Effective date: October 17, 2026

This Privacy Policy explains how J&T Solutions Inc., doing business as GTM ("GTM" or "TryGTM", "we", "us"), collects, uses, shares and protects personal information. It applies to our websites at trygtm.com and its subdomains (the "Sites"), our software platform and related services (the "Services"), and our marketing, events and support. Terms not defined here have the meanings in our Terms of Service.

1. Summary

GTM is business software that helps companies find, research and contact business prospects by email, LinkedIn and other channels, using AI.
If you are a GTM customer or user, we process your account, billing, usage and support information to run the Services.
If you are a prospect or a recipient of a message sent through GTM, we may hold business contact and professional information about you. Section 4 explains where it comes from, your rights, and how to stop all contact through GTM.
When we process data inside a customer's workspace, we act for that customer, and the customer's privacy notice applies.
Data we receive from Google (Google sign-in, Gmail and Google Calendar) is used only to provide and improve the features you use. Section 16 governs it and overrides anything else in this Policy for that data.
We use service providers, including AI model providers, to run the Services. Our Subprocessors page names them.
Our systems are in the United States.
To exercise your rights, email support@trygtm.com.

2. Our role

Data	GTM's role	Whose notice applies
Website visitor, waitlist, account, billing, support, marketing and security data	Controller (a "business" under the CCPA)	This Policy
Prospect Data: business contact and professional data that GTM sources and supplies through the Services	Controller for sourcing, maintaining and supplying it	This Policy
Customer Data: data a customer uploads, connects or generates in its workspace, including its use of Prospect Data for its own outreach, its messages and the replies	Processor (a "service provider" under the CCPA), acting on the customer's instructions	The customer's privacy notice. This Policy describes our handling for transparency
Aggregated and de-identified usage data	Controller	This Policy

When we act as a processor, we process data under our agreement with the customer, including our Data Processing Addendum. If a GTM customer contacted you, that customer decided to contact you and what to say.

3. Information we collect about customers, users and visitors

3.1 Information you give us

Account and profile. Name, business email address, sign-in credentials (through our authentication provider), company name, job title, role, workspace settings and preferences.
Company and campaign setup. Company website, product and offer descriptions, ideal customer profile, messaging preferences, sender names, the postal address on file, calendar links and other onboarding answers.
Authorized users. Name, email address and role of people an administrator invites.
Billing. Billing contact, company address, tax identifiers, plan and purchase history. Our payment processor collects card details. We receive a reference to the payment method and limited details such as card brand and last four digits, not the full card number.
Communications. Messages you send to support, including a phone number and your text-message choice if you give them, survey responses, feedback, and event and webinar registrations.
Waitlist and forms. Name, email address, phone number, company, the consent choices you make, including whether you chose to receive text messages, and the exact consent wording you agreed to.
Job applications. Information you submit when applying for a role, such as your CV, work history and links.
Partners. Contact, payout and tax information for affiliate and referral partners.
Signed documents. Information in agreements you sign with us electronically.

3.2 Information collected when you connect accounts

When you connect an account, we receive the information needed for the feature you enable:

Sending domains and email. Domain names, DNS records, sender addresses, message content, and delivery, bounce, complaint and reply events.
Mailboxes (Google and Microsoft). With your permission, we send email from your mailbox and read incoming messages in it to find and handle replies to your outreach. Section 16 governs data we receive from Gmail.
LinkedIn. Your profile identifiers, and the connections, messages, invitations and activity the feature needs. If a connection requires your password, we pass it to our connection provider to create the connection and do not store it.
Calendars and scheduling tools, such as Google Calendar, Calendly and Cal.com. Event times, attendees, meeting links and booking status. Section 16 governs data we receive from Google Calendar.
CRMs, such as HubSpot. Contacts, companies, deals, fields and activity you allow us to read or write.
Phone numbers and SMS. Numbers, registration details, message content and delivery status.

