Privacy Policy

We collect the following types of information:

Personal Information

• Contact Information: Name, work email address, job title
• Company Information: Company name, industry, size, and domain (derived from your email)

Business Metrics

• Revenue data, deal sizes, sales cycle length
• Team size, win rates, pipeline coverage
• Other GTM metrics you voluntarily provide

Technical Data

• Browser type and version
• Device information and operating system
• IP address (collected and stored in full; see "Visitor Identification" below)
• Pages visited and usage patterns
• Device characteristics (such as screen, graphics, font, time zone, language, and hardware details) that our site combines into a device fingerprint stored in your browser

Visitor Identification Data

We use your IP address to identify the company you are visiting from (company name, domain, industry, size). We do not anonymize your IP address; it is stored so that we can perform and audit this identification.

For visitors located outside the EEA, the UK, and Switzerland, we may also resolve the visit to a named individual, including business name, business email address, job title, and (where available) business phone number, using the third-party providers listed in Section 5. We do not perform person-level identification for visitors in the EEA, UK, or Switzerland. Identification there is limited to company-level (firmographic) data derived from your IP address.

Two of these providers, Warmly and DataMoon, identify a visit in your browser rather than from your IP address. Their scripts work with an identity partner, LiveIntent, which uses a cookie or similar browser identifier to link the visit to a hashed business email address. These scripts do not load for visitors in the EEA, the UK, or Switzerland, or when we cannot tell where you are connecting from. They also do not load on purchase confirmation pages, private links, or pages whose web address contains an access token, a session identifier, or an email address.

How This Depends on Where You Are

• United States: analytics and visitor identification, including the browser-based providers described above, run when you visit our site. Our cookie banner tells you this on your first visit. You can opt out at any time through Cookie Preferences, our Do Not Sell or Share My Personal Information page, or a Global Privacy Control signal.
• EEA, UK, and Switzerland: analytics and identification run only after you consent, and identification is company-level only.
• Everywhere else: analytics and identification run only after you consent.

Marketing cookies (HubSpot) load only after you allow them, in every region. We estimate the country you are connecting from using your IP address, and keep only the resulting region in your browser for the rest of your visit. If we cannot determine it, we apply the consent-first rules and do not load the browser-based identification providers. This estimate can be wrong, for example when you use a VPN.

To turn identification off for your browser, use our Do Not Sell or Share My Personal Information page, or open Cookie Preferences to turn off analytics and identification together. If your browser sends a Global Privacy Control signal, we treat it as the same opt-out: our identification providers, IP-based identification, and device fingerprinting do not run. See Section 8 for your rights, including the right to object and to request deletion.

We use the collected information to:

• Generate your personalized GTM audit analysis
• Research your company to provide relevant recommendations
• Identify the company (and, outside the EEA/UK/Switzerland, the individual) visiting our site so we can follow up with relevant outreach
• Measure how our website is used and which campaigns bring visitors to it
• Send internal alerts to our team via Slack when an identified visitor matches our ideal customer profile or shows high intent
• Process payments for premium features (via Stripe)
• Send transactional emails related to your audit
• Improve our AI models and service quality
• Contact you about product updates (only with your consent)
• Respond to your inquiries and support requests

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data under the following legal bases:

• Consent: For analytics and identification cookies, company-level visitor identification, and marketing cookies and communications
• Contract: To provide the GTM audit service you requested
• Legitimate Interest: To improve our service and prevent fraud

Data Collected Indirectly (GDPR Article 14)

Where we identify an individual without collecting their data directly from them (for example, by enriching a website visit), the personal data, such as name, business email, job title, and company, is obtained from the third-party sources named in Section 5 (including IPinfo/ipapi, Amplemarket, Warmly, DataMoon, and LiveIntent, which match a browser identifier to a hashed business email address and supply associated details such as name, employer, and job title), as well as those providers' own public and licensed datasets.

You have the right to object to this processing and to request erasure of personal data we hold about you (see Section 8), and you may use our Do Not Sell or Share My Personal Information page to turn identification off for your browser.

4. Data Storage & Security

Your data is stored securely using industry-standard encryption (AES-256 at rest, TLS 1.3 in transit). We use Supabase for our database, which provides enterprise-grade security and is SOC 2 Type II certified.

We retain personal data only as long as needed for the purposes described in this policy. Retention periods by category are:

• Audit data and account information: up to 24 months from your last activity, so you can return to your results.
• Visitor identification & enrichment data (company, and where applicable individual contact details derived from your IP): up to 24 months from your last activity. The raw enrichment payloads and raw IP records we receive from our providers are purged sooner, typically within 90 days.
• Billing and transaction records: retained as required by tax and accounting law (typically up to 7 years).
• Analytics and usage data: up to 24 months.
• Browser identifiers set by our identification providers: up to 2 years for LiveIntent cookies and up to 90 days for the DataMoon advertising click identifier, unless you opt out, withdraw consent, or clear them sooner. When you opt out or withdraw consent on our site, we delete these identifiers from your browser.
• Your cookie choices: a consent you give in our cookie banner lasts 180 days, after which we ask again. An opt-out stays in place until you change it.

You may request deletion of your data at any time (see Section 8).

