Privacy Policy | GTM Right

1. Who we are

GTM Right is operated by GTM RIGHT LIMITED, a company registered in England and Wales (Company Number: 17222856). We are the controller of personal data collected through gtmright.com and funder.gtmright.com.

For privacy questions or to exercise your rights, contact us at support@gtmright.com.

2. How we collect and use data

We collect and use personal data only to operate GTM Right, provide the commercial validation service, administer accounts and payments, support founders and partners, protect the service, and meet legal obligations.

Data category	What it can include	Why we use it
Founder account data	Name, email address, Clerk user identifier and sign-in method.	To create and secure a founder account, associate it with authorised Workspaces and provide account communications.
Funder and partner account data	Name, organisation, email address, partner account details, sign-in-link status or password hash.	To set up, secure and administer a partner relationship.
Canvas and Workspace data	Idea description, answers, uploaded evidence, generated analysis, stage outputs, saved decisions and share settings.	To provide the commercial validation engine, preserve a Workspace, generate a Pack and enable authorised sharing.
Market research data	Search terms derived from your submitted idea, public-source results and retrieved evidence.	To retrieve live market signals and support the analysis you requested.
Payment data	Stripe customer, checkout, payment or invoice identifiers, product and fulfilment status.	To process and fulfil a Canvas or War Room purchase, prevent fraud and keep required financial records.
Communications and consent data	Email address, preferences, subscription, suppression or unsubscribe status, and support messages.	To send requested transactional messages and optional follow-up where permitted.
Technical and security data	IP-address-derived rate-limit hash, device or browser information, request logs, authentication and session metadata.	To keep the service secure, prevent abuse, manage sessions and diagnose faults.
Cookieless analytics data	Aggregate page, referrer, general device and approved event information.	To understand aggregate product use and improve the service.

We normally rely on contract performance to provide accounts, Canvas work, payments and requested communications. We rely on legitimate interests to keep the service secure, prevent abuse and understand aggregate product use. Where we request optional follow-up consent, you can withdraw it at any time. You do not need to provide optional follow-up consent to use Stage 1.

3. AI and market-source processing

GTM Right is a commercial validation engine. When you request analysis, our server sends relevant Workspace inputs and stage context to OpenAI to generate the analysis requested by you. This can include relevant content from PDFs or documents you upload, evidence and context retrieved from public sources or derived from search, and the analysis and outputs generated for you. We may also send search terms derived from your request to Serper and, where necessary, Exa to retrieve public market evidence.

GTM Right does not use your Stage 1 inputs or Canvas content to train its own AI models. The provider processing described above is used to deliver the analysis and source retrieval you requested. Please do not enter information that you are not authorised to provide or that you would not want processed for this purpose.

The analysis is decision support. It is not a legal, tax, investment, insurance, medical or other regulated professional decision about you, and it does not make an automated decision with legal or similarly significant effects on you.

Each Stage 1 run retrieves public market evidence afresh. Results may therefore reflect new or updated evidence, and a grade or signal count may change. Stages 2 to 6 do not retrieve evidence from public sources in this way; they work from the answers and evidence you provide. We do not monitor the market continuously or update a result on our own.

We keep earlier evidence retrievals and earlier stage runs as an audit and revision history of how a result was produced. A stored evidence retrieval includes a normalised copy of the inputs used to retrieve it, such as your problem statement, target buyer and market. That history is kept as described in section 7.

4. Who we share data with

We do not sell personal data. We use the following service providers to operate GTM Right:

Clerk - Founder authentication by email or Google and related identity verification.
Supabase - PostgreSQL database, object storage and data-access infrastructure.
Railway - Application-server hosting and backend delivery.
Vercel - Public frontend delivery and web routing.
OpenAI - Analysis generation requested through the commercial validation engine, and text-to-speech when you create an audio Founder Brief from your Workspace. This can include relevant content from PDFs or documents you upload, evidence and context retrieved from public sources or derived from search, and the analysis and outputs generated for you.
Serper and Exa - Public-web search and source retrieval used to generate market evidence.
Stripe - Payment processing and payment-related identifiers.
Resend - Transactional, consent-based follow-up and operational email delivery. Restricted service or operational notifications may include limited business context you provided, where necessary to operate, support or secure GTM Right.
Better Stack - Monitoring and alerting for our staging (pre-release) environment. Alerts contain an event code, severity, the affected part of the service and a status code, not Workspace content, names or email addresses.
Cal.com - Scheduling for guided validation sessions booked through the embedded calendar on our guided session page. Cal.com receives the details you enter when you book.
Google Fonts - Web font delivery. Your browser loads fonts from Google's servers, which receive your IP address and browser information when a page loads.
Umami Cloud - GTM Right's owned cookieless analytics property, receiving sanitised page and approved anonymous event data only.

