gtmspy.
Sign inBook a call

Privacy notice

Draft, under review. Last updated 14 October 2026.

Who we are

gtmspy is run by [legal entity, address, company number], the controller of the personal data described here. Contact: hello@gtmspy.io.

What we collect on this website

  • Emails you send us: your address and message, to reply. Kept for [retention period].
  • Calls you book: your name, email and the time you pick, held by our booking provider when you open the calendar and book.
  • Server logs: our host keeps standard request logs (IP address, page, time) for security, for a short period.

This website uses no analytics or advertising tags.

Audits

When you run an audit we store the address you entered and the results. If you give us your email to unlock a report, we keep it with that report so we can send you the results and follow up about them, as the form says. You can ask us to delete it at any time.

Stores we scan

An audit visits a store's public pages like a shopper and records the store's tracking, never its visitors' data. Store owners can ask us to stop scanning their store.

Handover Access

Handover Access (at handover.gtmspy.io) lets a business give its agency access to its marketing accounts from one link. It is separate from the audit: it never scans a website. Agencies use it with their gtmspy account; their clients use it through the link the agency sends.

What we receive from Google

Only after you sign in with Google and agree on Google's consent screen, and only for the products the link asks for:

  • Your email address, to record who gave the access (shown to the agency).
  • The accounts you can see: Google Analytics accounts and properties, Tag Manager accounts and containers, Google Ads accounts and Merchant Center accounts (names, IDs and whether you can add users), to show you what you can share.
  • The changes you choose: we add the agency's email as a user (or link your Google Ads account to the agency's manager account) on the accounts you tick, and nothing else.

Your Google access is used only while you choose. It is kept encrypted in a cookie in your browser for up to 30 minutes and is never stored on our servers; we ask for no long-term (“offline”) access. An agency that connects its own Google account gives us its email address and the list of its Google Ads manager accounts, and we keep an encrypted long-term token for it. It is used only to send manager-link invitations for that agency's links and, with read-only access, to check that the access its clients gave is still in place (so the agency can be told if it is removed). It is deleted when the agency disconnects.

What we receive from Meta (Facebook)

  • Your name, to record who gave the access (shown to the agency), and your Facebook app-scoped ID, which we keep only as a one-way hash so we can act on a deletion request.
  • The Business Portfolios, ad accounts and Pages you can manage, to show you what you can share.
  • The shares you choose: we add the agency's business as a partner on the assets you tick, and nothing else.

Your Facebook access is used only while you choose and is kept encrypted in a cookie in your browser for up to 30 minutes; it is never stored on our servers. An agency that connects Facebook gives us the name and ID of its Business Portfolio; we keep no Facebook access for it.

What we keep, and who sees it

For each link: the agency's name and settings, the products the link asks for, and a log of every share: the product, the account's name and ID, whether it worked, and who gave it. The agency that sent the link sees this log. We keep it while the agency's account exists [retention period to be confirmed]. We host it with Cloudflare. We don't sell it, use it for advertising, or share it with anyone else.

Handover Access's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google or Meta data to train AI models, and people at gtmspy don't read it except to keep the service secure, to comply with the law, or with your permission.

Removing access and deleting data

  • The agency's access lives in the platform, not with us: remove it there (for example Google Analytics Admin, Access management; Tag Manager, User management; Google Ads, Access and security; Meta Business settings, Partners).
  • Remove Handover Access from your Google account at myaccount.google.com/permissions, or from Facebook in Settings, Apps and websites, where you can also send a deletion request.
  • A Facebook deletion request removes your name from every record you made at once (how it works). For anything else, email us.

Your rights

You can ask for a copy of your data, a correction, its deletion, or object to how we use it, by emailing us. You can also complain to the Information Commissioner's Office (ico.org.uk).