Privacy policy

The short version: if you ask for a free audit, we get your website and email address, plus anything you choose to add. We use them to write the audit and talk to you about it. If you order the paid AI search audit, we also take your name, company name and billing details for the invoice. If you only read the site, Vercel, which hosts it, receives your IP address. Google Analytics and Microsoft Clarity record your visit only if you accept analytics cookies.

Who we are

Kilter Agency is a trading name of QuickRank Marketing (Pty) Ltd, registration number 2025/257899/07. Section 18 of POPIA asks us to tell you who is responsible for your information and how to reach us.

• Responsible party: QuickRank Marketing (Pty) Ltd.
• Information Officer: email hello@kilteragency.com.
• Email: hello@kilteragency.com.

What the audit form collects

The form has two steps. Step 1 asks for:

• your website address
• your email address

Step 2 is optional. You can answer any of these questions, or press "Skip, just send the audit":

• your name
• a phone or WhatsApp number
• what you want more of: calls, quote requests, online sales, bookings or "Not sure yet"
• your monthly marketing budget, as a range, or "Rather not say"

With each step, we also receive:

• the page the form was on
• the first page you opened on this visit
• the website that linked you here, if you came from another site
• any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_term and utm_content)
• the date and time, and a reference number for the request

There's also a hidden field that people never see. Spam bots tend to fill it in, and when it's filled in we treat the request as spam and send nothing.

If you order the AI search audit

The same form takes orders for the paid AI search audit. For the invoice, we also collect:

• your name
• your company name
• your email address
• any billing details you give us

We use them to send you the invoice and to keep the tax records the law requires.

We make the invoice ourselves as a PDF and email it from our Google Workspace mailbox. No invoicing software or outside accountant handles it.

Why we collect it

We use the form's details to write your audit, send it to you and follow up about it. Your website address tells us what to look at. Your email address tells us where to send the result. The step 2 answers help us fit the audit to your business, because a builder who wants more quote requests needs different advice from a shop that wants online sales. The page, campaign tags and referring site show us which pages and links bring in requests.

We send your audit only to the email address you gave us, and we don't publish it or share it with anyone else.

You don't have to give us anything, but without a website and an email address we can't send an audit, so step 1 needs both. Step 2 is up to you: you'll get the audit whether you answer it or not. No law requires us to collect what the form asks for, though tax law does require us to keep the invoice for an AI search audit.

Our legal basis

• The audit request: your consent, given when you send the form (POPIA section 11(1)(a)). You can withdraw it at any time by emailing hello@kilteragency.com. Withdrawing doesn't make what we did before unlawful.
• The invoice for the AI search audit: carrying out the order you placed with us (section 11(1)(b)), and keeping the tax records the law requires (section 11(1)(c)).

• Google Analytics and Microsoft Clarity: your consent, given when you choose Accept in the cookie banner (section 11(1)(a)). You can withdraw it at any time through "Cookie settings" at the foot of every page.

• Delivering the site, keeping it secure and limiting form submissions: our legitimate interest in running a site that works and keeping the form free of spam and abuse (section 11(1)(f)).

Who else handles it

These outside companies handle personal information from the site. Microsoft's terms for Clarity also let it use what Clarity collects for its own purposes, as explained below.

Resend, for email delivery

When you send the form, our server emails your details to our inbox through Resend, an email delivery service. We send through Resend's EU region, in Ireland. The email's reply address is yours, so we can answer you directly. Resend's privacy policy (updated 27 August 2026) says it also transfers personal data to the United States and processes it there.

Google Workspace, for our inbox

The emails land in our inbox, where we also keep the audit we send you, any invoice and any replies. We email AI search audit invoices from the same mailbox. Google hosts that inbox for us, through Google Workspace.

Vercel, which hosts the site

Every page you load sends Vercel your IP address, the city and country worked out from it, your browser and device details (the user agent) and the address of the page, as it would with any web host. Vercel uses these to deliver the site and keep it secure. Its firewall also limits how many times the audit form can be sent from one IP address within 10 minutes. Vercel's privacy notice (updated 1 June 2026) says it may process information in the United States and other countries where it operates.

Our own server adds a second limit: 5 audit requests from one IP address in 10 minutes. It counts a scrambled (hashed) form of your IP address, which is held briefly in memory and never written to a database or a log. Our code only writes to the server log when something goes wrong, and those lines leave out what you typed.

