Privacy Policy

1. Who we are

GTM Engine is operated by FutureProof Sales Ltd ("FutureProof Sales", "GTM Engine", "we", "us", "our"), a company registered in Northern Ireland with its registered office at 8 Columba Terrace, Londonderry, Northern Ireland, BT47 6JT. We operate the website at gtmengine.app and the related application (together, the "Service"). This policy explains what personal data we collect, how we use it, and the rights you have. For privacy questions, or to exercise any of your rights, contact us at hello@gtmengine.app. FutureProof Sales Ltd is the data controller for the personal data described in this policy.

2. Information we collect

We collect the following categories of personal data:

• Account data — your name, email address, password (stored only as a secure hash), and the workspaces and team memberships you create or join.
• Content you provide — the brand materials, documents, messaging, projects, and other content you upload or generate in the Service.
• Connected-account data — if you choose to connect a Microsoft (Outlook), Google, LinkedIn, X (Twitter), or Facebook (Meta) account, we access data from those accounts strictly to provide the features you enabled (see section 5).
• Usage and device data — basic technical information such as IP address, browser type, and actions taken in the Service, used to operate, secure, and improve it.
• Payment data — if you purchase credits or a subscription, our payment processor handles your card details; we do not store full card numbers.

3. How we use your data and our lawful bases

Under UK and EU GDPR we rely on the following lawful bases:

• To perform our contract with you — to create and run your account, generate and store your content, and deliver the features you use.
• Your consent — to connect your email, calendar, or LinkedIn account, and to publish content on your behalf. You can withdraw this at any time by disconnecting the account in the app.
• Our legitimate interests — to secure the Service, prevent abuse, and improve our product, balanced against your rights.
• Legal obligation — to meet accounting, tax, and other legal requirements.

4. AI processing

The Service uses third-party AI providers to generate and analyse content. When you use these features, the relevant inputs (such as your prompts, brand materials, or the items you ask us to draft) are sent to those providers to produce the output. We do not sell your content, and we instruct our providers to process it only to deliver the Service.

5. Connected accounts (email, calendar, LinkedIn)

Connecting an account is always optional and initiated by you:

• Outlook / Google email & calendar — we request read-only access to summarise recent messages that may need your attention and upcoming calendar events. We do not send, delete, or modify your email or calendar.
• LinkedIn and X (Twitter) — we request permission to publish posts and replies on your behalf, only when you explicitly click to publish a specific item. We never post automatically. For LinkedIn, where you have granted it, we may also read your own posts' performance metrics to report them back to you.
• Facebook (Meta) Pages — if you connect a Facebook Page, we request permission to read the list of Pages you manage (so you can choose which to connect) and to publish posts you have reviewed and approved to that Page, on your behalf, only when you explicitly approve a specific post. We do not post automatically, and we only access the Page you select. Data obtained from Meta is used solely to provide this publishing feature and is handled in line with Meta's Platform Terms.

Access tokens for connected accounts are stored securely on our servers and are never exposed to your browser. You can disconnect any account at any time from within the app, which revokes our access going forward; you may also revoke access directly in your Microsoft, Google, LinkedIn, X, or Facebook account settings. To request deletion of data we hold from a connected account, see our Data Deletion page.

Google API Services User Data Policy (Limited Use)

GTM Engine's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access Gmail and Google Calendar data solely to provide and improve the user-facing features you have connected, namely a private inbox-and-calendar briefing and reply drafting shown only to you. We do not transfer or sell this data, do not use it for advertising, and do not use it to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models. Human access to this data is limited to what is necessary to operate or improve the feature, for security or to comply with applicable law, or with your explicit consent.

6. Who we share data with (sub-processors)

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it. These include providers of cloud hosting and database, payment processing, AI generation, transactional email, and the email/calendar/LinkedIn platforms you connect. We do not sell your personal data, and we do not allow advertisers to target you using it.

7. Data retention

We keep your personal data for as long as your account is active or as needed to provide the Service. If you delete your account or specific content, we delete or anonymise the associated personal data within a reasonable period, except where we must retain it to meet legal obligations or resolve disputes.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and storage with reputable infrastructure providers. No system is perfectly secure, but we work to safeguard your information and to respond promptly to any incident.

9. Government and law enforcement requests

We treat requests from public authorities or law enforcement for the personal data of our users with care, and we do not disclose data simply because it has been requested. When we receive such a request we: (a) review its legal validity before responding; (b) challenge it where we consider it unlawful or overbroad, taking legal advice where needed; (c) disclose only the minimum information necessary to comply; and (d) document each request, our response, and the legal reasoning involved. Where we are legally permitted to do so, we will notify the affected user. We do not grant any government or authority direct, unfettered, or bulk access to personal data or to our systems.

10. International transfers

Some of our providers process data outside the UK and European Economic Area. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses to protect your data.

11. Your rights

Subject to applicable law, you have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict certain processing; and to withdraw consent at any time. To exercise these rights, email hello@gtmengine.app. If you are in the UK or EU and believe we have not handled your data properly, you may also lodge a complaint with your data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk).

12. Cookies

We use cookies and similar technologies that are necessary to keep you signed in and to operate the Service, and a limited number to understand usage so we can improve it. You can control non-essential cookies through your browser settings.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you. Continued use of the Service after an update means you accept the revised policy.

15. Contact

Questions about this policy or your data? Email us at hello@gtmengine.app.