Tagwise

Privacy Policy

Effective date: 14 September 2026 Version: 1.3

This Privacy Policy explains how InsightFlow (InsightFlow B.V.) ("we", "us", "our") handles information in connection with Tagwise (the "Service"), a web application that analyses Google Tag Manager ("GTM") container configurations and generates assessment reports.

Controller: InsightFlow B.V., registered in the Netherlands, Chamber of Commerce (KvK) no. 42121902, registered address Marnixstraat 161, 1015 VN Amsterdam, Netherlands. Contact: contact@insightflow.nl.

We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch implementing law (UAVG).

1. The most important point: your GTM container is processed in your browser

When you upload or connect a GTM container export, the file is read and analysed entirely within your own browser (client-side). The contents of your container are not transmitted to our servers, and we do not receive, store, or retain them. Your report is generated locally from that data.

As a result, we are not a controller or processor of the configuration data inside your container. You remain solely responsible for the contents of any container you upload, including any personal data or custom code it may contain (see our Terms & Conditions).

The remainder of this Policy concerns the limited personal data we do process to operate the Service — such as your account and payment information — which is separate from your container contents.

2. Google account access and the Google Tag Manager API

When you choose to connect your Google account instead of uploading a file, Tagwise requests read-only access to your Google Tag Manager data using the scope https://www.googleapis.com/auth/tagmanager.readonly. This lets you select one of your containers and load its configuration for analysis.

This access is handled entirely within your browser:

  • Sign-in uses Google's in-browser token flow. The resulting access token is held only in your browser tab; it is never sent to, or stored by, InsightFlow B.V.
  • Your container configuration is retrieved directly from the Google Tag Manager API by your browser and analysed locally, exactly as with an uploaded file. We do not receive, store, or retain your container contents or your access token.
  • Our servers provide only the public Google client identifier needed to start the sign-in flow.

The access is strictly read-only. Tagwise never creates, modifies, publishes, or deletes any Tag Manager resource, and requests no write or account-management permissions. You can revoke Tagwise's access at any time from your Google Account permissions page (myaccount.google.com/permissions).

Limited Use. Tagwise's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, share or transfer it to third parties except as necessary to provide the Service or as required by law, or use it to develop, improve, or train generalised artificial-intelligence or machine-learning models.

3. What we collect and why

We collect the following categories of personal data:

a) Account data. If you create an account, we process your email address and authentication details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

b) Payment data. When you purchase a package, payment is handled by Paddle (Paddle.com Market Ltd), which acts as the Merchant of Record for the transaction. This means Paddle is the seller of record: you provide your payment details directly to Paddle, Paddle processes the payment, and Paddle collects and remits any applicable VAT or sales tax. We never receive or store your full card number. We receive limited transaction metadata from Paddle — such as confirmation of payment, the package purchased, the amount, your billing country, and the card brand and last four digits — for order fulfilment, reconciliation, and tax and accounting records. Paddle processes your payment data as an independent controller under its own privacy policy for these purposes. Legal basis: performance of a contract, and legal obligation for tax/accounting records (Art. 6(1)(b) and (c) GDPR).

c) Acceptance records. When you accept our Terms & Conditions and this Privacy Policy, we log a timestamp, the version of the documents accepted, and (if you are logged in) your account identifier, as evidence of acceptance. Legal basis: legitimate interest in evidencing agreement and establishing/defending legal claims (Art. 6(1)(f) GDPR).

d) Usage and device data. We collect standard analytics and technical data (such as pages visited, actions taken, approximate location derived from IP, browser and device type) to operate, secure, and improve the Service. Legal basis: legitimate interest, and consent where required for non-essential cookies.

e) Support communications. If you contact us, we process the content of your message and your contact details to respond. Legal basis: legitimate interest.

We do not intentionally collect special categories of personal data, and we ask that you do not send them to us.

4. How we use personal data

We use personal data to: provide and operate the Service; process payments and deliver purchased packages; authenticate and secure accounts; maintain records of agreement acceptance; provide customer support; comply with legal, tax, and accounting obligations; and monitor, troubleshoot, and improve the Service.

5. Cookies and analytics

We use cookies and similar technologies. Strictly necessary cookies (for security, session, and core functionality) are used on the basis of our legitimate interest. Non-essential cookies (such as analytics and preferences) are used only with your consent, which you can give or withdraw via our cookie banner or the "Cookie settings" link in the footer.

We use Google Tag Manager to load measurement tags and Google Analytics 4 to understand how the Service is used, including which pages are viewed, which steps of the check are completed, and which purchases are made. These tags stay disabled until you accept analytics cookies: until then Google Consent Mode is set to "denied" and no analytics or advertising identifiers are stored on your device. Analytics never receives the contents of your Google Tag Manager container — that file is analysed in your browser and is not sent to us or to any third party.

6. Who we share data with

We share personal data only with:

  • Service providers (processors) acting on our instructions, including hosting/infrastructure, analytics, and customer-support tooling. These providers are bound by data-processing agreements.
  • Paddle, which acts as an independent Merchant of Record for payments and processes payment data under its own privacy policy.
  • Professional advisers (e.g., accountants, lawyers) where necessary.
  • Authorities or third parties where required by law, to enforce our Terms, or to protect our rights, property, or safety.

We do not sell your personal data.

A current list of our key sub-processors is available on request at contact@insightflow.nl.

7. International transfers

Some of our service providers may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses and/or an applicable adequacy decision, to protect your data. You may request a copy of the relevant safeguards at contact@insightflow.nl.

8. Retention

We retain personal data only as long as necessary for the purposes described:

  • Account data: for the life of your account and a reasonable period afterwards.
  • Payment and transaction records: as required by applicable tax and accounting law (in the Netherlands, generally seven years).
  • Acceptance records: for as long as needed to evidence agreement and for the duration of any applicable limitation period.
  • Usage/analytics data: for a limited period in line with our analytics configuration.

We delete or anonymise data when it is no longer required.

9. Your rights

Subject to the conditions in the GDPR, you have the right to: access your personal data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interest; and withdraw consent at any time (without affecting prior lawful processing).

To exercise these rights, contact contact@insightflow.nl. We will respond within the timeframes required by law.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and reliance on client-side processing of container contents. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Service is intended for business users and is not directed to children under 16. We do not knowingly collect personal data from children.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email where appropriate, and the "Effective date" above will be updated. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact

Questions or requests regarding this Policy or your personal data: InsightFlow B.V. — contact@insightflow.nl — Marnixstraat 161, 1015 VN Amsterdam, Netherlands.