Google Analytics 4

We use Google Analytics 4 to count visits and enquiries. It loads only after you choose Accept in the cookie banner, and if you choose Reject it never loads. Once it's running, it records the pages you view, how you reached the site, your browser and device, your approximate location (worked out from your IP address) and two events:

• generate_lead: step 1 of the audit form was sent and the email to us went through, with which audit was asked for (free or AI search)
• audit_details: step 2 was sent and the email to us went through

Besides the page it happened on, each event notes only which form was used, such as the one at the top of the homepage or the one at the foot of a page, and generate_lead also notes which audit was asked for. Neither includes your name, email address, phone number or anything you type into the form. Depending on its settings, Google Analytics can also record some actions by itself, such as scrolling to the end of a page or clicking a link to another site.

We run Google Analytics with Google's Consent Mode v2. Every type of storage starts as denied, and Accept switches on analytics storage only. Ad storage, ad user data and ad personalisation stay denied, so Google Analytics sets no advertising cookies and we don't use it for advertising. Google's consent mode overview says that with those three denied, no advertising cookies are written, no personal data is collected for online advertising and personalised advertising is switched off.

Google's help page on IP addresses says that for visitors outside the EU, Switzerland and the UK, Google Analytics uses the IP address to filter out spam and work out a rough location, then discards it. The same page says it never links the address itself to the IDs it uses to tell visitors apart. Google's privacy policy says information may be processed on servers outside the country where you live, and How Google uses information from sites or apps that use our services explains what it does with the data. We checked all four Google pages on 7 October 2026.

Microsoft Clarity, for recordings and heatmaps

Clarity also loads only after you choose Accept, and never after Reject. It records how people use our pages, so we can play a visit back as a recording and see heatmaps of where people click and how far they scroll. Microsoft's list of what Clarity collects includes clicks, scrolling, mouse movement, text you select, window size, page errors, how fast the page loaded, and the page's layout and content.

We've set Clarity's masking to Strict. Microsoft's masking page (checked 8 October 2026) says Strict masks the entire content of the page, that input boxes and drop-down menus are masked in every mode, and that masked content is never uploaded to Clarity. So a recording shows the shape of the page, where you click and how far you scroll, but not the words on it or anything you type. Because it shows where you click, it can show which answers you pick in step 2 of the form.

Clarity gives your browser a pseudonymous ID. Microsoft's Clarity FAQ says it uses your IP address to work out roughly where you are, and that the data is stored in Microsoft's Azure cloud. Clarity's data is stored outside South Africa. The Microsoft Privacy Statement (updated September 2026) says personal data Microsoft collects may be stored and processed in your region, in the United States and in any other country where Microsoft, its affiliates, subsidiaries or service providers have facilities.

Microsoft also uses this data for itself. The Clarity terms of use make Microsoft and us each responsible for it in our own right, and let Microsoft use what Clarity collects for any purpose its privacy statement allows, including running Clarity, improving Microsoft's products and building user profiles for purposes that include advertising. The same terms ask us to tell you that Microsoft collects or receives personal data from us to provide Microsoft Advertising. We checked these five Microsoft pages on 7 October 2026.

We tell Clarity that ad storage is denied, and Microsoft's consent page says that with ad storage denied, Clarity shares no data with Microsoft Ads.

We don't sell your information, and we share it only with the providers named on this page or when a law requires us to.

Cookies and browser storage

Our own code sets no cookies, and nothing that sets one loads until you choose Accept in the cookie banner, which shows on every page until you choose. If you choose Reject, Google Analytics and Clarity never load.

After Accept, Google Analytics sets two cookies on this site, and Google's list of Analytics cookies (checked 7 October 2026) gives each a default lifespan of 2 years:

• _ga, which tells one browser from another
• _ga_ followed by an ID, which keeps track of your current visit

Clarity sets two cookies on this site. Microsoft's Clarity cookie list names them but gives no lifespans, so the lifespans here come from the Clarity script itself and its source code, which Microsoft publishes. We checked both on 8 October 2026.

• _clck, which keeps your Clarity ID and settings for this site, for 1 year
• _clsk, which joins the pages you view into one recording, for 1 day

The same Microsoft list names five more cookies Clarity can set on Microsoft's own domains rather than ours: CLID, MUID, MR, SM and ANONCHK. Microsoft says MUID identifies browsers that visit Microsoft sites and is used for advertising, site analytics and other operational purposes. The list gives no lifespans for these five, and because they sit on Microsoft's domains, only your browser settings can delete them.

If you accepted and change your mind, choose Reject in "Cookie settings". That stops both tools, deletes the four cookies listed above from this site and reloads the page. The site loads no advertising tags from Google, Meta or anyone else.

