Privacy Policy

This Privacy Policy describes how Casyl Digital, LLC ("Company", "we", "us", or "our") collects, uses, stores, protects, and shares information when you use TraceConverge (the "Service").

TraceConverge is an analytics implementation, onboarding, repair, and verification application that helps authorized users inspect, configure, repair, and verify Google Analytics 4 ("GA4") and Google Tag Manager ("GTM") implementations for websites they own, manage, or are otherwise authorized to administer.

By using the Service, you agree to the collection and use of information described in this Privacy Policy.

1. Information We Collect

We may collect the following categories of information.

A. Account and contact information

We may collect information you provide directly to us, including:

• Name
• Email address
• Company or business name
• Website URL
• Account preferences
• Support requests or other communications you send to us

B. Application usage information

We may collect information generated through your use of TraceConverge, including:

• Login and session activity
• Run history
• Website discovery results
• Implementation status
• Repair and verification results
• Error logs
• Audit logs
• Configuration choices made inside the application
• Timestamps and operational status information

C. Website and analytics implementation information

When you use TraceConverge to analyze or configure a website, the Service may collect or process technical information related to that website, including:

• Website URL and domain information
• Publicly available website source code or tag snippets
• Detected GA4 measurement IDs
• Detected GTM container IDs
• Tag, trigger, variable, and container configuration information
• Runtime analytics signal information used to determine whether tracking is functioning
• Implementation gaps, conflicts, or verification outcomes

D. Google account and Google API data

TraceConverge uses Google OAuth to allow authorized users to connect Google services required for analytics onboarding, inspection, configuration, repair, and verification.

Depending on the access mode selected by the user, TraceConverge may request access to one or more of the following Google services:

• Google account identity information, such as your email address and basic profile information, for authentication and account association
• Google Analytics Admin API data, including GA4 accounts, properties, web data streams, measurement IDs, and related configuration information
• Google Tag Manager API data, including accounts, containers, workspaces, tags, triggers, variables, container versions, and publishing status

TraceConverge supports both read-only and full-control access modes.

In read-only mode, TraceConverge uses Google API access only to inspect existing GA4 and GTM configurations and verify implementation status.

In full-control mode, TraceConverge may use Google API access to create, update, complete, version, or publish GA4 and GTM configuration changes that are explicitly authorized through the Service.

TraceConverge only accesses Google account, Google Analytics, and Google Tag Manager data needed to provide its analytics onboarding, repair, and verification features. TraceConverge does not access Gmail, Google Drive, Google Photos, Google Calendar, Google Contacts, or other unrelated Google user data.

2. How We Use Information

We use the information we collect only to provide, operate, support, and maintain TraceConverge, including:

• Authenticating users
• Connecting authorized Google accounts
• Discovering GA4 and GTM implementation status
• Identifying missing, incomplete, inconsistent, or non-functional analytics configurations
• Planning authorized setup or repair actions
• Executing user-authorized GA4 or GTM configuration changes
• Verifying whether analytics tracking is active and functioning
• Maintaining run history and audit logs
• Providing support and troubleshooting
• Retaining Google Analytics and Google Tag Manager account identifiers associated with previously scanned sites to improve the efficiency of future scans for the same site
• Analyzing aggregated and anonymized implementation data to identify common configuration patterns and inform future product improvements
• Complying with legal obligations

We do not use Google user data for advertising.

We do not sell Google user data.

We do not use Google user data to build advertising profiles.

We do not use Google user data to train generalized artificial intelligence or machine learning models.

We do not use Google user data for purposes unrelated to the user-facing features of TraceConverge.

3. Google API Services User Data

TraceConverge's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request Google API permissions that are necessary for TraceConverge functionality.
• We use Google user data only to provide or improve user-facing TraceConverge features.
• We do not transfer Google user data to third parties except as necessary to provide or secure the Service, comply with applicable law, or as otherwise expressly authorized by the user.
• We do not allow humans to read Google user data unless: (a) we have your affirmative agreement for specific data, such as in response to a support request you have initiated; (b) it is necessary for security purposes, including investigating abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized for internal operational analysis.
• We do not use Google user data for advertising, retargeting, or marketing profile creation.
• We do not sell, rent, or otherwise monetize Google user data.

4. OAuth Tokens and Authorization

When you connect a Google account, TraceConverge may receive OAuth access tokens and refresh tokens from Google.

OAuth tokens are used only to access Google APIs within the scope of permissions granted by the user.

We store OAuth tokens securely using encryption and access controls. Tokens are not sold, shared for advertising purposes, or used outside the functionality of TraceConverge.

Users may revoke Google access at any time through their Google Account permissions page or by disconnecting Google from within TraceConverge.