3.3 Information collected automatically

Usage data. Features used, actions taken, pages viewed, settings changed, Credit use and timestamps.
Device and browser. IP address, browser type and version, operating system, language, and approximate location derived from IP address.
Logs and diagnostics. Request metadata, error codes, performance data and security events. Our operational monitoring is designed to exclude message bodies, prompts, credentials and full web addresses.
Cookies and similar technologies. See Section 10 and our Cookie Policy.
Visitor identification. On trygtm.com, our visitor identification providers, Datamoon and LiveIntent, may match your browser to a hashed email address and report it to us with the pages you viewed, the referring site and campaign parameters. See Section 10.
Referral data. If you arrive through a partner link, we store the referral code in a cookie for up to 90 days so we can credit the partner.

3.4 AI interactions

When you use AI features in the Services, including assistants and agents, we process your prompts, files, the context the feature needs (such as prospect and company information) and the responses generated. Conversations are stored in your workspace so you can see and resume them.

When you use the assistant on our website, we send your messages to an AI model provider through our hosting provider's AI gateway to generate a reply. We do not save website assistant conversations to our database. We use your IP address to limit abuse.

3.5 API data

If you use our APIs, MCP server or command-line tools, we collect credentials used to authenticate, request metadata, the data sent and returned, and the tool making the request.

3.6 Information from third parties

Payment processor. Payment status, fraud signals and billing details.
Sign-in providers. If you sign in with a third-party identity provider, your name, email address and profile identifier. Section 16 governs data we receive from Google sign-in.
Business-information providers and public sources. Information about your company, including from your company website, which we read during onboarding.
Partners. The fact that a partner referred you.

4. Information about prospects and message recipients

This Section is for people whose business information is held in GTM or who receive a message sent through GTM.

4.1 What we hold

Identity and professional details. Name, job title, seniority, department, employer, work location (city, region, country), professional profile URL and headline, work history and skills.
Business contact details. Work email address and, where available, business phone number. Email addresses may be checked with a verification service.
Company information. Company name, website, industry, size, revenue range, technologies, funding and news.
Public professional activity. Recent public posts, comments or engagement on professional networks, used to judge whether your role and interests are relevant to a customer's offer.
Derived information. Fit and intent scores, relevance notes, research summaries and AI-generated message drafts.
Interaction records. Messages sent to you, your replies, opt-outs, bounces, meeting bookings, and the customer that contacted you.
Provenance. For each field, where it came from, how it was obtained, and when.

We do not seek to collect sensitive personal information about prospects, and our terms prohibit customers from using GTM for that purpose.

4.2 Where it comes from

Licensed business-data providers from which we license business contact and company data.
Publicly available sources, such as company websites and public professional profiles and activity.
Our customers, who upload lists, connect CRMs, and use their own connected accounts, including LinkedIn, to search and view profiles.
You, when you reply to a message, book a meeting or contact us.
Verification and enrichment services that confirm whether an email address can receive mail or find a business contact route.

We do not create, add to or enrich Prospect Data from Google user data. A reply that reaches a customer's connected Gmail account stays in that customer's workspace (Section 16).

4.3 Why we use it

We use prospect information to maintain a business directory within the Services, to help customers find and contact businesses and professionals who may be interested in their products, to verify contact details, to honor opt-outs, and to prevent abuse. For people in the EEA, UK and Switzerland, our legal basis is our legitimate interests, and those of our customers, in business-to-business sales and marketing. We limit the data to business information, apply retention limits, and give you an easy way to object.

4.4 Your choices

Stop all contact through GTM. Reply to any message sent through GTM asking to stop, or email support@trygtm.com with the address or profile URL to suppress. We add you to a suppression list that applies to every GTM customer. To make that work, we keep your identifier and the fact of your request, even if we delete everything else.
Access, delete, correct or object. See Section 13.
Contact the sender. The customer that contacted you is responsible for its own outreach and records, and its details appear in its message.

4.5 How long we keep it

We keep sourced prospect records for up to 24 months from the date we collected them, not from when they were last updated. After that we delete them. Suppression records are kept for as long as we need them to honor your request.