The site also keeps two small items in your browser. They aren't cookies:

• kilter-consent, in localStorage, remembers whether you chose Accept ("granted") or Reject ("denied"), so the banner doesn't keep coming back. It stays until you clear your browser's data for this site, and "Cookie settings" at the foot of every page lets you change it.
• kilter-attribution, in sessionStorage, holds the first page of your visit, the site that linked you here and any campaign tags. It leaves your browser only if you send the audit form, which includes it with your request. Your browser deletes it when you close the tab.

You can block or delete cookies and site data in your browser's settings. To stop Google Analytics on every site you visit, install the Google Analytics Opt-out Browser Add-on. The site and the form still work if you do.

Sending information outside South Africa

Resend, Vercel, Google and Microsoft process information outside South Africa, including in the United States, and not every country they use has a data protection law like POPIA. Google, which hosts our inbox through Google Workspace, may store mail outside South Africa too.

Section 72 of POPIA allows these transfers on several grounds. We rely on two:

• The company receiving the information is bound by a law or agreement that protects it adequately (section 72(1)(a)). Resend, Vercel and Google are each bound by data protection terms in their agreements with us.
• The transfer is needed for a contract with you, or for a step you asked for before one (section 72(1)(c)). Emailing your audit request to our inbox is a step you asked for, and emailing you the invoice for the AI search audit is part of carrying out your order.

For Clarity, we rely on the first of these: Microsoft is bound by data protection terms in its agreement with us.

How long we keep it

We keep audit requests, the emails about them and the audits we send for 12 months after our last contact with you, then delete them. If you become a client, we keep them until 12 months after our work together ends.

If you order the AI search audit, we keep the invoice and the details on it longer: for as long as tax law requires records to be kept, currently five years.

We've set Google Analytics to delete the detailed record of visits after 14 months. Totals, such as visits per month, stay in our reports.

Microsoft's Clarity data retention page (checked 7 October 2026) says recordings are kept for 30 days, and heatmap and click data, and recordings that someone has labelled or marked as a favourite, for 9 months, then deleted. We can't delete one visitor's Clarity data by itself: Microsoft's FAQ says that means deleting the whole project.

Resend and Vercel keep records of the emails and requests they handle for the periods set in their own terms.

Follow-up and direct marketing

After you ask for an audit, we contact you only about that audit. We won't add you to a newsletter or mailing list unless you ask us to.

Under section 69 of POPIA, we'd need your consent before sending you marketing by email, SMS, WhatsApp or any other electronic message, and each message would have to say how to ask us to stop. For direct marketing sent any other way, section 11(3)(b) lets you object at any time.

Your rights

POPIA gives you the right to:

• ask whether we hold personal information about you, which we'll confirm free of charge, and ask for a copy of it, including who has had access to it (section 23)
• ask us to correct or delete information that's inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or that we're no longer allowed to keep (section 24)
• object, on reasonable grounds, to processing based on our legitimate interest, such as the limits on how often the audit form can be sent (section 11(3)(a))
• refuse marketing by email, SMS, WhatsApp or any other electronic message, which we can't send you without your consent (section 69)
• object at any time to direct marketing sent any other way (section 11(3)(b))

• withdraw your consent to the audit request, or to Google Analytics and Clarity, at any time (section 11(2)(b))

• complain to the Information Regulator (section 74)

To use any of these rights with us, email hello@kilteragency.com. We may ask you to confirm who you are first, so we don't send your information to someone else. Section 25 of POPIA applies the request procedure in the Promotion of Access to Information Act 2 of 2000 to requests for a copy, so we may ask you to fill in the request form prescribed under that Act. We'll answer within 30 days, and we don't charge for it.

Security

The site runs over HTTPS, so what you type into the form is encrypted on its way to our server. Our server only accepts form requests sent from this website. If we have reason to believe that someone who shouldn't have it has accessed or taken personal information we hold, we'll tell the Information Regulator and you, as section 22 of POPIA requires.

Email

If you email us at hello@kilteragency.com, we get your email address and whatever you tell us, and we use it to answer you.

Complaints

If you're unhappy with how we've handled your information, tell us at hello@kilteragency.com and we'll try to put it right. You can also complain to the Information Regulator at any time. These are its details as its website gave them on 7 October 2026:

• Website: inforegulator.org.za
• POPIA complaints: the Regulator's complaints page asks you to register a profile on its eServices portal and lodge the complaint there
• General enquiries: enquiries@inforegulator.org.za

Changes to this policy

When we change how we handle personal information, for example by adding a new provider, we'll update this page and the date at the top. Our terms of use cover the rest of the site.