Privacy Policy

Effective October 9, 2026

GTM Swag helps businesses send personal, physical gifts to the people they work with. This policy explains what information Better Swag (“Better Swag”, “we”, “us”), the operator of GTM Swag, collects, how we use and share it, how long we keep it, and the choices you have. It covers our business customers and their teammates, and the people who receive their gifts.

If you received a gift and never signed up for GTM Swag, start with Information about gift recipients.

1. Information we collect

Account information

Your email address and name, and your company or workspace name.
If you sign in with Google, we ask Google only for your basic profile (the openid, email and profile permissions). We keep your verified email address, your name and Google’s account identifier for you. We do not receive your Google password and we do not store your profile photo.
If you sign in with an email code, we send a six-digit code to your address. GTM Swag does not use passwords.

Workspace and team information

Workspace settings you choose, such as your company name, website, meeting link and brand color.
Teammates’ names, email addresses and roles, and team invitations (the invitee’s email address, role and who invited them).
Integration settings: API key names (with a short prefix so you can recognize them) and when each key was last used, and webhook endpoints you configure.
Campaigns, gift choices, printed notes and messages, logos and artwork you upload, and activity you record, such as replies or meetings you report after a gift.

Recipient information our customers provide

To prepare a gift, a customer gives us information about each recipient. They may type it in, upload a CSV file, or send it through our API or a connected AI assistant. Depending on the campaign, this can include:

name, company and job title;
a work email address (optional);
a LinkedIn profile URL;
a US shipping address;
a printed gift note, a welcome message, and short research context used to personalize the gift;
identifiers from the customer’s own systems (for example, a CRM record ID), and any other columns from an uploaded file that the customer chooses to keep;
a photo, for gifts personalized with a portrait, uploaded by the customer or imported from a web address the customer provides;
for alcohol gifts, the customer’s confirmation that the recipient is 21 or older. We do not collect a date of birth or identity document.

Information recipients give us

When a recipient opens a private gift link, they can enter a US shipping address (street, city, state and ZIP code) and, if we do not already have it, the name for delivery. They can also decline the gift or report it. A report includes the reason the recipient types. We do not ask recipients for an email address or phone number.

Gift, order and payment activity

Gift and order status, such as when a gift was created, when an address was confirmed, when a gift was declined, and shipping updates including the carrier and tracking number.
An audit log of actions in GTM Swag: what was done, by which account or system, to which record, and when.
Payment records. Payments are made through Stripe’s hosted checkout. We receive the payment status, amounts and Stripe reference numbers. We never receive or store your full card number.

Technical information

Your IP address is used briefly to limit repeated requests and prevent abuse, for example on sign-in and gift pages. These short counters expire within an hour and are then deleted. We do not store IP addresses or browser user-agent strings with your account or with gift records.
Our hosting provider, Cloudflare, processes request logs to operate the service. We configure those logs to remove URL query strings and not to be kept in persistent log storage.

2. How we use information

To provide GTM Swag: sign you in, run your workspace, build campaigns, and show your team its gifts, links and reports.
To review, produce and deliver gifts, including printing personalization and calculating sales tax.
To process payments, refunds and tax records.
To send service emails: sign-in codes, account verification and team invitations.
To keep GTM Swag secure, prevent abuse, review reports, and enforce our Terms of Service.
To answer support requests.
To understand overall use of our public pages through anonymous, aggregate counts (see analytics).
To meet legal, tax and accounting obligations.

We do not sell personal information. We do not use recipient information for our own marketing, we do not add recipients to a mailing list, and GTM Swag does not email recipients on a customer’s behalf. Customers share gift links through their own outreach.

3. AI-assisted features

GTM Swag can suggest a short gift note using Cloudflare Workers AI. To write a suggestion, we send the model the gift name, the recipient’s name, company, job title and research context, and the angle and tone the customer chose. We treat that information as source material, not as instructions, and we tell the model not to invent facts or make a gift conditional on a meeting. Each workspace has a daily limit on suggestions. A suggestion is only a draft until the customer edits and approves it.

