Privacy Policy
Template — have counsel review. This document is a draft template, not legal advice and not yet in force. Bracketed fields such as [jurisdiction] must be completed and the whole text reviewed by a qualified lawyer before use.
This policy explains how [legal entity name and registered address] ("we") handles personal data when you visit our website or use GTM Engine. For personal data that our customers upload into the Service (for example their leads), the customer is the controller and we process it on their behalf under the Data Processing Addendum.
Data we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email address, password hash, two-factor settings | To create and secure your account |
| Workspace | Workspace name, members and roles, settings, audit log entries (including IP address and browser for sign-ins) | To provide the Service and show owners who did what |
| Billing | Billing email, plan, invoices (card details are handled by our payment provider, not stored by us) | To bill you and meet accounting duties |
| Contact form | Name, work email, company, message | To answer your request |
| Technical | Session cookies, request logs | To keep you signed in and keep the Service secure |
Cookies and similar storage
We use only what the Service needs: a session cookie to keep you signed in, a short-lived cookie during two-factor sign-in, a cookie that remembers your last workspace, and your theme choice in your browser's local storage. We do not use advertising cookies. [Update if analytics are added.]
Legal bases
- Contract: providing the Service you signed up for.
- Legitimate interests: securing the Service, preventing abuse, answering enquiries, improving the product.
- Legal obligation: accounting and tax records.
- Consent: where we ask for it, for example optional emails.
Processors and recipients
We use service providers for hosting and database, transactional email, payment processing, AI models (for the AI features you use), email verification and lead sourcing. A list of sub-processors with their locations is [to be published here] and available on request.
International transfers
Where data is transferred outside the EEA or UK we rely on [adequacy decisions / Standard Contractual Clauses]. [To be completed with the hosting region once decided.]
Retention
Account data is kept while your account exists and deleted within [period] after you close it. Billing records are kept as long as the law requires. Contact-form messages are kept for [period].
Security
See our security page for how data is protected.
Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing, and complain to your data protection authority. If you are a contact in one of our customers' lead lists, we will forward your request to that customer and honour unsubscribe requests immediately.
Contact
Use the contact form. Data protection contact: [name or role and address].