Privacy Policy
GTM Alpha is committed to protecting your personal data. This policy explains what data we collect, why we collect it, how we use it, and your rights regarding your data.
1. Data Controller
Helix GTM Consulting ("we", "us", "our") is the data controller for personal data collected through this website and services.
Contact:
Shashwat Ghosh
Email: shashwat@gtmhelix.com
Website: gtmalpha.gtmhelix.com
2. Data We Collect
2.1 Premium Audit form
| Data | Why | Where it is kept |
|---|---|---|
| Your name and role, company name, company description, GTM challenge, industry, business stage, team size, monthly budget, primary focus, company website and LinkedIn URL, and, if you choose to give them, your contract value band, deal cycle band, net revenue retention band, number of addressable accounts, main deal source, primary market and whether you offer self-serve sign-up | To build your Premium Audit report | Not kept. The form sends your answers to /api/premium-audit, which checks them, builds the report in the same request and returns it to your browser. Our code does not store or log the answers or the report, and sends them to no one |
The form does not ask for your email address, and no payment is taken, so no payment details are asked for. The report stays in your browser tab; if you download the PDF, it is saved on your device.
2.2 EPIC audit API
If you or an application send data to /api/epic-audit, the inputs are saved with the audit result in our Netlify Blobs database (store "epic-audits").
2.3 MCP server
When an AI assistant calls a GTM Alpha tool through /mcp (or the older address /mcp-sse), the server receives the tool name and the inputs for that call and uses them only to build the reply. Our code does not store or log these inputs or the results, and it never receives your conversation. Replies are sent with Cache-Control: no-store.
2.4 Data collected automatically
- Our pages include no analytics or tracking scripts and set no cookies.
- Netlify, which hosts this site, processes each request (including your IP address and browser details) to deliver it and to apply the rate limits, and keeps its own logs: netlify.com/privacy.
- Our pages load their fonts, images and scripts from this site. The generated report loads a PDF library from cdnjs, which receives your IP address when your browser loads it.
2.5 Older records
Earlier versions of this site saved consultation form answers in three other stores: "pending-payments" (until 25 September 2026, when the form stopped using PayPal), "gtm-consultations" and "consultations". Nothing writes to them now. Existing records are kept until you ask us to delete them.
3. How We Use Your Data
- Build your Premium Audit report and EPIC scores from your answers
- Answer EPIC audit API and MCP tool calls
- Comply with legal obligations
We do not sell your data, share it with competitors or use it to train AI models.
4. Data Sharing
- Netlify: hosting, our Blobs database (EPIC audit API records and the older records) and request logs (as a data processor)
- cdnjs: receives your IP address when your browser loads the PDF library for the generated report
- Legal authorities: when required by law
5. Data Retention
| Data | How long it is kept |
|---|---|
| Premium Audit form answers and reports | Not stored |
| EPIC audit API inputs and results (store "epic-audits") | Until you ask us to delete them. There is no automatic deletion |
| Older consultation records (stores "pending-payments", "gtm-consultations" and "consultations") | Until you ask us to delete them |
| MCP tool inputs and results | Not stored |
| Netlify request logs | Kept by Netlify under its own policy |
6. Your Rights
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a machine-readable format
- Restriction: Limit how we process your data
- Object: Object to processing based on legitimate interests
- Withdraw Consent: Where processing is based on consent
To exercise these rights, email us at shashwat@gtmhelix.com with subject "Data Rights Request". Records are stored by company name and time, so please include your company name and roughly when you used the site. We find and delete records by hand within 30 days.
7. Cookies
Our pages set no cookies and include no analytics, advertising cookies or tracking pixels.
8. International Transfers
Your data may be processed in:
- India: Primary business location
- United States: Netlify hosting
Netlify processes this data in the United States under its own data processing terms.
9. Security
- HTTPS encryption for all data in transit
- Security headers on every page, including a Content-Security-Policy that also stops other websites from framing this site
- No user accounts or passwords are held by us, and no payments are taken
- Rate limits: the Premium Audit form, the EPIC audit API and the health check share 30 requests a minute per visitor; the MCP server allows 300 a minute
- The Premium Audit form accepts only its own fields, each with a length limit, and a hidden field refuses automated submissions
- Stored records cannot be read back through any public endpoint
10. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect data from children.
11. Changes to This Policy
We may update this policy. Changes are published on this page with a new date.
12. Complaints
If you have concerns about our data practices:
- Contact us first at shashwat@gtmhelix.com
- You may also lodge a complaint with your local data protection authority
Contact our Data Protection contact: shashwat@gtmhelix.com