Privacy and cookies.

01Introduction

Last updated: 17 July 2026.

Statistical Inference Limited (hereinafter referred to as "we", "us", or "our") welcomes you (hereinafter referred to as "you" or the "User") on our website d2tr.com (hereinafter referred to as the "Platform"). This Privacy and Cookies Policy (hereinafter referred to as the "Policy") describes the types of information we gather from people visiting our Platform and/or using our Platform and Services. Any capitalized terms used in this Policy have the meaning defined in our Terms of Use. By accessing the Platform or using our Services, you agree to adhere to this Policy. If you do not agree to the terms of this Policy, please do not use the Platform or any of our Services. Each time you use the Platform or our Services, the current version of this Policy will apply.

02General principles

We may collect two types of information from Users: "Personal Data" and "Aggregate Information" (as defined below).

03Personal Data

3.1 Processing Personal Data in a secure, fair, and transparent way is extremely important to us.

3.2 We process Personal Data in accordance with the applicable privacy laws and best industry standards. In addition to terms defined in the Terms of Use, this Policy uses the following definitions regarding your Personal Data: "Controller" is a party that determines the purposes and means of the processing of Personal Data; we are the Controller with respect to your Personal Data. "Data Subjects" refers to those individuals who are our Users. "Incident" means: (a) a complaint or a request with respect to the exercise of an individual's rights under the applicable privacy laws; (b) an investigation into or seizure of the Personal Data by government officials; or (c) any breach of the security and/or confidentiality leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the Personal Data. "Personal Data" is any data relating directly or indirectly to an identifiable Data Subject. "Processing" is collecting, recording, using, storing, amending, adapting, disclosing, transferring or transmitting, structuring, combining, deleting or destroying Personal Data. "Processor" is the party that processes Personal Data on behalf of the Controller.

3.3 We collect Personal Data that is voluntarily provided when a User on our Platform creates an account or logs into their account.

3.4 This information is used to assist us in helping you select the appropriate service package, to allow you to authenticate to the Platform, to send you e-mail notifications, newsletters or other marketing materials.

3.5 We also automatically collect and store information about our User's use of the Platform and our Services, including page scraping activities, so that information gathered by a User through our Platform or Services can be served up each time a User logs in to the Platform.

3.6 We will process User's Personal Data only to the extent strictly necessary for the purpose of using the Platform and/or providing Services in accordance with the Terms of Use and this Policy and any further written instructions from the User that are mutually agreed upon between us.

3.7 When you use our public Knowledge Graph entity search or the entity-search mode in Google Profile Checker, the query is sent transiently to the Google Knowledge Graph Search API to return matching entities. We do not retain the submitted query or the returned entity results.

04How we use your Personal Data

4.1 We will only use your Personal Data when the law allows us to. Most commonly, we will use your Personal Data: (4.1.1) to perform the contract we are about to enter into or have entered into with you or your company; (4.1.2) where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests; or (4.1.3) where we need to comply with a legal obligation.

4.2 When we process your Personal Data, we are required to have a lawful basis for doing so. There are various different lawful bases on which we may rely.

4.3 Lawful bases we may rely on: consent — where you have given us clear consent; contract — where our use is necessary for a contract; legal obligation — where we must comply with the law; legitimate interests — where use is necessary for legitimate interests of us or a third party.

05Who we share your Personal Data with

5.1 Where you have ordered Services, we may share your Personal Data with third party contractors in order to perform such Services.

5.2 Payment processing services enable us to process payments by credit card or bank transfer. We only share the information necessary to execute the transaction with the financial intermediaries handling the transaction and we do not store any of your financial details ourselves.

5.3 We will also share Personal Data with law enforcement or other authorities if required by applicable law.

06Transfer outside your jurisdiction

6.1 We are a company incorporated in Hong Kong. Due to the global nature of our operations, we may collect, access, store, process, and transfer your Personal Data in Hong Kong and in any other jurisdiction in which we, our affiliates, service providers, or business partners operate.

6.2 Personal Data may therefore be transferred to, stored in, or otherwise processed in jurisdictions outside your country or region of residence, where data-protection laws may differ from those in your jurisdiction.

6.3 Where applicable law requires it, we use an applicable adequacy decision or contractual and organisational safeguards designed to protect Personal Data during international transfers. More information is available on our GDPR information page.

07Marketing

7.1 We would like to send you information about the website, our services, the services on sale and any special offers. Where we have your consent or it is in our legitimate interests to do so, we may do this by post, email, telephone, text message (SMS) or automated call.

7.2 We will ask whether you would like us to send you marketing messages when you provide consent to such marketing.

7.3 You can unsubscribe at any time by: (7.3.1) contacting us using the detail provided at the end of this Policy; or (7.3.2) using the 'unsubscribe' link in emails.

