Last updated 19 October 2026.
We make WordPress software, host websites, run an analytics service that gathers a website’s own figures from Google, Microsoft, Cloudflare, YouTube, Instagram, Facebook and TikTok into one place for the people who run that website, and run a sign-in service that lets those people sign in to their website with their Microsoft or Google work account.
You can reach us about anything in this policy at [email protected].
connect.presskit.live in Australia and never leaves our systems. Our analytics service receives only short-lived access tokens, and only the figures.This policy covers:
presskit.live and its subdomains, including connect.presskit.live;It does not cover the visitors to a customer’s own website, or the people a customer lets sign in to it. For them, we act as a service provider to that customer: we process their data on the customer’s instructions and under the customer’s privacy policy, and we use it for nothing else. § 4.6 says what passes through us when someone signs in.
Our web server and Cloudflare, which sits in front of it, record the ordinary request details: your IP address, the page asked for, the time, and your browser’s description of itself. We use these to run and secure the site. presskit.live carries no advertising or analytics tag.
Your name, business name, email address and phone number, what you tell us in support correspondence, and the details of what you have asked us to build, host or install. If we invoice you, the details on the invoice. The administrator accounts on a site we host are created at your request and belong to you.
A site running Presskit Live checks presskit.live for updates and downloads them from there. We see the request’s address, the site’s address and the plugin versions it asks about. The Software sends us nothing else: no content, no visitor data, no settings.
Analytics reads figures from the services you choose to connect. For each, it reads only what the permissions you grant allow, and it stores only what is listed here.
Google.
One Google sign-in may cover up to five read-only services, each shown on Google’s consent screen and each refusable:
Meta.
The Facebook Pages you choose and the Instagram professional accounts linked to them: the Page’s or account’s id, name, follower count and daily reach, views and new follows; and each post’s id, caption, type, permalink, thumbnail address, publish time, and its running totals of views or plays, reach, likes, comments, shares and saves.
TikTok.
Your account’s id, display name, avatar address, follower, following, likes and video counts; and each public video’s id, title, cover image address, publish time, duration, share address, and its running totals of views, likes, comments and shares.
Running totals from Meta and TikTok are recorded once a day as a snapshot, so that the day’s change can be worked out. Nothing is read about who viewed, liked or commented. We never read messages, comments’ text, or your audience’s identities.
Microsoft Bing Webmaster Tools and Cloudflare Web Analytics.
Where a customer gives us an API key: the site’s daily clicks and impressions by page and query, and its daily page views and web vitals. Both are aggregated figures with no record of any individual visitor.
When you connect an account, the provider gives Connect a refresh token (Meta gives a long-lived token instead). Connect stores it encrypted with a key held only in that service’s environment. It is never written anywhere in plain text, never logged, and never sent to any other system, including our own analytics service. When Analytics needs to read your figures it asks Connect for a short-lived access token, keeps it in memory for at most the time the provider allows, and discards it. The API keys a customer gives us for Bing and Cloudflare are held encrypted in our deployment configuration. A sign-in to a website (§ 4.6) stores no token at all.
A customer may let the people who run their website sign in to it with a Microsoft account, or a Google account, instead of a password. The customer decides which organisations and email domains are admitted and what each group of people may do.
When you sign in, the provider gives Connect: your account’s id and your name and email address; for Microsoft, the id of your organisation’s directory and the ids and names of the groups you belong to there; for Google, your organisation’s domain where it has one; and your profile photo. Connect checks that your organisation or domain is one the customer admits, encrypts these into a single-use code that the website collects within ten minutes, and overwrites them as the code is spent. Connect keeps none of them. What it keeps is a record that a sign-in happened – the time, the website, the provider and the outcome – for thirty days, so that a failed sign-in can be explained. No name, email address, id or group is ever in that record.
The website keeps, on your account there: which provider you sign in with and its id for you, your email address, the groups seen at your last sign-in (they set your role and what you may do on the site, and are read again every time you sign in), your photo, and the time of your last sign-in. Your name and email address on that account follow the provider’s and cannot be edited on the site. Where the customer has chosen so, an account is made for you the first time you sign in. The website also keeps a log of sign-ins and refusals – the time, the account, the provider, the outcome and the address the sign-in came from – for ninety days. The customer’s administrator can see these, and can unlink your account at any time (§ 12).
A sign-in stores no password and no token. Connect uses the provider’s answer once, to build the sign-in, and discards it.
