GTM Utility - Privacy Policy

This page contains the privacy information for GTM Utility (gtmutility.com) and, separately, for the Google Analytics Automations app for monday.com. Each section applies only to the product it describes and has its own date.

If you have questions or need more information, write to us at gtmutility@gmail.com.

Table of Contents

GTM Utility Platform Privacy Policy

Last updated: October 8, 2026

Hi! This notice explains in plain language which personal data GTM Utility (gtmutility.com) handles when you use it, why we do it, and what choices you have. If anything is unclear, write to us at gtmutility@gmail.com and we will gladly help.

The short version

  • We use your Google account to sign you in and to show your Google Tag Manager containers. We do not keep a copy of your container contents.
  • We use Google Tag Manager and Google Analytics to learn how GTM Utility is used, so we can fix things and build what people need. Where the law asks for it (EEA, UK, Switzerland), this only starts after you allow analytics in our cookie banner.
  • If you allow advertising, we also use Google Ads to see whether our ads work and to show them to people who may find GTM Utility useful.
  • Your Tag Manager and Analytics data is never used for advertising. If you allow advertising, we may share a scrambled (hashed) version of your Google account email when you sign in or subscribe, so we can tell whether our ads work.
  • You stay in control: you can change your cookie choices at any time, withdraw Google access, and ask us to delete your data.

Who we are

GTM Utility is run by Igors Smirnovs (“we”, “us”). We are the controller of the personal data described here under the EU General Data Protection Regulation (GDPR). For any privacy question or request, contact us at gtmutility@gmail.com.

What GTM Utility does

GTM Utility turns your Google Tag Manager setup into a visual flowchart of tags, triggers and variables, and lets you schedule the publishing of your containers.

Signing in with Google

You sign in with your Google account. Google shares with us your email address, name and profile picture. We store them together with an internal account ID, so we can create and recognise your account. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

We also keep the access permission (token) you grant to Google, so that GTM Utility can work with your Google data on your behalf. It is stored in our database at Google Cloud, which is encrypted at rest. The permissions we ask for:

  • Email, profile and basic account info: to sign you in.
  • Google Tag Manager (read): to show your containers, versions and workspaces as a flowchart.
  • Only if you use scheduled publishing: Google Tag Manager publish and edit permissions, to publish the version you picked at the time you chose; and Google Analytics read and edit permissions, to list your properties and add a note when a version goes live.

We use the email we have on file to run your account, to send you service messages about it (for example, about billing or a failed scheduled publish), and to block access in case of serious misuse of the service (our legitimate interest, Art. 6(1)(f) GDPR). If you allow advertising in our cookie banner, we also use it to measure our ads, as described under Advertising (your consent, Art. 6(1)(a) GDPR).

How we treat your Google data

GTM Utility’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use your Google Tag Manager and Google Analytics data only to provide and improve the features you see in the app. We do not sell it, we do not use it for advertising and we do not share it with advertising partners. Your Google account email is the one exception, and only if you allow advertising (see Advertising below). People at GTM Utility only look at your Google data with your consent, where needed for security or support, or to follow the law.

We fetch your container data from Google when you open it, to draw the flowchart in your browser, and we do not keep a copy. JSON files you load on the sign-in page are processed in your browser and are not uploaded.

Withdrawing Google access

You can withdraw access in the menu of the app or in your Google account at https://myaccount.google.com/permissions. You can also ask us to delete your account and the data stored with it.

Scheduled publishing

If you schedule a publish, we store your account ID, the container, workspace and version involved, the publishing time, the Google Analytics properties you picked for notes, and the result (including the reason if it failed). This is needed to do what you asked (Art. 6(1)(b) GDPR).

Subscriptions and payments

Paid plans are handled by Stripe. You enter your payment and billing details (card, billing address, tax ID) on Stripe’s checkout page. We never see your card number. We send Stripe your account email to create your customer record, and we keep your Stripe customer ID, plan, status and billing period. Stripe is responsible for its own obligations, such as fraud prevention and financial regulation. Legal basis: performing your subscription contract, and tax and accounting law (Art. 6(1)(b) and (c) GDPR).

