TagAudit

Privacy Policy

Last updated 6 October 2026 · Applies to analyticsdom.com and the TagAudit service

1. Who we are

TagAudit is operated by Edwin OÜ, Jüri tee 18f, Karla küla, Rae vald, Harjumaa 75326, Estonia, registration number 14178279 ("we", "us"). For anything in this policy, contact privacy@analyticsdom.com.

For the personal data described below, we are the data controller, except where stated otherwise in section 3.

2. What we collect, and why

Data	Why	Legal basis (GDPR)
Your email address	To sign you in and to send your report link. We use a sign-in link rather than a password, so there is no password to store or leak.	Performance of a contract (Art. 6(1)(b))
Your email address, only if you tick the box on the scan form	To ask you questions about the product and to send you offers. The box is unticked unless you tick it, and a scan never needs it.	Your consent (Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in any such email, or by writing to privacy@analyticsdom.com. We have not sent any of these emails yet; every one we send will carry that link.
The website addresses you ask us to scan	To run the scan you requested.	Performance of a contract
What we observe on that website	Network requests, cookies, tags, dataLayer events and page markup. This is the audit.	Performance of a contract
Your IP address	Rate limiting and abuse prevention; and, only if you have accepted analytics on our site, to derive the visitor identifier described under Site analytics.	Legitimate interests (Art. 6(1)(f)) — keeping the service available
Site analytics	If you accept analytics on our site, we record the pages you view and the actions you take, under a visitor identifier derived from your IP address and browser user agent. This runs on our own server (stats.analyticsdom.com); nothing is sent to a third party.	Your consent (Art. 6(1)(a))
Billing details	We never see these. See section 4.	Handled by Paddle as merchant of record

We do not use tracking cookies, we do not run advertising, and we do not sell or share personal data. We think an analytics-audit tool that spied on its own visitors would be difficult to defend.

3. Personal data belonging to other people

This is the part of our service most worth understanding. TagAudit checks whether a website leaks personal data into its tracking. To do that, it has to look at what the site actually transmits — which means a scan can capture personal data belonging to that site's visitors, not to you and not to us.

Where this happens:

We mask values before storing them. An email address found in a tracking payload is stored in a masked form sufficient to prove the exposure, not to identify the person.
We never use it for anything but the report. It is not analysed, enriched, sold, or used to train anything.
The raw capture is deleted on a timer. Every request, cookie and page snapshot behind a report is erased after 30 days — see section 6. The masked evidence shown in the report itself stays as long as the report does, because that is what makes the finding checkable; it is masked precisely so it no longer identifies anyone.

When you ask us to scan a website, you are instructing us to process whatever that site transmits. For that data you are the controller and we act as your processor. You confirm that you own the website or are authorised by its owner to have it scanned. This matters legally and it is not a formality — see our Terms and the Data Processing Agreement, which sets out how we handle it.

4. Payments — Paddle is the seller

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

This means you contract with Paddle for the purchase, and Paddle — not us — collects and processes your payment details. We never receive your card number. Paddle's own Buyer Terms and Privacy Notice apply to that part of the transaction.

Paddle passes us the information we need to give you what you bought — your email address, and which plan you are on. We use it only to deliver the service, handle your account, prevent fraud and answer support questions. We do not add you to a marketing list on the strength of a purchase.

5. Who else processes your data

Processor	What for	Where
Paddle	Payments, invoicing, tax, refunds (merchant of record)	UK / EU
Anthropic	Classifying what kind of business a site is, and naming page types. We send a small, fixed set of signals — page title, headline, meta description, language, currency, detected tool names and the URL. We never send the page's HTML, and we never send anything from section 3.	United States
Hetzner	Running the service	the EU
Neo	Sending your sign-in link	the EU
Resend	Sending the emails our service sends you: your sign-in link, your report link, and a notice if your scan fails	United States

Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses. We keep an up-to-date list of processors; ask and we will send it.

6. How long we keep things

Scan artefacts — the captured requests, cookies and markup behind a report, and any container file you attach to a scan — are kept for 30 days, then deleted. This is the material described in section 3, so we keep it no longer than we need to. A report keeps a summary of an attached container — its tag names and IDs — and that summary follows the rule for reports.
A Pro scan you have asked for but not yet started — the website, which account asked if you are signed in, and any GTM container file you attached — is kept for 24 hours so you can start it, and deleted within a day after that if you do not. We do not store an email address with it. When the scan starts, the container file becomes part of the scan and follows the rule for scan artefacts above. The request itself is then kept for 7 days after the scan starts or is paid for, so that a delayed payment confirmation cannot start a second scan, and then deleted.
What you enter on the scan form — your email address, the website you asked us to scan and which scan you chose — is kept on our list of scan requests for 30 days, then deleted from it. The report itself also names the website, and follows the rule for reports below. If you ticked the box to hear from us, we also keep your email address, separately, with a record of what you agreed to and when, until you withdraw, and delete it when you do. The address on an account, if you have one, is an account record and follows the rule below.
Your IP address: when you run a free scan, we store your IP address with a count of how much automated analysis it has used that day, to limit free use. That record is replaced the next time a free scan is counted on a later day; until then it stays.
Reports are kept so you can open them again. We do not yet delete reports on a timer, including reports from scans run without an account; to have one deleted, write to us (section 7).
When you are signed in, each scan you ask for is recorded against your account, so we know which reports are yours. Each record is kept only as long as the report it points to, and is removed after that report is deleted. If you ask us to close your account, it is deleted with your account records (below).
Account records are deleted within 30 days of a request to close your account. There is no self-serve way to close an account yet, so the request is an email to the address in section 7.
Billing records are kept by Paddle for as long as tax law requires.

7. Your rights

Under the GDPR you may ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Write to privacy@analyticsdom.com and we will respond within one month.

To have the scans, reports and email address we hold for you deleted, write to privacy@analyticsdom.com from the address you used. There is no self-serve delete button yet: we delete them by hand within 30 days of your request and confirm by email.

You can also complain to your national data protection authority. In Estonia that is the Estonian Data Protection Inspectorate.

If you are in California

We do not sell or share personal information as those terms are used in the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. You may request access or deletion using the same address above, and we will not discriminate against you for asking.

8. Cookies

We set one cookie: a session cookie that keeps you signed in. It is strictly necessary to provide a service you asked for, so under the ePrivacy Directive it does not require consent. We show a consent card; analytics runs only after you accept it, and declining or ignoring the card means no analytics data is collected.

We do not use advertising or third-party cookies on this site. If that ever changes, we will ask for your consent first, properly — refusing will be exactly as easy as accepting.

9. Changes

If we change this policy materially we will tell account holders by email before it takes effect. The date at the top always reflects the current version.