Privacy Policy

Last updated 25 October 2026

Version 2.0

This policy explains what personal data Webgarh Solutions Private Limited ("Webgarh", "we", "us") processes when you use the Webgarh GTM Assistant Shopify app (the "App"), visit gtmassistant.app (the "Site"), or contact us; why we process it; and the choices and rights you have.

1. Who we are, and our role

Webgarh Solutions Private Limited, a company registered in India (CIN U72200CH2013PTC034390), provides the App and the Site.

We play two different roles:

• For data about you — as a merchant, a member of a merchant's team, a Site visitor or someone who contacts us — we decide why and how the data is used. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary; under the GDPR, the controller.
• For data about a merchant's customers (shoppers), which the App processes so the merchant can send conversion events to the platforms they choose, we act on the merchant's instructions. The merchant is the Data Fiduciary (controller) and we are their Data Processor. The merchant's own privacy policy applies to shoppers, and shoppers should send their requests to the merchant. We help merchants answer them. Our Data Processing Agreement with merchants is available on request at privacy@webgarh.co.in.

2. The data we process

We do not ask for sensitive data such as health or financial account details, and the App is not designed to process them.

3. Why we use it

• To provide the App: install and configure tracking, send the conversion events you enable to the platforms you connect, check that tracking works, and show you reports.
• To respect shoppers' consent: the App is built on Shopify's Customer Privacy API, so every customer's consent choice is respected before any event is sent.
• To support you: setup, audits, troubleshooting and answering your messages.
• To keep the service secure and working: diagnose errors, prevent misuse and protect our systems.
• To bill you: through Shopify's billing system.
• To send you updates you asked for: such as the newsletter, only after you confirm your sign-up. You can unsubscribe at any time.
• To meet legal obligations and to enforce our Terms of Service.

We use data only for these purposes. We do not sell personal data, and we do not use merchants' store or shopper data to advertise our own services.

Legal grounds. Under the DPDP Act we rely on your consent, or on a legitimate use the Act allows, such as data you give us voluntarily for a specific purpose. Where the GDPR applies, we rely on performing our contract with you, our legitimate interests in running and securing the service, your consent (for example the newsletter and non-essential cookies), and legal obligations.

4. Consent

Where we rely on consent, we ask for it clearly and for a stated purpose: for example, when you connect an account, sign up to the newsletter or accept analytics cookies. You can withdraw consent at any time, as easily as you gave it, by disconnecting the account, using the unsubscribe link, changing your cookie choice, or writing to privacy@webgarh.co.in. Withdrawal does not affect processing that took place before it. Some features may stop working without the related consent.

5. Who we share data with

We share personal data only as needed to provide the App and the Site:

• The platforms you connect — advertising, analytics and marketing platforms you choose to enable. They receive the event data needed for those platforms to work, under their own terms and privacy policies.
• Shopify — the platform the App runs on and through which billing happens.
• Our cloud hosting providers — who store and run our systems on our behalf, under contract.
• AI model providers — who run the AI model behind Sanjo chat on our behalf, under contract (currently Anthropic).
• Authorities — when the law requires it.
• A successor — if our business is reorganised or transferred, under the same protections.

We do not share personal data with anyone else.

6. Google user data

When you connect a Google account (for example Google Analytics, Google Ads or Google Tag Manager), we access Google data only with your authorisation, through Google's OAuth, and only to provide or improve the App features you use.

Webgarh GTM Assistant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not transfer it except to provide the App, to comply with the law, or as part of a merger or acquisition with your consent. People at Webgarh do not read your Google user data unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it has been aggregated and anonymised.

7. Sanjo, our AI agent

Sanjo is GTM Assistant's AI agent: an AI character, not a person. His voice and animation are generated with AI tools.

Where chat with Sanjo is available, your messages are processed by an AI model to answer you, and you can ask to reach a person at any time. Chat transcripts are kept for up to 12 months to answer follow-ups and improve answers, and are then redacted. Please do not share passwords or payment details in chat.

8. Where data is stored

We store and process data in India and the United States. Platforms you connect may process data in other countries under their own terms. Where the law requires safeguards for transfers out of the European Economic Area, the United Kingdom or India, we use them, such as standard contractual clauses.

9. How long we keep it

We keep personal data only as long as needed for the purpose it was collected for: up to 24 months, and shorter for some data. Then we delete it or make it anonymous. Exceptions:

• records we must keep by law, such as billing and tax records, are kept for the period the law sets;
• chat transcripts are redacted after 12 months, as described in section 7;
• when you uninstall the App, we act on Shopify's data-deletion requests for your store and its shoppers within the time Shopify requires.

10. Security

We protect personal data with reasonable security safeguards, including access controls, encryption in transit, and restricted staff access. No system is completely secure. If a personal data breach occurs, we will inform affected people and the authorities as the law requires.

11. Your rights

Depending on where you are, you may have the right to:

• India (DPDP Act): get a summary of your personal data and how we process it; have it corrected, completed, updated or erased; withdraw consent; have your grievance addressed; and nominate a person to exercise your rights if you die or become incapacitated.
• European Economic Area and United Kingdom (GDPR): access, correct, erase, restrict or object to processing, and receive your data in a portable form; and complain to your data protection authority.
• United States (states with privacy laws): know, access, correct and delete your data. We do not sell or share personal data for cross-context behavioural advertising.

To use a right, write to privacy@webgarh.co.in. We may need to verify your identity, and we respond within the time the law requires. If you are a shopper of a store that uses the App, please contact that store first; we will help them respond.

12. Children

The App and the Site are for businesses and are not directed at anyone under 18. We do not knowingly process children's personal data. If you believe we have, contact us and we will delete it.

13. Cookies

The Site uses cookies that are needed for it to work and, only after you accept them, analytics and advertising cookies to understand how the Site is used and to measure our own ads. You can change your choice at any time through Cookie settings on the Site or in your browser. Details are in our Cookie Policy.

14. Grievance Officer and contact

If you have a question or complaint about how we handle personal data, contact our Grievance Officer:

Bishal Adhikari, Grievance Officer, Webgarh Solutions Private Limited Email: privacy@webgarh.co.in

We will acknowledge your complaint and resolve it within the time the law requires. If you are in India and are not satisfied with our response, you may complain to the Data Protection Board of India.

15. Changes to this policy

We will update this policy when our processing or the law changes, and show the new effective date at the top. For material changes, we will tell merchants by email or in the App before the change takes effect.

Definitions

• App — the Webgarh GTM Assistant Shopify app.
• Data Fiduciary / controller — whoever decides why and how personal data is processed.
• Data Processor / processor — whoever processes personal data on a Data Fiduciary's instructions.
• Destination platform — an advertising, analytics or marketing platform a merchant connects to the App.
• Merchant — a business that installs the App on its Shopify store.
• Personal data — any data about an individual who can be identified by or in relation to it.
• Shopper — a customer or visitor of a merchant's store.
• Sanjo — GTM Assistant's AI agent.