5. How we use personal information

Purpose	Examples
Provide the Services	Create accounts, run campaigns, source and score prospects, write and send messages, handle replies, book meetings, sync CRMs
Authentication and access	Sign-in, one-time codes, sessions, permissions, workspace separation
AI features	Qualification, research, writing, reply classification, assistants
Customer support	Answer questions and troubleshoot, including viewing your workspace when needed to help you
Security, fraud and abuse prevention	Rate limiting, detecting misuse, enforcing our Acceptable Use Policy, monitoring complaint and bounce rates, suppression
Billing	Subscriptions and Credits, invoices, tax, collections, partner payouts
Analytics and improvement	Understand feature use, fix bugs, measure performance, plan features
Communications	Service, security and billing notices, product updates, responses to inquiries
Marketing, where permitted	Newsletters, launch and event invitations, and calls or texts where you consented
Legal and compliance	Meet legal obligations, respond to lawful requests, enforce our terms, defend claims, keep records
Corporate transactions	Due diligence and transition in a merger, financing or acquisition

We do not use Customer Data to train or fine-tune AI models that are made available to other customers.

Google user data is excluded. We use Google user data only as Section 16 describes, not for every purpose in this table. In particular, we do not use it for marketing, for analytics beyond operating and improving the features you use, or to train AI models.

6. Sensitive information

We do not seek to collect sensitive personal information such as government identifiers, financial account numbers, precise geolocation, health information, racial or ethnic origin, religious beliefs, sexual orientation, union membership, biometric or genetic data, or information about children. Our Acceptable Use Policy prohibits customers from using the Services to process it. Account login credentials are sensitive personal information under some laws, and we use them only to authenticate you.

7. AI and automated processing

AI features send relevant information, which may include personal information, to AI model providers to generate outputs. We do not describe these requests as anonymous.
For AI features in the Services, we route model requests through a routing provider configured to exclude model providers that use request data for training.
AI features score, rank and classify prospects and replies to help customers prioritize business outreach. We do not use them to make decisions that produce legal or similarly significant effects about individuals, and our terms prohibit customers from doing so.
Messages sent through GTM may be written in whole or in part by AI.
Google user data is never used to develop, improve or train AI or machine learning models, by us or by the AI model providers we use. Section 16 explains how AI features may process it.

We share personal information only as follows:

Customers. We make Prospect Data available to customers who use the Services to find and contact businesses and professionals. Data inside a workspace is shared with that workspace's authorized users.
Service providers and subprocessors. Companies that host, store, secure, deliver, analyze or support the Services for us, under contracts that limit their use of the data. Categories: cloud hosting and compute; database and authentication; email delivery and inbound processing; LinkedIn and mailbox connectivity; SMS; AI model routing and inference; website reading; public-activity retrieval; email verification; business-data licensing and enrichment; rate limiting; payments; e-signature; domain registration and DNS; transactional email; and monitoring. See our Subprocessors page.
Integrations you enable. Services you or your organization connect, such as CRMs, calendars and professional networks, receive the data the integration sends.
Your organization. If you use a business email address, your organization's administrators can see and control your account.
Agencies and their clients. If an agency manages a workspace for its client, both may have access to that workspace's data.
Visitor identification providers. When you visit trygtm.com, Datamoon and LiveIntent receive your browser identifiers, a hashed email address they match to it, and the pages you view, so we can recognize visitors. See Section 10.
Partners. Limited information needed to confirm a referral and calculate a commission.
Professional advisers. Lawyers, accountants, auditors and insurers, under duties of confidentiality.
Corporate transactions. Buyers, investors, lenders and their advisers in connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of assets.
Legal and safety. Law enforcement, regulators, courts and others where we believe disclosure is required by law or needed to protect the rights, property or safety of GTM, our users, recipients or others, to prevent fraud or abuse, or to enforce our agreements.
With your consent or at your direction.

Google user data is excluded. We share Google user data only as Section 16 describes. It is never part of the Prospect Data we make available to customers.

Mobile information is excluded. None of the sharing in this Section includes mobile phone numbers, text messaging originator opt-in data or consent collected for TryGTM's text messages. We handle that information only as Section 17 describes.

We may share aggregated or de-identified information that does not identify any individual. Where we de-identify data, we take reasonable measures to prevent re-identification and do not attempt to re-identify it.