08User obligations

In supplying Personal Data to us, the User warrants that it has all necessary rights to provide such Personal Data for Processing in connection with the provision of the Services. To the extent required by applicable law, the User is responsible for ensuring that any Data Subject consents that may be necessary to this processing are obtained.

09Aggregate information

9.1 We may also collect aggregate information. Aggregate information is information about your activities on the Platform or in connection with the Services that cannot be used to identify, locate, or contact you. Aggregate information is anonymised and is used in a collective manner; no single person can be identified by that compiled information.

9.2 We may use aggregate information to improve the Platform and Services, to monitor traffic and general usage patterns, and for our other legitimate business interests.

10Security of Personal Data

10.1 We take appropriate security measures to protect against unauthorised access to or unauthorised alteration, disclosure or destruction of data. These include internal reviews of our data collection, storage and processing practices and security measures.

10.2 We restrict access to collected information to our employees, service providers and agents who need to know that information in order to operate, develop or improve our services.

11Integrity of your data

We process your Personal Data only for the purposes for which it was collected and in accordance with this Policy. We take reasonable steps to ensure that the Personal Data we process is accurate, complete, and current, but we depend on our users to update or correct their Personal Data whenever necessary.

12Children and special categories

12.1 Our Platform and Services are not directed to children and we will not request personally identifiable information from anyone who we know to be under the age of 18, unless we have obtained verifiable parental consent.

12.2 We do not collect any Special Categories of Personal Data about you, including details about your race, religion, sex life, political opinions, health, or genetic and biometric data.

13Business transfers

In the event that we sell substantially all of our assets, or one of our business units is acquired, Personal Data of Users will likely be one of the transferred assets.

14Your rights

14.1 You have a number of important rights free of charge. In summary, those include rights to: fair processing of information; access to your Personal Data; correction of mistakes; erasure in certain situations; data portability; objection to direct marketing or automated decisions; restriction of processing in certain circumstances.

14.2 If you would like to exercise any of those rights, please email or write to us using the details provided on the Platform.

14.3 We will endeavor to respond to all requests within 30 days of receipt.

15Cookies

15.1 We use a consent-based cookie model with three categories. Necessary storage supports security, core site operation, and remembers your privacy choice. Analytics covers Vercel Analytics, Vercel Speed Insights, and Microsoft Clarity. Marketing covers Google Tag Manager and any optional technology configured through it.

15.2 Analytics and Marketing technologies are disabled by default. They are loaded only after you give consent to the relevant category. Rejecting non-essential cookies does not prevent access to the public website or its core functions.

15.3 When Analytics is enabled, the analytics providers may process usage events, device and browser information, referring pages, approximate location derived from network information, and interaction or performance signals. When Marketing is enabled, configured tags may measure campaign performance. We do not use website or extension data to build or sell profiles for personalized advertising.

15.4 You can choose Accept all, Reject non-essential, or Manage preferences when the banner appears. You can later reopen Cookie settings from the footer and change Analytics and Marketing separately. Necessary storage cannot be switched off through this control because it is used to provide requested functions and remember the choice.

15.5 Withdrawing consent stops future loading of the disabled category. We also attempt to remove known optional first-party analytics cookies and reload the page when necessary so an already loaded optional tool is no longer active. You may additionally clear cookies using your browser controls.

15.6 For more information about lawful bases, international transfers, retention, and your data-protection rights, read our GDPR information page.

16D2TR — Discover Trends Tracker Chrome Extension

16.1 Single purpose and first-use choice. The D2TR — Discover Trends Tracker Chrome Extension adds publisher and content-research information to the page you are viewing. Domain intelligence is off by default. Before a current or listed domain, D2TR authentication session, or other extension user data leaves the browser, the extension presents a prominent disclosure and asks you to choose whether to enable domain intelligence. If you do not enable it, the extension does not make domain-check requests or capture an application session.

16.2 Domain checks. After you enable domain intelligence, opening the popup or Side Panel may send the current website domain to D2TR to return publisher-presence, profile, social-link, publication, and related research signals. While the Side Panel is open, it follows the active tab when you switch tabs or navigate. The extension may display the active page title, URL, and favicon locally, but only the derived domain is included in a domain-check request; it does not enumerate or retain inactive-tab browsing history. On supported third-party research pages, a listed domain is sent only after you click the D2TR icon for that row. You can disable domain intelligence in Settings; this stops future requests, disconnects the account session, and clears cached domain results.

16.3 Optional page-content analysis. Entity extraction and related Google Discover article matching are disabled by default. After the extension displays a prominent disclosure and you choose "Allow page analysis", it may extract headings, paragraphs, and lists from the current page and send a structured document containing up to 50,000 characters to D2TR. This content is used only to extract and rank entities, calculate available trend and content-context signals, and find relevant Discover publications. If the submitted page is not in English, our configured AI provider first creates a block-preserving English translation and a bilingual entity-alias map for that requested analysis. The English version is used for entity extraction and related-content matching, while exact source-language forms are mapped back to the original page blocks for optional highlighting. Google News and Google Profile domain checks do not require or transmit page text. You can withdraw this permission at any time in the extension Settings.