4. ChatGPT, Claude and other connected tools

Customers can connect GTM Swag to ChatGPT, Claude or another tool that supports the Model Context Protocol (MCP), or use a workspace API key.

A signed-in person approves each connection on a GTM Swag consent page that shows the workspace and the permissions requested. The permissions are gifts:read (view gifts, campaigns and tracking), gifts:write (prepare drafts and add recipients) and gifts:links:read (retrieve private gift links and recipient exports, which requires separate consent).
No connection or API key can approve spending, pay for a gift, add funds, change approval rules or email gift recipients. Gifts are approved by a signed-in person, or by an auto-approve rule an owner or admin set for a playbook. ChatGPT, Claude and other connected assistants also cannot change your team or manage webhooks.
When you use a connected assistant, information you ask it to send to GTM Swag, and information GTM Swag returns to it, is also handled by that assistant’s provider (for example OpenAI or Anthropic) under its own privacy policy.
You can disconnect at any time at gtmswag.com/chatgpt/oauth/disconnect (ChatGPT) or gtmswag.com/oauth/disconnect (Claude and other tools). This revokes your connections for that workspace. Saved drafts and history stay in GTM Swag.

Within a workspace. Members of a workspace can see its campaigns, recipients, gifts and reports, and each other’s names and email addresses.
With the sender. An address a recipient enters on a gift page is available to the sender’s workspace and to our fulfillment staff.
Suppliers and carriers. To produce and deliver a gift, our staff give the supplier that makes it and the carrier that ships it the recipient’s name, shipping address and the gift’s personalization.
Service providers. We use Cloudflare to host GTM Swag, store data and files, run AI suggestions and resolve web addresses safely; Stripe to process payments, refunds and sales tax (Stripe receives your company name and email address, and the recipient’s shipping address to calculate tax); Resend to deliver sign-in, verification and invitation emails; and Google to sign you in if you choose Google sign-in. They process information on our behalf to provide these services.
Tools you connect. Information goes to the assistants, API clients and webhook endpoints you set up. Webhook events contain gift and campaign IDs, your own record identifiers, statuses and shipping tracking details. They do not contain recipient names, email addresses or postal addresses.
Legal and safety. We may disclose information when the law requires it, or to protect the rights, property or safety of our customers, recipients, Better Swag or others.
Business transfers. If Better Swag is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction, subject to this policy.

A small number of Better Swag staff, using verified accounts on an allowlist, can see workspace, order and recipient records to review and fulfill orders, provide support and investigate abuse.

6. Cookies, browser storage and analytics

GTM Swag uses only these cookies, all of them essential:

gtm_session keeps you signed in for up to 30 days. Signing out ends the session.
gtm_auth and gtm_google protect an email-code or Google sign-in while it is in progress. They last 10 minutes.

We do not use advertising cookies or analytics cookies. Your browser also stores unsaved campaign drafts and a few display preferences locally on your device, and temporarily holds files you are importing. Drafts are cleared when you sign out.

Site analytics. We count page views ourselves, as daily totals. For each view, your browser sends only a page category (such as “Homepage” or “Gift catalog”), a general source (direct, search, social, referral or internal) and whether the screen is mobile or desktop. We do not record the full web address, query strings, names, email addresses, gift links, IP addresses or a visitor ID. Private gift pages, invitations and settings are not counted. We skip counting when your browser sends a Do Not Track signal, and for staff and API traffic. We may also enable Cloudflare Web Analytics, a cookie-free service, on our public home, gift catalog and connection guide pages for signed-out visitors who have not sent a Do Not Track signal.