If an account admin adds you to their subscription, we store your email address so you get access. Admins can remove you, and you can remove yourself.

Feedback and support

If you send us feedback, we store your message, the reason you selected and, if you give one, your email so we can reply. We use it only to answer you and to improve GTM Utility (legitimate interest, Art. 6(1)(f) GDPR). Please do not include passwords or other sensitive details in your message.

Cookies and your choices

When you first visit, a banner lets you choose Accept all, Deny all or Settings. In Settings you can switch analytics (Google Tag Manager and Google Analytics, including Google signals) and advertising (Google Ads) on or off separately. Accept all turns both on and Deny all keeps both off. Saying no is as easy as saying yes, and GTM Utility works the same either way. In the EEA, UK and Switzerland, we set nothing beyond what is strictly necessary until you choose. You can change or withdraw your choice at any time through “Cookie settings”. Withdrawing does not affect what happened before. You can also block cookies in your browser settings.

Strictly necessary storage covers your sign-in session, your account ID in your browser, and your cookie choice itself. Legal basis: it is needed to provide the service you asked for.

Google Tag Manager and Google Analytics

We use Google Tag Manager to manage the measurement and advertising tags of GTM Utility, and Google Analytics 4 to understand how the tool is used: which screens are opened, which features are used, how many containers, versions or tags are involved (counts only, never names or contents), your browser and device, approximate location, and errors. When you are signed in, we add our internal account ID, never your name, so we can see usage across visits and devices. Your email is covered under user-provided data below. Measurements first go to a server endpoint on our own domain (action.gtmutility.com) and from there to Google.

Google signals are switched on. If you allowed analytics and advertising, and you are signed in to a Google account with ads personalisation turned on, Google can link this visit to your Google account, which gives us cross-device reports and lets us build audiences of people who visited us. User-provided data is used too: if you allowed analytics and advertising, we may send your Google account email to Google Analytics when you sign in or subscribe, to improve cross-device and conversion reporting. Your browser sends it to our own server endpoint, which hashes it before passing it on to Google. Google describes how it handles data from sites that use its services here. You can manage ads personalisation in your Google Ads settings and opt out of Google Analytics with the browser add-on.

Google Consent Mode makes our Google tags follow your choice. If you allow analytics, Google Analytics can use cookies. Legal basis: your consent (Art. 6(1)(a) GDPR). If you do not, the tags store no cookies or identifiers on your device, but they still send a few basic signals (for example that a page was opened, your browser type and approximate region). Google uses them for aggregated statistics and for modelling. We do this based on our legitimate interest in understanding overall usage and measuring ads in aggregate (Art. 6(1)(f) GDPR), and you can object at any time.

Advertising

We may advertise GTM Utility with Google Ads. Its tags run on our public sign-in page, and a few result events (a sign-up, a subscription) are sent to Google Ads so we can tell which ads work. Apart from those result events, its tags do not run inside the signed-in app, and it never receives container data.

If you allowed advertising, we may share with Google Ads: technical data from your browser (page, time, browser and device, IP address, cookie and ad-click IDs), the result event and, for a purchase, its value. We may also share a hashed (SHA-256) version of your Google account email when you sign in or subscribe. Google can match a hash to its own account holders, so it is still personal data. We use it for Google Ads enhanced conversions, to measure ads, and to show or exclude ads for people who match. We do not use your name, or your Google Tag Manager or Analytics data, for advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR). In the EEA, UK and Switzerland this is off until you allow advertising in the cookie banner, and you can withdraw it any time. Google uses the data for its own purposes under its own privacy policy. You can also manage ads in your Google Ads settings or at youronlinechoices.com.

Who else receives your data

  • Google (sign-in, Firebase and Google Cloud hosting, Tag Manager and Analytics APIs, Google Analytics, Google Ads) and Stripe, to run the service.
  • Authorities, where the law requires it.

We do not sell your data to data brokers.

Transfers outside the EU

Some of these providers are based in, or process data in, the United States or other countries outside the EEA. We rely on the EU-US Data Privacy Framework for certified providers, or on the EU Standard Contractual Clauses with additional safeguards. You can ask us for details.