16.4 Service providers. To deliver requested page analysis, D2TR may process submitted text through TextRazor, Google Cloud Natural Language, and an AI model provider reached through our OpenAI-compatible processing route (currently configured through OpenRouter). For non-English pages, that AI route also performs the private English translation described above. The translation and bilingual alias map expire with the raw analysis job after 30 minutes, are not returned as browser-safe results, and are not stored in the completed local analysis cache. For an entity trend requested in the extension, ScrapingDog receives one entity search term already present in the authorised analysis result and, if you selected one, a two-letter research-country code. This server-side request does not include submitted page text, the active page URL, D2TR account credentials, or a provider API credential from the extension. Google services are also contacted to perform the Google News and Google Profile checks requested by the extension. These providers process only the data necessary to return the requested result, subject to their applicable terms and privacy commitments.

16.5 Authentication data. Only after you enable domain intelligence and choose Connect, the bundled authentication bridge may read a short-lived Supabase access token, account user identifier, email address, and token expiry from an existing authenticated app.d2tr.com session. It transfers those fields directly to the background service worker. It does not copy or store the Supabase refresh token. The access token is validated by D2TR and kept only in Chrome's in-memory chrome.storage.session, restricted to trusted extension contexts. It is not returned to the popup, page-analysis script, Ahrefs script, or GoDaddy script through extension messaging; the popup bundle does not contain account-token transport code, and content scripts cannot read the restricted storage area. The authentication bridge is the sole content script that handles the token during this direct transfer. The token is removed on disconnect, domain-intelligence consent revocation, or expiry and is cleared when Chrome restarts or the extension is disabled, reloaded, or updated. On migration from an older extension build, any legacy access-token entry in local extension storage is removed.

16.6 Storage and retention. Raw submitted text and its analysis job expire from D2TR's temporary job store after no more than 30 minutes. The extension may cache a completed analysis result locally for reuse for up to 24 hours to make reopening the popup faster; that cache excludes the submitted page blocks and raw text. The cache is limited to the 25 most recently saved page results. An expired entry is ignored immediately and removed the next time the extension starts or opens, when that page is refreshed, when page analysis is disabled, or when the extension is uninstalled. Domain-check results may be cached locally for up to 24 hours as a bounded fallback and are then ignored. The extension keeps in-flight page-analysis job metadata in trusted chrome.storage.session for no more than 30 minutes so a user can close and reopen the popup without submitting the same analysis again. This temporary entry contains the normalised page URL, a page title/byline and count summary, an idempotency identifier, and a job-scoped polling credential; it excludes page blocks and raw text and is removed on completion, expiry, consent revocation, extension reload, or browser restart. Disabling page analysis clears local analysis-cache entries. Disabling domain intelligence clears cached domain results and the session. Removing the extension clears its Chrome-managed local data. Default News and Trends research-country selections are stored as local settings; they are explicit user choices and are not derived from device location or precise geolocation.

16.7 Security and quota data. D2TR may process request timestamps, response status, account or anonymous quota state, and network/IP-derived identifiers for abuse prevention, rate limiting, reliability, and security. Anonymous rate-limit identifiers are stored in pseudonymised or hashed form where supported by the service architecture. Hosting and network providers necessarily process connection information while delivering requests.

16.8 Chrome Web Store Limited Use. Our use and transfer of information received from Google APIs and extension surfaces complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension-transferred user data is not sold, used for personalized advertising, used to determine credit eligibility, or transferred for unrelated purposes. We do not allow humans to read extension-transferred user data except when you give affirmative consent for a specific item, when necessary for security or abuse investigation, when required by law, or when the data has been aggregated and anonymised for internal operations.

16.9 We use extension data only to provide the functionality you request, maintain security and quotas, troubleshoot failures, and improve the reliability of those features. To stop future page-content collection, disable "Allow page-content analysis" in Settings. To stop domain checks and authentication transfer, disable domain intelligence. To remove all Chrome-managed extension data, uninstall the extension. You may also contact us using the details below to exercise applicable data-protection rights.

16.10 Optional entity highlighting. After an entity analysis is returned, you may turn on highlighting for the current page. The extension applies those marks and hover details locally from the existing entity names, types, and trend points. Turning the switch on does not transmit additional page content, and the extension does not store the highlighted page DOM. The marks are removed when you turn the switch off or navigate away.

17How to contact us

If you have any questions regarding this Privacy Policy or the Personal Data we hold about you, please contact us through the contacts provided on the Platform.