7. How long we keep information

Private gift links expire 14 days after they are created.
Sign-in codes expire after 10 minutes and work once.
Team invitations expire after 7 days.
Sign-in sessions last up to 30 days. Expired sessions are deleted automatically.
Connections to ChatGPT, Claude and other tools stay active for 30 days after you approve them or after the tool last renews its access, and end no later than one year after you approved them. Disconnecting ends a connection immediately. Expired and revoked connection records are removed by a daily cleanup.
Unfinished recipient file uploads are deleted after 6 hours. Download links for recipient exports expire after 24 hours.
Site analytics counts are deleted after 92 days.
Rate-limit counters that include an IP address are deleted within about an hour.
Account, workspace, campaign, recipient, order and payment records, photos and artwork are kept while the workspace is active and afterward as needed to provide support, resolve disputes, prevent abuse, and meet legal, tax and accounting obligations. We do not yet delete recipient information automatically after a gift is delivered. You can ask us to delete it (see Your choices and requests).

8. How we protect information

GTM Swag is served only over HTTPS, with HTTP Strict Transport Security and a strict content security policy.
Sign-in sessions, API keys and connection tokens are stored as one-way hashes, not in readable form. API keys and webhook signing secrets are shown to you once.
Webhook signing secrets and queued email contents are encrypted at rest.
Photos, logos and artwork are kept in private storage and can be viewed only by the owning workspace and our fulfillment staff. Recipients see only the sender’s logo, through their own gift link.
Requests are protected against cross-site forgery and rate-limited. Our staff console is limited to verified, allowlisted staff accounts, and API keys cannot use it.
Our audit log cannot be edited or deleted.

No system is perfectly secure. If you believe your account or a gift link has been exposed, contact us right away.

9. Information about gift recipients

This section is for people who receive a gift through GTM Swag but never signed up for it.

How your information reaches us

A business that wants to send you a gift (the “sender”) gives us your information, usually your name, company and job title, and sometimes your work email address, LinkedIn profile URL, shipping address or a photo. The sender decides whom to gift and is responsible for having the right to share your information with us. If the sender asks us to find a photo for a portrait gift, our staff use only an image the sender is permitted to use, and the sender must approve the exact image and confirm that permission. GTM Swag does not scrape LinkedIn.

What we hold and why

We hold the information the sender provided, any address you enter on your gift page, and the status of your gift. We use it only to prepare, personalize and deliver that gift and to keep the service safe. Your address is available to the sender’s workspace and to our fulfillment staff, and is given to the supplier and carrier that deliver your gift. We do not add you to a mailing list, we do not sell your information, and GTM Swag does not send you marketing emails.

Declining or reporting a gift

Every gift is optional and never conditional on a meeting or reply. On your private gift page, choose to decline and confirm with “Yes, decline this gift”. The gift is cancelled, nothing ships, and the sender sees that you declined. If something looks wrong or unwelcome, use “Report this gift” at the bottom of the page; our staff review every report.

Access or deletion

To ask what we hold about you, or to have it corrected or deleted, email eric@betterswag.com with your name and the company that sent the gift. Please do not send us the gift link itself. We may also let the sender know about your request so that it is honored in their records.

10. Your choices and requests

You can update workspace settings, remove teammates, revoke API keys, remove saved file columns, and disconnect connected tools yourself.
GTM Swag does not yet offer self-service account or data deletion. To request access to, a copy of, correction of, or deletion of your personal information, email eric@betterswag.com with the subject “Privacy request”. We may need to verify your identity first. Some records, such as payment, tax and audit records, may be kept where the law or security requires.
Depending on where you live, you may have additional privacy rights. We will respond to requests as applicable law requires and will not discriminate against you for making one.

11. United States only

GTM Swag delivers gifts only to addresses in the United States, and we store and process information in the United States and other places where our service providers operate.

12. Children

GTM Swag is a business service. It is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child’s information has been provided to us, contact us and we will delete it.

13. Changes to this policy

We may update this policy as GTM Swag changes. We will post the new version here with a new effective date, and for material changes we will take reasonable steps to let workspace owners know.

14. Contact us

Better Swag, operator of GTM Swag.
Email: eric@betterswag.com

See also our Terms of Service and Support page.