When you disconnect Google from within TraceConverge, when access is revoked through your Google Account permissions, when a session expires, when your account is deleted, or when continued access is no longer necessary, we delete or invalidate stored OAuth tokens in accordance with our retention and security practices.

5. Data Sharing

We do not sell, rent, or share personal information or Google user data with third parties for advertising purposes.

We may share limited information only in the following circumstances:

A. Service providers

We may use trusted service providers for hosting, database storage, logging, security monitoring, email delivery, payment processing, customer support, and other operational services. These providers may process information only as needed to provide services to us and are not permitted to use the information for their own advertising or marketing purposes.

B. Legal compliance and protection

We may disclose information if required to do so by law or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect the rights, property, or safety of Casyl Digital, LLC, our users, or others
• Investigate fraud, abuse, security incidents, or unauthorized access
• Enforce our agreements or policies

C. User-authorized sharing

We may share information when you direct us to do so or when sharing is necessary to complete an action you explicitly authorize.

6. Data Retention

We retain information only for as long as reasonably necessary to provide the Service, support users, maintain auditability, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service.

Our retention approach is as follows:

• Account and contact information is retained while your account remains active and for up to 24 months thereafter as needed for support, legal, or business records.
• Run history, discovery results, repair records, verification results, and audit logs are retained while your account remains active to support operational traceability, troubleshooting, compliance, and customer reporting.
• Google Analytics and Google Tag Manager account identifiers associated with scanned sites are retained while your account remains active and are deleted upon account deletion or upon your request.
• OAuth tokens are deleted or invalidated when you disconnect Google from within TraceConverge, when access is revoked through your Google Account permissions, when a session expires, when your account is deleted, or when continued access is no longer necessary.
• Support communications are retained as needed for customer service and internal records.

You may request deletion of your personal information as described in the "Your Rights and Choices" section below. We may decline or delay deletion requests where retention is necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Security

We use reasonable technical, administrative, and organizational safeguards designed to protect personal information and Google user data against unauthorized access, disclosure, alteration, and destruction.

These safeguards include:

• Encryption of sensitive credentials and OAuth tokens
• Access controls
• Tenant isolation controls
• Audit logging
• Secure session management
• Least-privilege access practices
• Monitoring and operational safeguards
• Secure development and deployment practices

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

8. User Controls

You may control access to your Google account data in the following ways:

• You may choose whether to authorize TraceConverge through Google OAuth.
• You may choose read-only or full-control access modes where supported.
• You may revoke TraceConverge's access through your Google Account permissions page or by disconnecting Google from within TraceConverge.
• You may request deletion of personal information associated with your account.
• You may contact us for support regarding account access, data deletion, or privacy questions.

Revoking Google access may limit or disable features that require Google API connectivity.

9. Cookies and Similar Technologies

TraceConverge and our website may use cookies, session storage, and similar technologies to:

• Authenticate users
• Maintain secure sessions
• Remember user preferences
• Improve application performance
• Understand usage patterns
• Protect against abuse or unauthorized access

We do not use cookies to sell personal information or to share Google user data for advertising purposes.

10. Your Rights and Choices

Depending on your location and applicable law, you may have rights regarding your personal information, including the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Request restriction of processing
• Object to certain processing
• Withdraw consent where processing is based on consent
• Request data portability
• Opt out of marketing communications

To exercise these rights, contact us at support@casyldigital.com.

We may need to verify your identity before fulfilling certain requests.

11. Marketing Communications

We may send Service-related communications, such as account, security, support, billing, or operational notices.

We may also send marketing communications where permitted by law. You may opt out of marketing communications at any time by using the unsubscribe link in the message or by contacting us.

Opting out of marketing communications does not prevent us from sending necessary transactional, security, or account-related messages.

12. Children's Privacy

TraceConverge is not intended for children under 13 years of age, and we do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13, we will take reasonable steps to delete that information.

13. Third-Party Links and Services

The Service or website may contain links to third-party websites, services, or documentation. We are not responsible for the privacy practices, content, or security of third-party services.

Your use of Google services is also subject to Google's applicable terms and privacy policies.

14. International Data Processing

Casyl Digital, LLC is based in the United States. Information collected through TraceConverge may be processed in the United States or other locations where we or our service providers operate.

By using the Service, you understand that your information may be transferred to and processed in jurisdictions that may have different data protection laws than your location.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will update the "Last Updated" date above and may provide additional notice where appropriate.

If we materially change how TraceConverge accesses, uses, stores, or shares Google user data, we will update this Privacy Policy and obtain any required user consent before using Google user data in a materially different way.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

Email: support@casyldigital.com