Privacy Policy

This policy explains what GTM (gtm.inc),, collects when you review a product, how we use it, and the rights you have over it. GTM stores structural metadata about your product — never your source code.

Data we collect

• Graph metadata — file paths, symbol names, AST edges, commit shas, and the readiness scores GTM computes.
• Session counters — turn count, token metrics, latency data, error codes.
• Account data — name, email, workspace, role, billing contact.

How we use it

Five lawful purposes under UK GDPR Article 6:

• Score readiness context — contract
• Route model calls — contract
• Render the readiness dashboard — contract
• Invoice production — contract + legal obligation
• Aggregate heuristic improvement — legitimate interests, opt-out available

Cookies & tracking

Session cookies for sign-in only — strictly necessary. No advertising or cross-site tracking.

Model providers

GTM routes to third-party LLMs (Anthropic and others) and enforces zero-retention mode on every outbound call. Where you supply your own key, calls run under your account.

Sub-processors

• Amazon Web Services — eu-west-2 (London), multi-AZ.
• Anthropic — model API, via your own key.

Residency & transfers

All metadata is hosted in AWS eu-west-2 (London). Any EU transfers rely on adequacy decisions and Standard Contractual Clauses.

Retention & deletion

Your rights

Under GDPR Articles 15–21 you may access, rectify, erase, restrict, port, and object to processing of your data. Email [email protected] and we respond within statutory timelines.