TagAudit

Privacy Policy

Last updated 5 August 2026 · Applies to analyticsdom.com and the TagAudit service

1. Who we are

TagAudit is operated by Edwin OÜ, Jüri tee 18f, Karla küla, Rae vald, Harjumaa 75326, Estonia, registration number 14178279 ("we", "us"). For anything in this policy, contact privacy@analyticsdom.com.

For the personal data described below, we are the data controller, except where stated otherwise in section 3.

2. What we collect, and why

Data	Why	Legal basis (GDPR)
Your email address	To sign you in and to send your report link. We use a sign-in link rather than a password, so there is no password to store or leak.	Performance of a contract (Art. 6(1)(b))
The website addresses you ask us to scan	To run the scan you requested.	Performance of a contract
What we observe on that website	Network requests, cookies, tags, dataLayer events and page markup. This is the audit.	Performance of a contract
Your IP address	Rate limiting and abuse prevention only. Not used to profile you.	Legitimate interests (Art. 6(1)(f)) — keeping the service available
Billing details	We never see these. See section 4.	Handled by Paddle as merchant of record

We do not use tracking cookies, we do not run advertising, and we do not sell or share personal data. We think an analytics-audit tool that spied on its own visitors would be difficult to defend.

3. Personal data belonging to other people

This is the part of our service most worth understanding. TagAudit checks whether a website leaks personal data into its tracking. To do that, it has to look at what the site actually transmits — which means a scan can capture personal data belonging to that site's visitors, not to you and not to us.

Where this happens:

We mask values before storing them. An email address found in a tracking payload is stored in a masked form sufficient to prove the exposure, not to identify the person.
We never use it for anything but the report. It is not analysed, enriched, sold, or used to train anything.
The raw capture is deleted on a timer. Every request, cookie and page snapshot behind a report is erased after 30 days — see section 6. The masked evidence shown in the report itself stays as long as the report does, because that is what makes the finding checkable; it is masked precisely so it no longer identifies anyone.

When you ask us to scan a website, you are instructing us to process whatever that site transmits. For that data you are the controller and we act as your processor. You confirm that you own the website or are authorised by its owner to have it scanned. This matters legally and it is not a formality — see our Terms and the Data Processing Agreement, which sets out how we handle it.

4. Payments — Paddle is the seller

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service enquiries and handles returns.

This means you contract with Paddle for the purchase, and Paddle — not us — collects and processes your payment details. We never receive your card number. Paddle's own Buyer Terms and Privacy Notice apply to that part of the transaction.

Paddle passes us the information we need to give you what you bought — your email address, and which plan you are on. We use it only to deliver the service, handle your account, prevent fraud and answer support questions. We do not add you to a marketing list on the strength of a purchase.

5. Who else processes your data

Processor	What for	Where
Paddle	Payments, invoicing, tax, refunds (merchant of record)	UK / EU
Anthropic	Classifying what kind of business a site is, and naming page types. We send a small, fixed set of signals — page title, headline, meta description, language, currency, detected tool names and the URL. We never send the page's HTML, and we never send anything from section 3.	United States
Hetzner	Running the service	the EU
Neo	Sending your sign-in link	the EU

Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses. We keep an up-to-date list of processors; ask and we will send it.

6. How long we keep things

Scan artefacts — the captured requests, cookies and markup behind a report — are kept for 30 days, then deleted. This is the material described in section 3, so we keep it no longer than we need to.
Reports are kept while your account is active, so you can open them again.
Account records are deleted 30 days after you close your account.
Billing records are kept by Paddle for as long as tax law requires.

7. Your rights

Under the GDPR you may ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Write to privacy@analyticsdom.com and we will respond within one month.

You can also complain to your national data protection authority. In Estonia that is the Estonian Data Protection Inspectorate.

If you are in California

We do not sell or share personal information as those terms are used in the CCPA/CPRA, and we do not use it for cross-context behavioural advertising. You may request access or deletion using the same address above, and we will not discriminate against you for asking.

8. Cookies

We set one cookie: a session cookie that keeps you signed in. It is strictly necessary to provide a service you asked for, so under the ePrivacy Directive it does not require consent, and we do not show a cookie banner.

We do not use analytics, advertising or third-party cookies on this site. If that ever changes, we will ask for your consent first, properly — refusing will be exactly as easy as accepting.

9. Changes

If we change this policy materially we will tell account holders by email before it takes effect. The date at the top always reflects the current version.