Updated 24 October 2026.
Controller and contact
Max Benz, Am hohen Stein 36a, 01189 Dresden, Germany. team@thegtmlead.com.
Account and security data
We store your email, verification timestamp, preferences, hashed login and session tokens, subscription identifiers and rate-limit records. Email links are single-use, expire after 15 minutes and are delivered by SendGrid. An essential Secure, HTTP-only, SameSite cookie maintains your session for seven days. MCP bearer keys are stored as hashes and can be revoked.
Your product data
Selected local files are parsed in your browser and are not uploaded to us. For scheduled monitoring we fetch and store the public feed URL, bounded product snapshots, findings, changes and notification state. Never provide private feeds or secrets in URLs.
Processors and international transfers
Cloudflare hosts the Worker, D1 database, queue and technical logs. SendGrid processes sign-in and alert email addresses and content. Stripe processes checkout, cards, invoices and subscriptions; we do not store card numbers. If you connect an MCP assistant, requested data is transmitted to that assistant’s provider under your account with them. Providers may process data outside the EEA; applicable provider data-processing agreements and transfer safeguards apply.
Purposes and legal bases
Account, subscription and product data are processed to provide your requested service (Article 6(1)(b) GDPR). Rate limits and technical security records support legitimate interests in secure operation (Article 6(1)(f)). Legal billing retention duties may apply (Article 6(1)(c)). Optional alerts can be disabled in Settings.
Retention and deletion
Monitored feed snapshots: 30 days; change events: 90 days. Your current successful baseline is retained while its monitor exists. Expired login, session and rate-limit entries are cleaned up by scheduled jobs. Delete monitors or your account in Settings to remove owned product records; legally required billing records may be retained separately by the payment provider.
Your rights
Contact the controller to request access, correction, erasure, restriction, portability or applicable objection rights. You may complain to a data-protection authority; the operator is based in Saxony, Germany.
Cookies and analytics
We use the essential authentication cookie. No advertising pixels or marketing analytics are installed, and fonts are served locally.