Privacy Policy | GTM Signal Studio

Who we are

GTM Signal Studio is operated by Oloye Adeosun, a sole trader based in Kent, United Kingdom. Our website is gtmsignalstudio.com.

For data protection enquiries, contact us at thegtmsignalstudio@gmail.com.

What data we collect

We collect the minimum data necessary to provide our services:

Email address when you subscribe to our newsletter or download a resource (processed by Beehiiv).
Website analytics via Google Analytics 4 (GA4). This includes pages visited, time on site, referral source, and device type. GA4 uses first-party cookies and does not collect personally identifiable information by default.
Name, email, and company details when you request a GTM audit or AI Visibility audit.
Correspondence when you email or message us directly.

How we use your data

To deliver the newsletter you subscribed to.
To deliver audit reports you requested.
To analyse website usage and improve our content.
To respond to your enquiries.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Legal basis for processing (GDPR)

Consent when you subscribe to our newsletter, submit your email for a resource, or accept analytics cookies via our cookie banner.
Legitimate interest for contacting businesses about our services (outreach to corporate subscribers only, supported by a documented Legitimate Interest Assessment).
Contract when you engage us for audit or consulting services.

Third-party services

We use the following third-party services that may process your data:

Beehiiv for newsletter delivery and email subscription management. Stores your email address and engagement data (opens, clicks). Data processed in the US.
Google Analytics 4 for website analytics. Collects anonymised usage data (pages visited, time on site, device type, referral source). IP addresses are anonymised. Only active if you consent via our cookie banner.
Vercel for website hosting. May process access logs including IP addresses for security purposes.
Supabase for database and content storage. Stores blog content and resource metadata. Does not store personal data beyond what you submit.
Google Workspace for email communication. Processes correspondence when you email us directly.
Calendly for appointment scheduling. When you book a call, Calendly processes your name, email, and selected time slot.
Microsoft Clarity for website analytics and heatmaps. Records anonymised session replays, clicks, and scroll behaviour to help us improve the user experience. Only active if you consent via our cookie banner. Data processed in the US.

Each service has its own privacy policy. We encourage you to review them. We do not use any cold email platforms or share subscriber data with outbound tools.

Cookies

We use three categories of cookies. Analytics and functional cookies are only set after you provide explicit consent via our cookie banner.

Essential cookies — Required for the website to function. Cannot be disabled. Includes security tokens and session management.
Analytics cookies — Google Analytics 4 and Microsoft Clarity cookies that help us understand how visitors use the site. Anonymised IP. Session replays are anonymised. Only active after consent.
Functional cookies — Remember your preferences (cookie consent choice, display settings). Improve your experience on return visits.

You can manage your cookie preferences at any time by clicking "Cookie Settings" in our footer. For a detailed list of every cookie we use, see our Cookie Policy.

Your rights

Under GDPR, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data.
Withdraw consent at any time.
Object to processing based on legitimate interest.
Lodge a complaint with the ICO (Information Commissioner's Office) if you believe your rights have been infringed.

To exercise any of these rights, email thegtmsignalstudio@gmail.com.

International data transfers

Some of our third-party services (Beehiiv, Google Analytics, Vercel, Supabase, Calendly, Microsoft Clarity) process data in the United States. These transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) as required under UK GDPR. We only use services that provide adequate data protection safeguards.

Data security

We implement appropriate technical and organisational measures to protect your personal data, including: HTTPS encryption on all pages, Content Security Policy (CSP) headers, secure HTTP headers (HSTS, X-Frame-Options, X-Content-Type-Options), rate limiting on API endpoints, and restricted access to databases and storage. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your data.

Chrome extensions

GTM Signal Studio publishes free, open-source Chrome extensions (such as LinkedIn Comment Assist). These extensions:

Run entirely in your browser. No data is sent to GTM Signal Studio servers.
Send page content (post text, article text) directly from your browser to the AI provider you select (Anthropic or OpenAI) using your own API key.
Store your API key and preferences locally in Chrome's sync storage. We never have access to your API keys.
Do not collect, store, or transmit any personal data, LinkedIn data, browsing history, or analytics.

The extensions are open source. You can review the full source code on GitHub.

Data retention

Newsletter subscriber data is retained for as long as you remain subscribed. You can unsubscribe at any time via the link in any email. Audit and consulting data is retained for 12 months after project completion, then deleted. Analytics data is retained according to Google Analytics default settings (14 months).

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. We will not reduce your rights under this policy without your explicit consent.