GTM Engineer

This Privacy Policy explains how GTM Engineer ("we", "us", "the service") collects, uses, and protects information when you use our application at gtmengineer.sh.

1. Information we collect

When you sign in with Google, we receive the following from your Google account:

• Name — to display in the application interface.
• Email address — to identify your account and send service-related notifications.
• Profile picture — to display as your avatar (optional).

We also collect content you create within GTM Engineer: project URLs, brand information, generated artifacts (research files, keyword targets, content drafts), and chat messages between you and the AI assistant.

2. How we use Google data

Information obtained through Google Sign-In is used only to:

• Authenticate your account and maintain your session.
• Identify your projects and the artifacts you create.
• Display your name, email, and avatar in the application interface.

We do not access any other Google services, including Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or YouTube. We only request the minimal scopes (openid, email, profile) required for sign-in.

GTM Engineer's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we store and protect data

• Account data and generated artifacts are stored on Google Cloud Platform infrastructure, encrypted at rest.
• Authentication uses signed JSON Web Tokens (JWT) delivered as HttpOnly cookies — your session token is never exposed to JavaScript.
• Connections to GTM Engineer use HTTPS exclusively.

4. Sharing and disclosure

We do not sell, rent, or trade your personal information. We do not share Google user data with third parties, except:

• Cloud infrastructure providers (Google Cloud Platform) acting as data processors under Google's standard terms.
• Anthropic Claude API, which processes the prompts you send to the AI assistant. Anthropic does not retain prompt content for training.
• When required by law or to enforce our Terms of Service.

5. Data retention and deletion

You can delete individual projects and artifacts from within the application. To delete your entire account and all associated data, email us at the contact address below — we will process the deletion within 30 days.

6. Your rights

You have the right to access, correct, export, or delete your personal data. To exercise these rights, contact us at the email address below.

7. Cookies

We use a single HttpOnly authentication cookie to maintain your signed-in session. We do not use third-party tracking cookies or advertising cookies.

8. Children

GTM Engineer is not directed to individuals under 16. We do not knowingly collect data from children.

9. Changes to this policy

We will update this policy as needed. Material changes will be communicated via in-app notification or email to your account address.

10. Contact

Questions about this Privacy Policy or data handling? Email yifan@onvoyage.ai.