Privacy Policy

1. Visitors of gtmsdr.com

When you visit the site we record the page you land on, the referring page, campaign parameters (utm tags, click identifiers) and the pages you go through, in your browser's session storage; they leave your browser only with a form you send or a sign-up you complete. We measure visits with Google Analytics. When you type a domain into the plan field, we keep the domain and the plan built for it.

When you send the contact form, we receive your name, email, company, message and the visit details above, through our lead service.

2. People who use the cabinet

We keep your account details (name, email, sign-in methods), your organisation and its members, the products you add and their settings, and billing details. Card data is held by Stripe; we see only the card's brand, last digits and expiry.

To find and fix problems we record sessions in the cabinet, including what is shown and typed on screen, and we report errors with their technical context. We keep the sign-up's campaign attribution (source, utm tags, click identifier).

3. Prospects, leads and website visitors of our customers

To run a customer's outreach and account-based marketing we process business contact data: names, business email addresses, job titles, employers, public profile links, public posts and company signals, collected from public sources and data providers and verified before use. We record the emails sent, their opens and clicks, replies, and views of shared documents.

On customers' websites that carry our tracking snippet, we record visits and, through an identity provider, the company behind a visit and, in the United States, the person. Leads that fill in a customer's form are answered and, when they tick consent in that form, called back.

Every outreach email carries a way to opt out, which stops further outreach to that address. You can also ask us to delete your data through the contact page.

4. Why we use data, and on what basis

• Providing the service you signed up for: performance of a contract.
• Billing, tax and fraud prevention: legal obligation and legitimate interests.
• Measuring and improving the site and the service, including session recording and error reports: legitimate interests.
• Business-to-business outreach for our customers: our customers' legitimate interests, with an opt-out in every message.
• Calls to leads: the consent given in the form.
• Aggregated, de-identified results across products that never identify a person or a customer: legitimate interests.

5. Who receives data

We use service providers that process data for us under contract:

• Stripe: payments.
• Amazon Web Services (SES): sending and receiving email.
• Cloudflare: website delivery, DNS and security.
• Sentry: error reports and cabinet session recordings.
• Google: Analytics, and Google Ads when you use advertising.
• OpenAI and Anthropic: language models that write and check content.
• Meta, Microsoft, Reddit and LinkedIn: advertising and publishing on their platforms.
• Registrars and DNS providers: sending domains.
• An identity provider: matching website visitors to companies and, in the US, people.
• The CRM, calendar, analytics and social accounts a customer connects.

6. International transfers

Our servers and some providers are outside the European Economic Area, the United Kingdom and Switzerland. Where data leaves those regions we rely on the European Commission's standard contractual clauses or another lawful transfer mechanism.

7. How long we keep data

Account and product data for as long as the account exists, and up to 30 days after cancellation for export. Billing records for as long as tax law requires. Prospect data for as long as the customer's product runs, and opt-outs permanently, so they keep working. Session recordings and error reports for up to 90 days.

8. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your data, to restrict or object to its use, and to withdraw consent. California residents can ask what we collect and ask us to delete it; we do not sell personal data. Write to us through the contact page; we answer within 30 days. You can also complain to your data protection authority.

9. Security

Data travels encrypted, sign-in sessions are bound to your browser's key, and access tokens for connected platforms are stored encrypted. Access inside our team is limited to the people who need it.

10. Children

GTMSDR is a business service and is not meant for anyone under 18.

11. Changes and contact

We update this policy when what we do changes, and show the date of the latest version at the top. Questions and requests: write to us through the contact page at gtmsdr.com/contact.