We use what we collect to:
We do not sell data, share it with advertisers or data brokers, use it to serve or target advertising, or use it to assess anyone’s creditworthiness. We do not combine figures from different customers, and one customer’s figures are never shown to another. No person at Presskit reads a customer’s figures except to support that customer at their request or to investigate a security problem. We do not use connected-account data to train or improve any model.
Presskit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: we use Google user data only to provide the features described in § 4.4, § 4.6 and § 5 to the customer who connected the account or whose website you signed in to; we transfer it to no one except as needed to provide those features (the customer’s own analytics service), for security, or where the law requires; no human at Presskit reads it except as § 5 allows; and we never use it for advertising.
Presskit uses YouTube API Services.
By connecting a YouTube channel you also agree to the YouTube Terms of Service and Google’s handling of your data is described in the Google Privacy Policy. Besides disconnecting in Presskit SEO (§ 12), you can revoke Presskit’s access to your Google data at any time on the Google security settings page. The YouTube statistics we store are kept for as long as the connection stands, and every 30 days we confirm that we are still authorised to hold them; a video’s title, description and thumbnail are refreshed or removed within 30 days. When a connection is revoked, collection stops and the data is deleted as § 12 describes.
Data we receive from Meta and TikTok about your Pages, accounts and posts is processed on your behalf and at your direction, is kept separate from every other customer’s, and is used for nothing but the features described here. We keep it only as long as § 10 says, and delete it when you disconnect or ask us to (§ 12). Your use of those platforms remains subject to their own terms and privacy policies.
Only the service providers that run our systems, each for the stated purpose and nothing more:
We disclose data where the law requires it, and we will tell you if we do unless the law prevents it. If Presskit is sold or merged, data passes to the new owner only under this policy, and we will tell you first.
Our servers are in Australia. Connected-account tokens and collected figures are stored and backed up in Australia. Cloudflare may process request details at the edge location nearest the visitor, and Resend processes email in the United States. A sign-in to a website passes through Connect in Australia; what the website keeps about your account is held wherever that website is hosted, and for the sites we host that is Australia.
Everything travels over TLS. Tokens are encrypted at rest with AES-256-GCM. Access to our systems is limited to the people who operate them and protected by keys rather than passwords. Backups are encrypted before they leave our servers. Our services are built so that no token or secret appears in a log, an error message or a backup. If a data breach is likely to cause serious harm we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
To disconnect an account: in your site’s WordPress admin open Presskit SEO > Settings > Analytics > Connections and choose Disconnect beside the service.
We revoke our access with the provider, overwrite the stored token, and stop collecting from that account the same day.
You can also remove our access from the provider’s side at any time:
To stop signing in to a website with Microsoft or Google: ask that website’s administrator to unlink your account on your profile there. The account stays and signs in with a password from then on, and it leaves the groups the sign-in put it in. You can also remove Presskit Connect’s access from your own side: for Microsoft, at My Apps (myapps.microsoft.com) or through your organisation’s administrator; for Google, on the same Third-party apps and services page as above.
To delete your data email [email protected] from an address associated with your account, naming the site and the accounts concerned. Within 30 days we will delete the connection records, the figures collected from those accounts, and any copies in our live systems, and confirm by email. Backups age out on the schedule in § 10. If you only want to delete the data for one Page or account while keeping another, say so and we will do that instead. A customer who ends their service with us is offered an export first, then deleted the same way.
We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. You may ask for access to the personal information we hold about you, ask us to correct it, or complain about how we have handled it, by writing to [email protected]. We answer within 30 days. If you are not satisfied with our answer you may complain to the Office of the Australian Information Commissioner. If you are in the United Kingdom or the European Economic Area you have the corresponding rights under the UK GDPR or the GDPR, including the right to object and to data portability, and the same address reaches us.
presskit.live sets WordPress’s own cookies only when someone signs in to its admin, and Cloudflare may set its bot-protection cookie (__cf_bm) for a short time. We set no advertising or analytics cookies. Presskit Connect sets no cookies: a sign-in is carried by a short-lived, single-use code in the address. A website you sign in to sets one cookie of its own for the ten minutes a sign-in is in flight, and then WordPress’s usual sign-in cookies.
Our services are business tools and are not directed at children. We do not knowingly collect personal information from anyone under 16.
We will post any change on this page with a new date at the top, and tell customers by email about any change that affects how we handle their data at least 14 days before it takes effect.
Email [email protected]