How long we keep data

  • Account and Google permission: until you withdraw access or ask us to delete your account.
  • Scheduled publishing records: as long as your account exists, so you can see your publishing history.
  • Payment and billing records: as long as the law requires (in Germany, up to 10 years).
  • Feedback and support messages: as long as needed to handle your request and any follow-up.
  • Google Analytics data: 14 months. Analytics cookies last up to 2 years. Google keeps advertising data under its own policies.

Your rights

You can ask us for access to your data, correction, deletion, restriction of processing and a copy in a portable format. You can object at any time to processing based on our legitimate interests, and withdraw consent at any time. Just write to gtmutility@gmail.com and we will reply within one month. You also have the right to complain to a data protection authority, for example where you live or work, or where we are based. We do not make decisions about you based solely on automated processing. Sharing your data with us is voluntary, but without an account and the data above we cannot provide the service.

Children

GTM Utility is for people aged 18 and over, and we do not knowingly collect data from children.

Changes

When we change this notice we update the date above. If a change needs your consent, we will ask you again.

Google Analytics Automations on monday.com - App Privacy Policy

Effective Date: September 9, 2025

This section describes the privacy practices specific to the Google Analytics Automations app (“the App”), developed by GTM Utility for the monday.com marketplace.

The App enables monday.com users to create automations that send annotations and events to Google Analytics properties.

1. Data We Collect and Use

1.1 Authentication Data

  • Users must sign in with a Google account holding Editor access in the GA property.
  • During sign-in, an access token is obtained from Google.
  • Tokens are stored in monday.com Secure Storage and used only for automations.
  • Tokens are never logged, manually accessed, or shared. Expired tokens are deleted automatically.

1.2 Board and User Data

  • The App accesses monday.com board data (e.g., status changes, column values) to trigger annotations and events.
  • User profile data may be used to identify token owners and automation creators.

1.3 Templates

  • Event and annotation templates are stored in monday.com storage.
  • Templates may contain fixed values or references to board columns.

1.4 Subscription Data

  • An external database stores only the monday.com account ID for subscription management.

1.5 App Installation and Usage Data

  • We may collect installation and usage data (e.g., which accounts installed the App, activity metadata).
  • Used for operations, service monitoring, adoption tracking, and compliance.
  • May also be used for communications, such as product updates or marketing campaigns.

2. Data Retention

  • Templates Upon de-authorization, deactivation, uninstallation, or termination of an App by monday.com or an end-user, all End User Data will be permanently deleted within 10 days.
  • Google tokens and monday.com tokens are retained only while valid and necessary for automation. Invalid or expired tokens are deleted automatically.
  • App installation and usage data is retained for as long as necessary to provide the App and communication services, or until you opt out where applicable.
  • Data may also be deleted upon user request.

3. Data Sharing and Transfers

  • We do not sell, rent, or share user data with third parties.
  • Data is transmitted only between monday.com, Google Analytics, and the App to fulfill requested automations.
  • Outside monday.com Secure Storage, only account IDs and installation/usage data may be stored externally.

4. Security

  • Tokens and templates are stored in monday.com Secure Storage.
  • Subscription account IDs are stored in an external database with restricted access.
  • Tokens are inaccessible beyond automation use and never logged.
  • Installation and usage data is stored securely and used only for operational/communication purposes.

5. User Responsibilities

  • monday.com account holders are responsible for board data, including client data.
  • By using the App, users confirm they have the right to process and connect this data to GA.

6. Children’s Privacy

This App is intended for business use only and is not directed at children under 13 (or 16 in the EU).

  • Data is processed to provide automation features and support operational needs.
  • No sensitive personal data is collected.
  • Legal bases include:
    • User consent (app installation, Google sign-in).
    • Contractual necessity (delivering the App).
    • Legitimate interest (improving services, operational communications).
  • Users may request deletion of subscription, usage data, or templates.

8. Changes to this Policy

We may update this policy as necessary. Updates will be posted on the monday.com marketplace listing or via release notes. Continued use of the App constitutes acceptance.

9. Contact Us

If you have questions regarding this Privacy Policy or your data, contact us at:

GTM Utility
📧 Email: gtmutility@gmail.com
🌍 Global availability via the monday.com marketplace