Privacy Policy

The short version, before the detail.

What we collect

• Your email address — the one you use to buy, the one you want alerts sent to, and the one you sign in with (they can all be different).
• The web addresses you ask us to scan or monitor.
• The results of our scans on those websites: for each tracker, whether it fired, the tag IDs we observed (such as a GA4 measurement ID or a Meta Pixel ID), short technical evidence of what we saw, whether a consent tool was detected, and any page-load error.
• A small set of product events (for example “a scan finished”) tied to a random id that lasts for one browsing session, and which version of our own wording you were shown.
• If you have an account: your sign-in sessions. There is no password to collect — signing in is a one-time link we email you.
• Technical records of scan requests, including the IP address they came from, so we can stop abuse of the free scanner.
• Anything you write to us for support.

What we never collect

• Nothing about your website’s visitors. We look at your site from the outside, like any visitor. We never receive your visitor logs, your analytics data or your ad-account data.
• No access to your Google or Meta accounts. We never ask for logins, API keys or account connections, and would refuse them if offered.
• No card or payment details. Ever. Lemon Squeezy takes the payment; those details never touch our servers.
• No advertising trackers on our own site — no ad pixels, no third-party analytics, no cross-site tracking.

We do not sell your personal information, and we do not share it for advertising.

TagZ is operated by [LEGAL ENTITY], of [ADDRESS]. For data-protection law, [LEGAL ENTITY] is the controller of the personal data described in this policy. This policy covers the TagZ website, the free scanner, your TagZ account and paid tracking monitoring.

Your email addresses

Your account email identifies your subscription, receives service messages, and is the address you sign in with. Your alert email is where monitoring alerts go — it can be a different address, such as whoever manages your website or your ads.

The websites you ask us to check

Every address you enter, in a tidied form so that “www.Example.com/” and “example.com” are treated as one website. For a paid subscription we store which website occupies each of your monitored-website slots.

What a scan observes, and how

We load your public pages in a real headless browser running on our own infrastructure, and let your page run exactly as a visitor’s browser would. While it runs we observe the network requests it makes. When one of your tags tries to send its measurement request, we answer that request ourselves with an empty 204 rather than passing it on: the tag believes it succeeded — so we have our proof that it fired — and nothing we do reaches Google or Meta, or appears in your reporting. We need no account access and no OAuth connection to do any of this.

When we scan a website we keep the conclusions, not a copy of the site. For each platform we recognise (the ten we monitor — Google Analytics, Google Tag Manager, Google Ads, Meta, TikTok, LinkedIn, Microsoft Advertising, Pinterest, Snapchat and Reddit — and the others the scanner detects) that means: its status — working, installed but not firing, blocked by consent, or not detected; the tag IDs observed on your pages; the events it sent and a short, curated set of their parameters (event name, value, currency, order and product identifiers) — never whole request addresses, and never visitor details; short excerpts of the evidence (script addresses and the endpoints of tracker requests); whether a consent tool was detected, which one, and whether we pressed its accept control; and any page-load error. When we accept a cookie banner we do it in a temporary browser that is discarded when the scan ends: the choice is not stored anywhere and no cookie from the scanned website is kept. For monitored websites we also keep the history of these observations, the per-tracker baseline we alert against, and any incidents they led to.

Your account and how you sign in

There is no password, so there is no password to store. When you ask for a sign-in link we record the email address, a one-way hash of the link itself (a copy of our database cannot sign anyone in), when it expires, whether it has been used, and a short one-way hash of the requesting IP address. When you use the link we create a session record; your browser holds only an opaque reference to it — see section 5.

Product events

We record a small, fixed list of first-party product events — for example “landing page viewed”, “scan finished”, “checkout started”. Each event carries its name, a timestamp, a random session id that lives only for the current browser session, and the version of our own wording you were shown. No email address is ever sent to this collector. Your IP address is used to rate-limit the collector and is not written down with the event.

Scan telemetry (abuse prevention)

Separately from product events, the free scanner keeps an operational log of its own decisions — “scan requested”, “rate limited”, “served from cache”, “scan finished”. Entries about the request record the IP address it came from; entries about the scan itself record the website address. No single entry holds both — but they are written to one time-ordered log, so we will not pretend the two could never be connected. We keep this because the free scanner is an obvious target for abuse.

Billing records

From Lemon Squeezy we read and store your email address, which plan you bought, your subscription status, the date your subscription is paid through, and Lemon Squeezy’s own reference ids. We never read or store any card details — not even the card brand or the last four digits.

