Back to Dr.GTM

Privacy Policy & Data Notice

Last Updated: October 7, 2026 | Effective Immediately

1. Overview & Data Philosophy

Dr.GTM ("we", "our", "us") provides automated container auditing, validation, and monitoring for Google Tag Manager (GTM). We process your information strictly to analyze your GTM containers, generate diagnostic scores, deliver alert reports, and manage your credit balance. We do not sell your personal data or container configurations to any third party.

2. Information We Collect & How We Obtain It

  • Google Account Information: When you log in via Google OAuth, we receive your email address, display name, and unique Google account identifier.
  • Google Tag Manager Configuration Data: When you connect a container, we fetch container structures, tag definitions, triggers, variables, and workspace commit states via Google Tag Manager REST APIs.
  • Live Monitoring Event Logs: If you install the Dr.GTM monitor tag, we record live event pings (container ID, tag ID, event name, timestamp, and HTTP referrer) to detect dead or non-firing tags.
  • Payment & Invoicing Information: When you purchase credit packs, payments are processed directly by Stripe Inc. We store order IDs, credit pack quantities, transaction amounts, currency, and Stripe receipt URLs. We never store credit card numbers.

3. Data Encryption & Security Safeguards

We implement defense-in-depth security controls to safeguard your data:

  • Encryption at Rest: Google OAuth refresh tokens are encrypted at rest using AES-256-GCM with authenticated additional data (AAD).
  • Encryption in Transit: All web traffic and API calls are encrypted using TLS 1.3 with HSTS enabled.
  • Database Row-Level Security: Database queries are constrained via Row-Level Security (RLS) policies and session email verification.

4. Google User Data: How We Use It and Who Receives It

Dr.GTM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

  • tagmanager.readonly (requested at sign-in): we read your containers, tags, triggers, variables and versions to audit them and show you the results.
  • tagmanager.edit.containers (requested only when you first choose Apply): we create a new draft workspace and write the fixes you confirmed. We never publish a container.
  • tagmanager.manage.users (requested only when you tick "Include user access" on an audit export): we read the email addresses and roles of people with access to the containers you are exporting and write them into the file you download. We never add, remove or change Tag Manager users.

We do not sell, share, transfer or disclose Google user data to anyone, with these exceptions only: (a) the infrastructure that runs Dr.GTM (our own servers and database, which are operated by us and store the data only on your behalf); (b) where required by law or to protect against fraud, abuse or security incidents; and (c) if Dr.GTM is acquired, in which case the same commitments continue to apply. Google user data is not used for advertising, is not read by people except where you ask for support or where needed for security or to comply with law, and is not used to develop, improve or train generalized AI or machine-learning models.

5. Other Service Providers

To operate the service we send limited, non-Google-API data to these providers:

  • Google (sign-in and Tag Manager API): authentication and retrieval of the containers you choose to audit.
  • Stripe Inc.: receives your email address and the order details to take payment and send a receipt. It never receives your Tag Manager data.
  • Resend Inc.: receives your email address and the text of the alert or report email you asked us to send. Those emails summarise audit results (for example a container name and a score).

6. Your Rights & Data Erasure (GDPR / CCPA)

You retain full control over your data. You may exercise the following rights at any time:

  • Right to Access: You can export audit reports and project history from the dashboard.
  • Right to Erasure (Account Deletion): You can delete your account and remove all stored OAuth tokens, audit projects, and event history directly via your account settings or by making a DELETE /api/account/delete request.
  • Right to Revoke Access: You can revoke Dr.GTM's access to your Google Account at any time via Google Security Settings.

7. Contact Us

If you have questions regarding this Privacy Policy or your personal data, please contact our privacy lead at support@bigab.dev.