertisements. It limits measurement and personalisation.

8. Third-party services

We engage third-party providers for infrastructure and hosting, content delivery and security, website analytics, bot protection, live chat and support tooling, email delivery, and payment processing.

The current, itemised list of our sub-processors — naming each provider, what they do, and where they process data — is published at trackog.com/sub-processors and updated whenever a provider is added or removed. It is also available on request to [email protected].

Each provider is engaged under a written contract limiting them to processing on our instructions, with confidentiality and security obligations equivalent to our own. None has an independent right to use the data.

Google API Services

TrackOG’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Sharing of information

Service providers. As described in section 8, under written contract and limited to our instructions.

Parties to a tracking relationship. Where our customer configures it, conversion and performance data is shared with the advertiser, network or publisher involved in that campaign. This is the core function of the platform and is determined by our customer.

Payment processors. As described in section 3.5.

Administrative access. Our support and engineering personnel may access customer environments for troubleshooting. Such access is limited to that purpose, granted on a need-to-know basis, and logged.

Legal and safety. Where required by law, court order, or a request from a competent authority including the Data Protection Board of India; or where we reasonably believe disclosure is necessary to investigate fraud, invalid traffic, security incidents, or threats to safety.

Corporate transactions. In connection with a merger, acquisition, financing or sale of assets, subject to the acquiring party being bound by equivalent protections. We will notify affected customers.

Aggregated data. We may publish statistics and benchmarks derived from platform activity. Such data cannot identify any individual, customer or campaign.

We do not rent or sell personal data.

10. Ownership of data

Our customers own the data they submit to and generate on the TrackOG platform. We hold it on their behalf.

Customers may export their data at any time, and may configure the platform to mask or omit fields such as IP address and device identifiers. Once data is exported from TrackOG, its handling is governed by the customer’s own policies and legal obligations.

On termination, we delete or return customer data in accordance with the applicable agreement and section 12 of this Policy.

11. Your rights

Subject to applicable law, you have the following rights:

• Access. Obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of other parties with whom it has been shared.
• Correction and erasure. Have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased where it is no longer needed for the purpose it was collected.
• Nomination. Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these, write to [email protected] with the subject “Privacy Rights Request”, or use Account Settings → Privacy → My Data. Include your name, the email address associated with your data, and the right you wish to exercise. We will verify your identity before acting and respond within the period prescribed under applicable law.

If you are an end user and have no direct relationship with TrackOG

When we operate as a Data Processor, we are not an end-user facing company. The direct relationship is between you and the business whose advertisement or offer you interacted with, usually the advertiser, and sometimes a publisher, agency or network. They are the Data Fiduciary.

To access, correct, erase or export your data, contact that business. They hold the relationship and the authority to act.

Where a Data Fiduciary receives such a request concerning data they share with us, they are required under their agreement with us to pass that request to us with the information needed to fulfil it, and we act on it.

If you cannot identify the business, write to [email protected] with whatever details you have: the site or app, the advertisement, the approximate date. We will make reasonable efforts to identify the correct Data Fiduciary and route your request to them.

Disabling tracking. You can disable cookies in your browser or browse in a private or incognito mode that ignores them. This will not stop you receiving advertisements. To opt out of a particular ad network, publisher or advertiser, contact them directly. To stop collection of advertising identifiers for targeted advertising, enable Limit Ad Tracking on your device — this does not disable advertising, it disables targeting. Resetting your advertising identifier clears the data currently used to target ads to you.

12. Retention

TrackOG holding sensitive/ personal data or information of providers of information, shall not retain such information for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under the User Agreement or any other law for the time being in force or unless ordered to the contrary by any order of court of law. The information collected shall be used for the purpose for which it has been collected.

13. Security

We maintain administrative, technical and physical safeguards appropriate to the data we handle, including:

• Encryption of personal data in transit and at rest
• Role-based access control, granted on a need-to-know basis and reviewed periodically
• Audit logging of access and processing activity, retained for one year, with alerting on anomalous access
• Secure, regularly tested backups
• Written confidentiality and security obligations for all personnel and service providers
• Security training for personnel and revocation of access on exit
• Periodic vulnerability assessment and patching

Your responsibility. Keep your credentials confidential. Use a strong, unique password. Enable available account security features. Notify us immediately at [email protected] if you suspect unauthorised access to your account.

We have no control over the security of other websites you may visit or interact with. No system is completely secure; we cannot guarantee absolute security, but we commit to the standard of care described above.

14. Third-party links

Our website, blog, Academy and documentation may contain links to third-party websites and services. We do not control them and are not responsible for their content or privacy practices. Please review their policies before providing information to them.

15. Communications

We may send you service-related messages including billing notices, security alerts, platform updates and changes to our terms. These form part of the service and cannot be opted out of while your account is active.

Marketing emails, newsletters and product announcements may be unsubscribed from at any time using the link in each message or by contacting [email protected].

17. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, our technology, or the law. The date at the top of this document will change accordingly.

For material changes, we will give reasonable advance notice by email to account holders and by notice within the TrackOG Panel. Where a change requires fresh consent under applicable law, we will obtain it rather than relying on your continued use.

We review this Policy at least every six months, and whenever we add or remove a service provider, change how data is processed, or the law changes.

18. Contact us

For all privacy enquiries and rights requests, security incidents, data processing agreements, and general support, please contact [email protected]. Our team will review your request and respond promptly, ensuring that all concerns are addressed through this single point of contact.