The emails we send you

We keep a record of each email we sent: the address, what kind of message it was, the subject, when it was sent, and whether the provider accepted it. That record is how we can tell whether an alert actually went out — which matters most on the day it did not. We also record unsubscribes and delivery failures.

Support correspondence

If you email us, we keep the message and our reply.

• Personal data about your website’s visitors. We arrive as one ordinary anonymous visitor, and we answer your trackers’ measurement requests locally with an empty 204 instead of delivering them — so a scan neither reads your visitors’ data nor adds to it. We never place any code on your website.
• Copies of your pages. Page content is read only for as long as a scan needs it and then discarded. What we keep is the conclusion, not the content.
• Your analytics or ad-account data. We have no access to your Google Analytics property, Google Ads account, Meta Business account, or any reporting inside them — and we never ask for it.
• Payment card data. Card details are entered on Lemon Squeezy’s checkout, on their own domain, and are never sent to, seen by, or stored by TagZ.
• Advertising or cross-site tracking data. There are no ad pixels, no retargeting tags and no third-party analytics on this site.
• Credentials of any kind. Our scans never sign in, never submit forms, and never need a password from you.

Our web fonts are served from our own domain, so reading this page does not send a request to any font or advertising network.

TagZ sets two cookies and uses two pieces of browser storage. There are no third-party cookies, no advertising identifiers, and nothing here follows you to another website.

The sign-in cookie and the unfinished-purchase entry exist to do things you asked for. The split-test cookie and the session-storage id are how we measure our own wording; the scanner and every public page work with all four cleared. When the human-verification step is enabled on the scanner, it is Cloudflare Turnstile, loaded from Cloudflare under their privacy terms.

We do not use your data to make automated decisions with legal or similarly significant effects, and we do not profile you.

We keep the list of companies involved deliberately short. Each one is bound by a contract to process data only on our instructions.

We do not sell personal data, and we do not pass it to anyone else except where the law requires it, or where it is necessary to establish or defend a legal claim.

We keep data only as long as it is doing a job. Scheduled deletion enforces the fixed periods; everything else is kept while the reason for holding it lasts, and you can ask us to delete it sooner — see section 9.

When we delete, the data is deleted or irreversibly aggregated so it no longer identifies anyone.

If you are in the UK or the EU

Under the UK GDPR and EU GDPR you have the right to:

• get a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• receive your data in a portable, machine-readable format;
• restrict how we use your data while a concern is being resolved;
• object to processing we base on legitimate interests, including any direct marketing; and
• withdraw consent at any time, where consent is what we relied on.

If you are a California resident

Under the CCPA/CPRA you have the right to know what personal information we collect and why, to request its deletion or correction, and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

How to exercise them

Email [SUPPORT EMAIL] from the address we hold for you. We respond within one month (UK/EU) or 45 days (California). Some data cannot be deleted on request — billing records we are legally required to keep, and abuse records where deleting them would defeat their purpose. If that applies we will say so and explain why.

A service whose whole job is loading web addresses strangers give it has to be careful. Concretely:

• Every outbound request is checked before it is made. We refuse to connect to private, internal, loopback or cloud-metadata addresses — including requests the scanned page itself tries to make — so our service cannot be used as a way into someone else’s network.
• We never hold credentials for anything of yours. No website logins, no analytics accounts, no ad accounts, and no TagZ password either — signing in is a one-time link, stored only as a one-way hash.
• Payment data is out of scope by design. Card details go to Lemon Squeezy directly; there is no card data in our systems to protect.
• Scan requests are individually authorised with short-lived signed tickets tied to the one address being scanned.
• Billing messages from Lemon Squeezy are cryptographically verified before we act on them.
• Traffic between you and TagZ is encrypted in transit (HTTPS).

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will tell the relevant supervisory authority within 72 hours where the law requires it, and tell you directly without undue delay where there is a high risk to you.

TagZ is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.

Some of the companies listed in section 7 operate outside the UK and the European Economic Area, including in the United States. Where personal data is transferred out of the UK or EEA, we rely on the safeguards those providers offer — such as the European Commission’s Standard Contractual Clauses with the UK Addendum, or an adequacy decision covering the destination country. You can ask us for details of the safeguards that apply to a particular transfer.

We will update this policy when what we do changes — in particular if we add a cookie, an analytics provider, or a new processor. If a change materially affects how we use your data, we will email subscribers before it takes effect.

For anything in this policy — a question, a data request, or a complaint — email [SUPPORT EMAIL]. A person reads it, and we aim to reply within two business days. Postal address: [LEGAL ENTITY], [ADDRESS].

If you are not satisfied with how we have handled your data, you have the right to complain to a data-protection supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in the country where you live or work. We would rather you came to us first, but you do not have to.