Some US state laws give you the right to opt out of the "sale" or "sharing" of your personal information, as those laws define those terms. To opt out of any such sale or sharing of your information by GTM, including the supply of Prospect Data about you to GTM customers, email support@trygtm.com with the subject line "Do not sell or share" and the email address or profile URL concerned. We do not knowingly sell or share the personal information of anyone under 16.

We do not use advertising cookies. The visitor identification on trygtm.com described in Section 10 may count as a sale or sharing under some state laws. We treat a Global Privacy Control signal from your browser as an opt-out and do not load it, and the email opt-out above also covers it.

9. Data retention

We keep personal information only as long as needed for the purposes in this Policy, then delete or de-identify it.

Data	Retention
Account and profile	While the account is open, and afterward as long as needed for the purposes below
Customer Data (as processor)	During the subscription, exportable for 30 days after it ends, then deleted within 90 days, except copies in backups, which expire in the ordinary course
Prospect Data (as controller)	Up to 24 months from collection
Google user data	As Section 16.6 describes
Suppression and opt-out records	As long as needed to honor the request, limited to the identifier and the request
Billing and tax records	As long as tax and accounting law requires
Consent records for calls and texts	At least as long as needed to show consent was given
Support, security, application and marketing records	As long as needed for the purpose they were collected for

We may keep information longer where the law requires it, for a legal hold, or to resolve disputes and enforce agreements.

10. Cookies and tracking

We use cookies and similar technologies that are needed to run the Sites and Services, for example to keep you signed in and to remember a partner referral. We do not use advertising cookies. Our Cookie Policy lists them and explains your choices.

Visitor identification. On trygtm.com, we use Datamoon, which works with LiveIntent, to identify the people and companies that visit so we can follow up with them. LiveIntent may use its cookies and identity data to match your browser to a hashed email address, and Datamoon receives that hash with the pages you viewed. If your browser sends a Global Privacy Control signal, we do not load it. Section 8.1 explains how else to opt out.

Do Not Track. There is no common standard for browser "Do Not Track" signals, so we do not respond to them.

11. International data transfers

GTM is based in the United States, and we store and process information in the United States. Some of our service providers may process information in other countries, where data protection laws may differ from those where you live. When we transfer personal information from the EEA, UK or Switzerland to a country without an adequacy decision, we use a recognized transfer mechanism, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask for a copy of the relevant safeguards by contacting us.

12. Security

We use administrative, technical and physical measures designed to protect personal information, including separation of each customer's data at the database level, access checks on each request, and limits on what operational logs contain. No system is completely secure, and we cannot guarantee the security of information. You are responsible for protecting your credentials.

13. Your privacy rights

Depending on where you live, you may have some or all of these rights:

Access and know. Confirm whether we process your personal information and get a copy, including its categories, sources, purposes and recipients.
Portability. Receive information you gave us in a usable format.
Correction. Correct inaccurate information.
Deletion. Ask us to delete your information.
Opt out of sale, sharing, targeted advertising, and profiling that produces legal or similarly significant effects.
Restrict or object to processing, including processing based on legitimate interests and direct marketing.
Withdraw consent where processing relies on consent, without affecting earlier processing.
Appeal our decision on your request.
Complain to a data protection authority.

How to make a request. Email support@trygtm.com with the subject line "Privacy request". Tell us your name, the email address or profile URL the request concerns, and what you are asking for. We will verify your identity, normally by confirming control of that email address, and may ask for more information if needed. We will respond within the time the law requires.

Authorized agents. An agent may submit a request for you with your signed permission. We may ask you to verify your identity directly.

Requests about a customer's workspace. If your information is in a GTM customer's workspace, for example in a list the customer uploaded, we process it for that customer. We may forward your request to the customer and help them respond. We will still add you to our platform-wide suppression list if you ask us not to contact you.

Non-discrimination. We will not discriminate against you for exercising your rights.

Appeals. If we decline your request, you may appeal by replying to our decision with the subject line "Privacy appeal". If you are not satisfied with the outcome, you may contact your state attorney general.