5. Third-Party Services

We share data with, or receive data from, the following processors and recipients to provide our service:

• Supabase: Database hosting and authentication
• Stripe: Secure, PCI-DSS compliant payment processing
• ipify: Returns your public IP address to our site so that we can run IP-based company identification
• IPinfo / ipapi: IP geolocation, used to map your IP to a company domain and location
• Amplemarket: Company and (outside the EEA/UK/Switzerland) person-level enrichment, deriving contact details such as name, business email, and job title
• Warmly: Website visitor identification and intent data, including person-level identification outside the EEA/UK/Switzerland. Its script runs in your browser and works with LiveIntent
• DataMoon: Website visitor identification, including person-level identification outside the EEA/UK/Switzerland. It receives the hashed business email address LiveIntent matches to your browser, the pages you visit during your session, the page that referred you, and any advertising click identifier (such as a Meta click ID) in the link you arrived on
• LiveIntent: Identity matching used by Warmly and DataMoon. It receives the address of the page you are viewing and an identifier stored in your browser, may read advertising identifiers that other websites have already stored in your browser, and returns a hashed business email address associated with that browser when it has one
• HubSpot: CRM and contact management, where identified visitor and lead records are stored
• Slack: Internal alerts to our team about identified, ICP-matched, or high-intent visitors
• Google Analytics (loaded through Google Tag Manager) and Ahrefs Web Analytics: Site usage analytics
• AI Services: Company research and analysis generation (data is not retained by AI providers)

These services have their own privacy policies and data protection measures.

We use cookies and similar technologies, such as localStorage and sessionStorage in your browser:

Essential Cookies

Required for the website to function. These cannot be disabled.

• Session management and authentication
• Form submissions and CSRF protection
• Cookie preferences, your opt-out choice, and the region we estimated for your visit

Analytics & Identification Cookies

Help us understand how visitors use our website and identify the companies, and outside the EEA/UK/Switzerland the people, who visit. In the United States these run when you visit unless you opt out; everywhere else they run only after you consent.

• Page views and user journey tracking
• Feature usage analytics
• A visitor identifier and a device fingerprint stored in your browser
• The campaign, referring site, and landing page that brought you to our site, kept in your browser so a form you submit can be attributed to it
• Visitor identification cookies and browser identifiers set by our identification providers (Warmly, DataMoon, LiveIntent); see the Cookie Policy

Marketing Cookies

Set by HubSpot's marketing script. Requires your consent in every region, and does not load when your browser sends a Global Privacy Control signal.

You can change your choices at any time in Cookie Preferences (also linked in the footer of every page) or through your browser settings. Our Cookie Policy lists each cookie and how long it lasts.

7. Affiliate Disclosure

When you click a partner or affiliate link on our site, we record the click (the partner, the page, a session identifier, and on our server your IP address) so we can measure referrals.

Depending on your location, you may have the following rights:

GDPR Rights (EU/EEA/UK)

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("Right to be Forgotten")
• Portability: Receive your data in a structured format
• Objection: Object to processing based on legitimate interest
• Restrict Processing: Request limitation of processing
• Withdraw Consent: Withdraw consent at any time

CCPA/CPRA Rights (California)

• Know: Right to know what personal information is collected
• Delete: Right to delete personal information
• Correct: Right to correct inaccurate personal information
• Opt-Out: Right to opt out of the "sale" or "sharing" of personal information
• Limit: Right to limit use of sensitive personal information
• Non-Discrimination: Right to non-discrimination for exercising rights

"Sale" and "sharing" of personal information. Under the CCPA/CPRA, our practice of identifying website visitors and disclosing visitor and contact data to enrichment and advertising partners (such as Amplemarket, Warmly, DataMoon, LiveIntent, and HubSpot) may be treated as a "sale" or "sharing" of personal information, even though we do not receive money for it. You can opt out in any of these ways:

• Our Do Not Sell or Share My Personal Information page, which turns identification off for your browser
• Cookie Preferences, by choosing Opt out or turning off Analytics & identification
• A Global Privacy Control signal from your browser

We honor Global Privacy Control as a request to opt out of sale and sharing for that browser: our visitor identification providers, IP-based identification, and device fingerprinting do not run, and HubSpot's marketing script does not load. For a browser sending this signal, analytics loads only if you allow it in our cookie banner or Cookie Preferences. Because these choices are stored in your browser, they apply to the browser and device you make them on.

Notice at collection. When you visit our website, we collect the categories of personal information described in Section 1: identifiers (including IP address, browser and cookie identifiers, and hashed business email addresses), professional and employment information (such as job title and employer), and internet activity (such as pages viewed and referring pages). We use them for the purposes described in Section 2 and retain them for the periods described in Section 4. We may sell or share identifiers, professional information, and internet activity with the providers named above. In the United States, this collection begins when you visit, and you can opt out at any time using the methods above. We do not knowingly sell or share the personal information of consumers under 16.

9. Data Transfers

Your data may be transferred to and processed in countries outside your residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

10. Children's Privacy

Our service is intended for business professionals and is not directed at individuals under 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last Updated" date and, for material changes, by email or prominent notice on our website.