This page is maintained by TagCoPilot to explain how we handle data in the TagCoPilot service. It describes our current practices and controls; it is not a certification, legal compliance statement, or independent audit report.
Privacy Policy
Last updated: 27 July 2026
1. Who we are
This service is operated by TagCoPilot.io (“TagCoPilot”, “we”, “us”). For privacy questions, contact us at info@tagcopilot.io.
2. What we collect
Account data. When you register or sign in, we receive your email address, name, and profile identifier from your chosen sign-in provider (Google, email magic-link, or other supported providers). We use this to create your account and authenticate you on return visits.
Free audit data. You may enter any public website URL to receive a free audit. We store the URL, the scan date, the results we observed, and any contact details you voluntarily provide so you can return to the report after registering.
Connected account data. If you choose to connect Google Tag Manager or Google Ads, we store the account IDs, container IDs, and encrypted OAuth tokens needed to read (and, only when you enable write mode, update) your containers and conversion actions. We do not store your Google password.
Usage data. We collect log data about the features you use, errors, and aggregate analytics to keep the service running and improve it. This is not used to build advertising profiles.
3. How we use your data
- To run the free audit and connected audits you request.
- To generate AI-written recommendations and, when you approve them, to draft changes in your GTM workspace or Google Ads account.
- To send monthly monitoring reports and service updates by email.
- To keep the service secure, diagnose issues, and improve the product.
4. Legal basis for processing
We process your data to perform the contract we have with you (providing the audit and connected services), to comply with our legal obligations, and where it is in our legitimate interests to keep the service secure and improve it. For marketing emails, we will rely on your consent where required by law.
5. Who we share data with
Google. We call Google Tag Manager and Google Ads APIs on your behalf when you connect those accounts. Data is exchanged under Google’s terms and your own Google account settings.
Hosting and AI providers. We use Lovable Cloud for hosting, database, and authentication, and an AI service provider to generate recommendations. These providers process data only as necessary to deliver the service.
No sale of personal data. We do not sell or rent your personal data to third parties for marketing or advertising.
6. Cookies and analytics
TagCoPilot uses essential cookies for authentication and session security. We may use a small number of analytics cookies to understand product usage, but we do not use third-party advertising cookies on this service. You can control non-essential cookies through your browser settings.
7. Data retention
If you close your account, we delete your personal data and scan logs within 90 days, except where we are required to keep it longer by law or for legitimate security or billing reasons. Aggregated, anonymised statistics may be retained beyond this period.
8. Security
Google OAuth tokens are encrypted before storage (AES-256-GCM) and only decrypted server-side when a task you triggered requires them. Access to production data is strictly limited and audited. Read mode is the default: write access to your GTM or Ads accounts is blocked until you explicitly enable it per client.
9. Your rights
You can access, correct, export, or delete your data from your account settings, or by emailing info@tagcopilot.io. Depending on your location, you may also have the right to object to or restrict certain processing, or to lodge a complaint with your local data protection authority.
10. Changes
We may update this policy as the service evolves. We will post the new date at the top of this page and notify you by email or in-app notice for material changes.
11. Contact
For privacy questions or data requests, email info@tagcopilot.io.
Shared responsibility. TagCoPilot helps you inspect and manage your own Google Tag Manager and Google Ads configuration. Configuring your website, cookie banner, and consent settings in a legally compliant way remains your responsibility. This policy describes the TagCoPilot service only.