14. United States: state privacy disclosures

Several US states have comprehensive privacy laws. Most of them exclude people acting in a commercial or employment context. The California Consumer Privacy Act does not, and this Section gives the disclosures it requires.

In the past 12 months we have collected these categories of personal information, from the sources in Sections 3 and 4, for the purposes in Section 5, and disclosed them for business purposes to the recipients in Section 8:

Category	Examples
Identifiers	Name, email address, phone number, IP address, account ID, professional profile URL
Customer records	Name, address, phone number, payment details
Commercial information	Plans, purchases, Credit use
Internet or network activity	Usage data, logs, pages viewed
Approximate geolocation	City or region from IP address or professional profile
Professional or employment information	Job title, employer, work history
Inferences	Fit and intent scores, professional interests
Sensitive personal information	Account login credentials, used only to authenticate you

Categories of Prospect Data (identifiers, professional information, approximate location and inferences) are made available to GTM customers as described in Section 8. Identifiers and internet activity from visits to trygtm.com are disclosed to our visitor identification providers, which may be a sale or sharing. See Section 8.1 to opt out of either. We do not use or disclose sensitive personal information for purposes that give California residents a right to limit it. Retention is described in Section 9.

15. EEA, UK and Swiss residents

J&T Solutions Inc., at the address in Section 19, is the controller for the processing described in Section 2.

Processing	Legal basis
Providing the Services to customers and users	Performance of a contract; our legitimate interests in serving business customers whose staff use the Services
Sourcing and supplying Prospect Data, and verification	Legitimate interests in business-to-business sales and marketing
Security, fraud prevention and suppression	Legitimate interests; legal obligation
Analytics and improvement	Legitimate interests
Marketing to customers and leads	Consent where the law requires it; otherwise legitimate interests
Billing, tax and record keeping	Legal obligation; contract
Legal claims	Legitimate interests

Right to object. You may object at any time to processing based on legitimate interests, including profiling, and to direct marketing. If you object to direct marketing, we will stop.

Automated decisions. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Complaints. You can complain to the supervisory authority where you live or work, or where an alleged infringement took place. In the UK that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

16. Google user data

This Section covers information we receive from Google APIs when you sign in with Google or connect a Google account to GTM, and anything we derive from it, such as reply classifications, meeting records and counts, including in aggregated or anonymized form ("Google user data"). For Google user data, this Section governs, and it overrides anything else in this Policy that would allow more.

GTM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

16.1 What we access

Google feature	What we access
Sign in with Google	Your name, email address, profile picture and Google account identifier
Gmail, when you connect a mailbox to send from	Permission to send email from your account, and read-only access to your messages so we can find replies to the emails GTM sent. We read incoming messages and their headers, body and sender. We never change, delete or label your email
Google Calendar, when you connect it for meeting booking	Your free and busy times, and your events' times, status, meeting links and attendees' email addresses and responses, which we read to find meetings with contacts in your workspace. We store only events GTM booked or that include a contact in your workspace, and never event titles or descriptions. We create and update the events for meetings booked through GTM

16.2 How we use it

We use Google user data only to provide and improve the features you use in the Services:

Sign-in: to create and manage your account, sign you in, show your name and picture in the app, and send you service, security and billing messages about your account.
Gmail: to send the emails you, or campaigns you set up, tell GTM to send; to recognize replies, bounces and opt-out requests to those emails; to show replies in your inbox and conversation history; to stop a sequence when someone replies or asks not to be contacted; and to write the reply drafts and answers you use GTM for.
Google Calendar: to offer times you are free, to book, update and cancel meetings arranged through GTM, and to confirm whether those meetings took place.

We keep counts derived from these features, such as the number of replies and meetings a workspace had, to show them in your reports and to operate and support the Services. These counts contain no message content.

16.3 What we never do with it

We do not use Google user data to serve advertising, including retargeting, personalized or interest-based advertising.
We do not sell Google user data, or give it to data brokers or information resellers.
We do not use Google user data to determine creditworthiness or for lending.
We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine learning models, and the AI model providers we use may not use it for training either.
We do not add Google user data to Prospect Data, make it available to any other customer or workspace, or use it to source, enrich or score prospects for anyone else.
We do not use Google user data to market GTM or anything else to you or anyone else.
We do not use or share Google user data for any purpose this Section does not describe.

