Privacy Policy

This policy explains what [Company name] ("we") collects when you use GTMorganic, why, and your rights. We follow the EU and UK GDPR and Israel's Protection of Privacy Law, including Amendment 13.

Who is responsible

• For your account data (you, your team, your product information): we are the controller.
• For your visitors' data collected through tracking links, published-page pixels and the optional snippet: you are the controller and we are your processor under the DPA.

What we collect about you

• Account: email, name if given, timezone (from your browser), sign-in method.
• Product data: your website URL and the public content we read from it, your Brain, confirm answers, drafts, plans and settings.
• Community usernames you give us (for example your Hacker News username) so we can find and verify your replies.
• Billing: our Merchant of Record processes payment details; we receive your plan, status and billing country, never full card numbers.
• Usage: product analytics and error reports (PostHog, Sentry), and an internal usage ledger for plan limits.
• Optional connections: read-only Google Search Console data; a read-only Stripe restricted key (encrypted); publishing tokens for WordPress, Webflow, Ghost or our GitHub App (encrypted); Slack or Discord webhooks.

What we collect about your visitors (as processor)

• Tracking-link clicks and page views of pages we published: time, referrer domain, and a daily hash of IP address and user agent with a salt that changes every day. We never store raw IP addresses or user agents and we set no cookies on your visitors.
• Optional snippet: referrer, UTM tags, landing path and signup events. In the EU, EEA and UK it runs only after the visitor's consent (you call go.consent(true)), otherwise only the referrer is sent. Data is held in the browser for the session only. If you call go.identify(email), we store only a hash of the email.
• Optional Stripe: payment events read with your restricted key, matched by email hash.

Things we never store

• Results from the Brave Search API. Live search queries are sent to Brave at the moment you open the panel; results are shown in your browser and not saved by us.
• Text you paste into "Score a thread". We keep only the link, score, reason and our draft.

Who we share data with

Sub-processors listed on the Sub-processors page, only to run the Service. Search queries built from your Brain (problem phrases, competitor names, category) are sent to Brave Search; AI questions are sent to OpenAI, Perplexity and (on Pro) Google Gemini; drafts and analysis use Anthropic's API. We do not sell personal data.

International transfers

Some sub-processors are in the United States. We rely on Standard Contractual Clauses or adequacy decisions.

Retention

Account data for as long as your account exists. Proof events for 25 months. After a deletion request, workspace data is deleted within 30 days; backups roll off within a further 30 days.

Your rights

Access, correction, deletion, export, restriction and objection. Use Export and Delete in Settings, or email mohamdeya123@gmail.com. You can complain to your data protection authority, or in Israel to the Privacy Protection Authority.

Security

Encryption in transit and at rest, encrypted secrets, row-level security on every table, least-privilege access.

Contact

mohamdeya123@gmail.com

Last updated November 12, 2026.