Privacy Policy

GA4 Sensei (“we”, “us”) runs the website ga4sensei.com and the GA4 and Google Tag Manager auditing app at app.ga4sensei.com (together, the “Service”). This policy explains what data we collect, why we collect it, who we share it with and how we protect it.

1. Information we collect

Account information

When you create an account we collect your name, your email address and, if you sign up with a password rather than Google, a securely hashed password. If you sign in with Google, we receive your name and email from your Google profile.

Google account access

To audit your GA4 properties and Tag Manager containers, we request access to your Google account through Google’s own consent screen:

• View and edit access to Google Analytics 4, requested when you connect. Audits only read your configuration and reporting data; edit access is used solely to apply an auto-fix you have reviewed and approved.
• Read access to your GA4 user permissions, used for the access-rights check.
• Access to read your Google Tag Manager containers (tags, triggers, variables) and their user permissions.
• Tag Manager edit and publish access, requested separately and only when you first choose to apply a GTM auto-fix. Every change is shown to you for review before anything is published.

We store your Google OAuth tokens encrypted, so we can keep auditing without asking you to reconnect every time. We never see or store your Google account password.

Audit data

We store the results of each audit you run (health scores, pass / warning / critical findings and a summary of what we checked) so you can follow your setup over time. We don’t keep the raw GA4 report data or GTM container contents beyond what’s needed to produce and show these findings.

Settings you give us

We store the settings you choose, so audits and features work the way you asked: check settings (for example checks you mark as accepted or not applicable, your domains, expected key events, approved accounts, values you confirm are not personal data, and your thresholds), monitoring schedules and the email addresses alerts go to, and the people you invite to your team.

Sign-in security

If you turn on two-step verification, we email you a 4-digit code when you sign in. We store only a one-way hash of each code; codes expire after 10 minutes and work once. If you choose “Don’t ask again on this browser”, we store a one-way hash of a random browser token and the browser type for up to 30 days. You can remove trusted browsers at any time from your Account page.

Billing information

Paid subscriptions are processed by Razorpay. We don’t receive or store your card details; we store your plan, subscription status and billing history.

Forms on our website

When you subscribe to our newsletter, request the sample report or ebook, or send us a message through the contact form, we store what you enter (such as your name, email, company and message), the page you submitted it from, any campaign tags in that page’s address, whether you agreed to receive tips by email, and a one-way hash of your IP address that we use only to block abuse. We use this to reply to you and deliver what you asked for, and we send marketing emails only if you subscribed or ticked the box.

How you use our website

With your consent, we use Google Analytics and Google Ads measurement to understand how visitors find and use our website. Details are in our Cookie Policy.

2. Cookies and similar technologies

We use a small number of cookies and browser-storage entries. Some are strictly necessary (keeping you signed in, remembering your cookie choices and security settings) and are always on. Analytics and advertising cookies are set only after you allow them in our cookie banner, and you can change your choice at any time. Our Cookie Policy lists every cookie, what it’s for and how long it lasts.

3. Google API Services User Data Policy

GA4 Sensei’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use data obtained from Google APIs only to provide and improve the auditing features you see in the product. We never sell or rent it, never use it for advertising, and never use it to train generalised AI/ML models.

4. How we use your information

• To run the GA4 and GTM audits you request, including scheduled audits you set up, and show you the results
• To apply auto-fixes you have reviewed and approved
• To send service emails: sign-in codes, password resets, email verification, security notices, team invitations and the monitoring alerts you configure
• To process subscription payments and manage your plan
• To reply to messages you send us
• With your consent, to understand how visitors use our website and measure our advertising
• To keep the Service reliable and secure, and to prevent abuse

5. Who we share data with

We use these providers to run the Service. Each receives only what it needs to do its job:

• Google: Analytics and Tag Manager APIs and Google Sign-In; on our website, with your consent, Google Analytics and Google Ads measurement
• Google Cloud Platform: hosting, databases and infrastructure
• Razorpay: payment processing for paid plans
• Zoho Mail: sends our service emails
• Cybot (Cookiebot): shows the cookie banner and stores your cookie choices

If you invite people to your team, they can see your account’s properties and reports according to the role you give them. We don’t sell your personal information, and we don’t share it with third parties for their own marketing.

6. Data retention

We keep your account, settings and audit history while your account is active. Your plan decides how much history you can view; older audits are hidden, not deleted, and reappear if you upgrade. Form submissions are kept until you ask us to delete them. Sign-in codes expire after 10 minutes and trusted browsers after 30 days. If you ask us to delete your account, we delete your data except what we must keep by law (for example billing records).

7. Your rights and choices

• Change your cookie choices at any time with “Cookie settings” at the bottom of our website.
• Disconnect Google or unlink a GTM container from the app at any time.
• Revoke GA4 Sensei’s access entirely from your Google Account permissions page.
• Unsubscribe from marketing emails at any time; service emails continue while you have an account.
• Ask us for a copy of your data, a correction, or deletion of your account by emailing hello@ga4sensei.com. We confirm once it’s done.

8. Security

Google OAuth tokens and other sensitive credentials are encrypted at rest, and all traffic is encrypted in transit (HTTPS). Sign-in cookies can’t be read by scripts on the page and are only sent over HTTPS. You can add two-step verification to your account for extra protection. Access to production systems is limited to the people who operate the Service. If you believe your account is at risk, change your password and contact us.

9. Children’s privacy

The Service is for business use and is not directed at children. We don’t knowingly collect personal information from anyone under 16.

10. Changes to this policy

We may update this policy as the Service changes. If we make material changes, we’ll update the “Last updated” date above and, where appropriate, tell you directly.

11. Contact us

Questions about this policy or your data? Email hello@ga4sensei.com.