We share Google user data only:

With your workspace. Replies and meetings appear to the authorized users of the workspace you connected the account to. For an agency, that includes the client workspace the reply belongs to.
With service providers that run the features, under contracts that limit their use to providing them: our mailbox connectivity provider, which connects your Gmail account to GTM; our cloud hosting and database providers; and AI model providers, which process message content only to classify replies, recognize meeting requests and write the drafts and answers described in Section 16.2. We route AI requests through a provider configured to exclude model providers that use request data for training. Our Subprocessors page names these providers.
At your direction. If you connect a CRM or another integration, we send it the reply activity you set it up to receive.
For legal and safety reasons, where needed to comply with applicable law or legal process, or to protect against fraud, abuse or security threats.
In a merger, acquisition or sale of assets, only after you give your explicit consent.

16.5 Human access

GTM staff do not read Google user data unless:

you give us permission for specific data, for example when you ask our support team to look into a conversation or a booking;
it is needed for security purposes, such as investigating abuse or a security incident;
it is needed to comply with applicable law; or
it has been aggregated and anonymized and is used for internal operations.

16.6 How we store, protect, keep and delete it

Storage and protection. Google user data is stored in the United States in our database, encrypted in transit and at rest, and separated by organization and workspace at the database level. Access tokens for Google Calendar are stored in our database, and Gmail access is held by our mailbox connectivity provider.
Gmail. A reply to an email GTM sent is kept in your workspace as part of that contact's conversation history, and is deleted when the contact is deleted, either by your workspace or at the end of the contact's retention period, and when your workspace data is deleted (Section 9). A copy that appears in your workspace's assistant conversations, or in a delivery to an integration you connected, is kept with that record and deleted with your workspace data. Other incoming email we read while looking for replies is deleted within 30 days. After that we keep only its message identifiers, so the same email is not processed twice.
Google Calendar. Meeting records are deleted when you disconnect Google Calendar or when the contact is deleted. We use free and busy times to offer meeting times, and do not keep them as a separate record.
Sign-in. Your name, email address and picture are kept while your account is open, and are deleted as Section 9 describes.
Disconnecting and revoking access. You can disconnect a Google account in the Services at any time, and you can revoke GTM's access in your Google Account settings. When you disconnect an account in the Services, we stop reading and sending from it and delete its access tokens. If you revoke access in your Google Account, those tokens stop working. To have Google user data that we still hold deleted sooner, email support@trygtm.com with the subject line "Google data deletion". We will delete it within 30 days, except where the law requires us to keep it.

17. Text messages from TryGTM

This Section covers the text messages TryGTM sends from its own phone numbers. Our SMS Terms give the full program terms.

How you opt in. By checking the text message box on a TryGTM form: our waitlist form or our support form. The box is optional and unchecked, and it is separate from every other choice on the form. Consent is not a condition of purchase.
What we send. Only what the form you used describes: from the waitlist form, messages about your waitlist spot, the GTM launch, onboarding, support and GTM product updates; from the support form, messages about your support request and your account.
Frequency and cost. Message frequency may vary. Message and data rates may apply.
Stopping and help. Reply STOP to opt out at any time, or HELP for help. You can also email support@trygtm.com. Carriers are not liable for delayed or undelivered messages.
What we keep. Your number, when you opted in or out, the exact consent wording you agreed to, and the messages we sent you.
Sharing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as the provider that delivers our text messages, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Texts that a GTM customer sends you from its own messaging account are not TryGTM's messages. The customer is responsible for them, and Section 4.4 explains how to stop all contact through GTM.

18. Children

The Sites and Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

19. Changes and contact

We may update this Policy. We will post the new version with a new date and, if the changes are material, give notice by email or in the Services before they take effect.

Contact. J&T Solutions Inc., d/b/a GTM, Attn: Privacy, 251 Little Falls Drive, Wilmington, DE 19808, United States. Email support@trygtm.com.

Privacy Policy