Privacy Policy

Effective: October 9, 2026

Tag Docket is operated by MM Sanford, LLC, which is the controller of the personal data described in this policy. The agency decides what it puts into Tag Docket about its clients and campaigns.

What we do not store

• Passwords. There are none. You sign in with a link emailed to you.
• Who scanned a code. A short-code scan adds one to that code’s count and updates its last-scanned time. We do not store the scanner’s IP address, device, browser or location. The browser’s user-agent string is read at the moment of the redirect only to leave link-preview bots and crawlers out of the count, and is not kept.
• Trackers. We run no third-party analytics, advertising trackers or session recorders on this site or in the app.

Information you give us

• Account data. Your name, work email, the agency you belong to, your role and which clients you can reach. Sign-in links are created and verified through Firebase Authentication, a Google service, and emailed through Resend. When you start an agency yourself, we also record that you accepted the terms and this policy, and when.
• Registry content. Clients, campaigns, your taxonomy of dimensions and values, pairing rules, templates, and the links, short codes and QR codes you make, including their destinations. Each change is recorded in an audit trail with the email address of the person who made it, and stays attributed to them after they leave the agency.
• Imported files. Spreadsheets you import, as the rows you choose to write.
• Branding. For the white label, the agency website you paste in, and the colour and logo taken from it.
• Messages you send us. Anything you write in the contact form or by email, along with the agency you tell us about.
• Billing data. Paid plans are billed through Stripe. Card details are entered on Stripe’s systems and never reach ours. We keep a customer reference, your plan and your subscription status.

Google Analytics 4 connections

An agency can let Tag Docket read a client’s GA4 property in one of two ways.

• A service account. Each agency has its own Google service account; none is shared between agencies. It can read a client’s property only after someone with admin rights on that property adds it in GA4, and removing it there revokes access at once.
• Signing in with Google. An agency owner or admin can instead sign in with their own Google account and grant Tag Docket read-only access to Google Analytics (analytics.readonly), plus their email address so the agency can see whose account a client reads through.

Either way, access is read-only: Tag Docket cannot change anything in a GA4 property.

What we read from Google, and why

• Your properties’ names and IDs, listed when you connect, so you can pick a client’s property instead of typing its ID.
• Session counts and key-event counts by campaign tag (source, medium, campaign, content and landing page) for the last 30 days, and a 7-day session total when a connection is tested. We read these only to show the agency which of the links it created in Tag Docket brought traffic, and which tags in GA4 did not come from Tag Docket.

We do not read anything about the individual visitors in those reports; GA4 gives us totals per tag, not people.

What we keep

• The report totals above, cached for up to six hours so that browsing the History page does not spend the property’s daily quota. Each refresh replaces the last. They are deleted with the client or the agency.
• For a Google sign-in: the Google account’s email address and Google’s account ID, and the refresh token Google issues. The token is encrypted at rest, is never shown to anyone or written to logs, and is used only to make the reads described above. Disconnecting the account in Settings revokes the token at Google and deletes it from our database. You can also revoke it yourself at any time at myaccount.google.com/permissions.

Limited Use

Tag Docket’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the features described above to the agency that connected it. We do not sell it, use it for advertising, share it with anyone except the processors listed below as needed to run the service, or use it to train machine-learning models, and nobody at Tag Docket reads it except with your agreement, for security, or where the law requires.

Pages we fetch for you

The landing-page check fetches the destination you enter, to see whether it loads, redirects, carries an analytics tag or already has UTM parameters. The white-label check fetches the agency website you paste in. Both fetch only public web pages at the address you supply, identify themselves in the request, and refuse private and internal network addresses.

Information collected automatically

• Short-code scans. A count and a last-scanned time per code, as described above. Nothing about the person scanning.
• Hosting logs. Our hosting provider’s standard request logs record details such as IP address, browser and time for operating and securing the service, and are kept for 14 months. Contact-form submissions store a one-way hash of the sender’s IP rather than the address, which is enough to limit abuse.
• Browser storage. Only what signing in requires, plus conveniences such as remembering the email address you last used. No advertising or analytics cookies, so there is no consent banner.

This site loads its typefaces from Google Fonts, so your browser fetches those files from Google and Google sees the request.

How we use it

To run the service, send sign-in links, check short-code destinations against Google’s list of unsafe sites, answer you when you get in touch, bill you, and keep the system secure and working. We do not sell personal data, we do not share it for advertising, and we do not use registry content to train machine-learning models.

Who else processes it

• Google Cloud (Cloud Run, region us-east5, Ohio) hosts the app.
• Firebase Authentication (Google) creates and verifies sign-in links.
• Resend delivers sign-in, invitation and account emails.
• Google Web Risk receives the destination address of each short code when it is created or changed, to check it against Google’s list of unsafe sites.
• Neon hosts the Postgres database, on AWS in us-east-2 (Ohio).
• Stripe processes payments for paid plans.
• Google Analytics Data and Admin APIs are used for the GA4 connections your agency sets up.
• Firebase (Google) hosts this website and stores contact-form submissions, and Resend delivers those submissions to our inbox.

Each processes data only to provide its service to us. We will update this list before adding another, and note the change in the effective date above.

Keeping agencies separate

Each agency’s data is scoped to that agency. A member list never shows which other agencies a person belongs to, and a member limited to certain clients cannot see that other clients exist.

Export and moving to another agency

Records about a client belong to that client. An agency can export a client’s records at any time, free, in a readable format with values written out in full. If a client moves to another agency on Tag Docket, the receiving agency requests the transfer and the agency holding the client approves it. If that agency declines or does not answer within 14 days, we may approve it at the client’s request, and we record a note of why with both agencies. Once approved, the client’s records move to the receiving agency, and the outgoing agency keeps a read-only archive of the work it did.

How long we keep it

Registry content is kept while the agency’s account exists. Cancelling a plan deletes nothing, and retiring a client archives it rather than deleting it, because printed codes must keep resolving. An account that only ever used a trial, and never moved to a paid plan, is deleted with its content one year after the trial ended; its owners are emailed beforehand.

An account owner can ask us in writing to close the account and delete its data. We will talk through an export first if you want one, and then delete the account within 30 days of the request. Database backups roll over every 7 days, so deleted data is gone from them 7 days after it is deleted from the live service.

Contact-form messages are kept for 14 months, and hosting logs for 14 months.

Your rights

You can see and export your agency’s data from inside the app at any time, and ask us to correct or delete personal data about you. If you are a client of an agency that uses Tag Docket, ask that agency first; we will help them answer. Depending on where you are, laws such as the GDPR or the CCPA may give you further rights, including the right to object or to complain to a supervisory authority. Ask us and we will help you exercise them.

Where data is held

Tag Docket runs in the United States, and so does every processor listed above. If you are outside the United States, using the service means your data is processed there. For personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum), and on our processors’ certifications under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where they hold them.

Children

Tag Docket is a business tool and is not directed to anyone under 18.

Changes to this policy

We post changes here and update the effective date. We email account owners about material ones before they take effect.

Contact

Privacy questions, or a request about your own data: hello@tagdocket.com. MM Sanford, LLC, Green Bay, WI.