Your Workspace and Canvas are not public by default. A saved Workspace opens only through your magic key, a signed Workspace access link or your signed-in account; before you save, a new Workspace can be reopened only from its private, hard-to-guess address until it expires. If you create a share or investor link for your Canvas, anyone who holds that active share or investor link can view the shared Canvas without signing in, including a funder you send your Pack to. You can revoke the link at any time, after which it stops working. If you share the same Canvas again later, its link becomes active again, so anyone who still has it can view it again.

If you started through a partner's referral link, that partner can see limited progress information in its partner dashboard: your idea title, the date you joined through their link, whether you have unlocked the paid Canvas, a progress score for each stage, and when you sent your Pack to them and when they viewed it. The partner cannot open your Workspace or your Pack unless you send the Pack to them or share a link with them.

Authorised GTM Right personnel can access Workspaces, Canvas content and related records where required to operate, support, secure or fix the service, or to run a session you have booked. Internal operational notifications sent to GTM Right by email can include your email address, your idea title or the opening of your problem statement.

We do not provide advertising networks with Canvas content, account data or analytics cookies. We may disclose information where required by law, to protect the security or rights of GTM Right or others, or as part of a genuine corporate transaction, subject to applicable law.

5. Cookies, sessions and analytics

GTM Right uses necessary authentication and session cookies, including Clerk authentication cookies for founders and scoped GTM Right session cookies for authorised Workspace or partner access. These are necessary to sign you in, protect the service and keep authorised access working.

Magic keys and other access links we email you are personal credentials. Each one is scoped to the Workspace or account it was issued for and is time-limited. Opening one can establish a signed browser session for that Workspace or account, so that browser stays signed in for a limited period without a password. Anyone who has a link while it is valid could use it, so keep your magic key and access links private and do not forward them. If you think a link has been exposed, contact us.

Our GTM Right Umami Cloud property is cookieless. It receives page paths, referrers, page titles, general device information and approved event names such as validation started, Canvas claimed, checkout opened, payment returned, Pack downloaded or shared Canvas viewed. Before anything is sent, query strings and link fragments are removed, page addresses that contain an access token or a Workspace or Canvas identifier are replaced with a generic route such as /workspace/:token, the titles of those pages are replaced with a neutral title, and referrers from other sites are reduced to the site address. We do not send names, email addresses, Workspace or Canvas identifiers, access tokens, idea text, payment details, analytics cookies or cross-site identifiers to Umami.

GTM Right does not use advertising cookies, retargeting pixels or third-party analytics cookies. See our Cookie Policy for more detail.

6. International transfers

Some service providers may process personal data outside the United Kingdom. Where a transfer requires safeguards under applicable data-protection law, we use the provider’s relevant contractual, technical or other lawful transfer mechanism. You may contact us for information about safeguards relevant to your data.

7. Retention

We keep data to provide an active account or Workspace, respond to an enquiry, maintain security, resolve disputes and meet legal, accounting or reporting obligations. Payment-related records may need to be kept for statutory financial-record periods.

We do not currently delete or anonymise data automatically. In practice:

A Stage 1 result you have not saved can be opened from its Workspace address, or recovered in the browser that ran it when you choose to, for 48 hours after the result is delivered. After 48 hours, an unsaved Workspace can no longer be opened, recovered or saved, but its content is not automatically deleted.
A saved Workspace, its Stage 1 run, later stage runs, evidence and revision history, consent records and uploaded files are kept until you ask us to delete them.
When paid Canvas access ends, your Workspace content is not deleted automatically.
Access expires even though data is kept: a magic key or signed Workspace access link is valid for 30 days, an emailed return link for 14 days, a partner sign-in link for 15 minutes, and a signed Workspace browser session for up to 30 days from when it was last renewed.

You can ask us to delete your data, or ask how these criteria apply to your data, by contacting us.

8. Your rights

Subject to applicable law, you may ask for access to, correction of, deletion of, restriction of or a portable copy of your personal data. You may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time.

To make a request, contact support@gtmright.com. We aim to respond within one month. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

9. Security, changes and contact

We use technical and organisational measures designed to protect personal data, including encrypted transport, restricted service access and secure session controls. No method of transmission or storage is completely secure, but we work to protect data appropriate to the risks involved.

We may update this policy when our data practices or legal requirements change. The latest version is published at gtmright.com/privacy with its last-updated date. For privacy questions, contact GTM RIGHT LIMITED at support@gtmright.com.