Privacy Policy

1. Introduction

Etals Core AB, org. nr 559460-5759 ("Etals", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website etals.com and use our services.

By accessing or using our services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

• Submit a contact, demo, waitlist, or event-audit form
• Subscribe to our newsletter or other communications
• Request access to our platform or free tools
• Submit support requests, feedback, or survey responses
• Provide content (text, product data, URLs) to our AI tools for processing

This may include your first and last name, business email address, company name, job title, company domain/website, competitor domains, phone number (where provided), and how you found us. We require a business email on most forms and reject common free-mail providers to maintain data quality.

2.2 Information Collected Automatically

When you access our website, we automatically collect certain information about your device and usage, including:

• IP address and approximate location (country/region)
• Browser type, version, language, and user agent
• Operating system and device type
• Screen and viewport size
• Pages visited, referring URL, and time spent on each page
• Scroll depth, click events, CTA interactions, and outbound link clicks
• Form views, form starts, form submissions, and form errors
• Tool usage events (e.g. generations, copies, rate-limit hits)

2.3 Marketing Attribution Parameters

When you arrive from an ad or marketing campaign, we capture attribution parameters in your browser and forward them to our CRM and ad platforms with the forms you submit, to measure campaign performance. For your current visit they are kept in session storage. If you accept Marketing cookies, they are also kept for 30 days in our first-party etals_attr cookie, so a form you submit on a later visit can still be linked to the ad that brought you. These include:

• UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
• Google Click ID (gclid) for Google Ads attribution
• LinkedIn First-Party Ad ID (li_fat_id) for LinkedIn Ads attribution
• Meta click ID (fbclid) and Meta's browser cookies (_fbp, _fbc) for Facebook & Instagram Ads attribution
• ChatGPT Ads click reference (oppref) for ChatGPT Ads attribution, stored in HubSpot as the OpenAI click ID
• Referring URL and landing page

3. Analytics, Advertising & Tracking Technologies

We use a combination of analytics, advertising, and CRM technologies to understand how visitors interact with our website, measure campaign performance, and improve our services. Non-essential trackers only load after you grant the corresponding consent in our cookie banner.

3.1 Google Analytics 4 (GA4)

We use Google Analytics 4 (via direct gtag() calls) to analyze traffic and user behavior. In addition to standard page views and sessions, we send custom events such as cta_click, scroll_milestone, form_view, form_start, form_submit, form_submit_error, waitlist_signup, tool_generate, tool_result_copied, tool_limit_reached, conversion_popup, and outbound_click. We also set GA4 user properties for audience segmentation. The Google tag runs on every page in Google Consent Mode and sets no analytics cookies until you accept Analytics cookies.

3.2 Google Tag Manager

We use Google Tag Manager to manage and deploy marketing and analytics tags without modifying our site code directly.

3.3 Google Ads & Enhanced Conversions

We use Google Ads conversion tracking and remarketing. For high-intent conversions (such as waitlist signups, demo bookings, and event audits), we use Enhanced Conversions: your email address (and, where available, first/last name) is hashed (SHA-256) in your browser before being sent to Google to improve conversion attribution. Different conversion actions are used per intent level (e.g. demo, waitlist, event signup). The Google Ads tag runs on every page in Google Consent Mode and sets no advertising cookies until you accept Marketing cookies. When you submit a form with Marketing consent, our server also reports the conversion to Google Ads: the conversion action, time, a shared event ID, a SHA-256 hash of your email address and, where provided, of your phone number, and the gclid value if you arrived from a Google ad.

3.4 LinkedIn Insight Tag & Conversions API

We use the LinkedIn Insight Tag for conversion measurement, retargeting, and audience insights on LinkedIn Ads. We fire dedicated LinkedIn conversions for actions such as Book Demo, Waitlist Signup, Event Signup, and Demo Page View. The Insight Tag may set cookies and capture li_fat_id. The Insight Tag is loaded only with Marketing consent.

When you submit a form with Marketing consent, our server also reports the conversion directly to LinkedIn through its Conversions API. That report contains the conversion type, the time, a shared event ID, a SHA-256 hash of your email address and, if you arrived from a LinkedIn ad, the li_fat_id value. We do not send your name, phone number or the unhashed email address to LinkedIn.

3.5 HubSpot (CRM, Marketing Automation & Tracking)

HubSpot is our CRM and marketing automation platform. When you submit any form on our site, the data is sent server-side via our backend functions to HubSpot to create or update a contact. Stored fields typically include name, business email, company, website/domain, competitors (where provided), how you found us, lead tier (e.g. demo, waitlist, specific event audit), and the marketing attribution parameters listed in section 2.3.

We also load the HubSpot tracking script, which sets the hubspotutk cookie and related HubSpot cookies (__hstc, __hssc, __hssrc) to recognize returning visitors, attribute pageviews to the correct contact, and enable HubSpot email and lifecycle automation. The script is loaded only after you accept Marketing cookies, including when you arrive from an ad. Your choice in our cookie banner is passed to HubSpot and applies to everything HubSpot loads. If you later withdraw Marketing consent in Cookie settings, HubSpot stops tracking and its cookies are removed. Ad-click parameters (such as utm values and click IDs) are still sent with forms you submit, so we can see which campaign brought you to us.

3.6 Meta Pixel & Conversions API

We use the Meta Pixel and the Meta Conversions API to measure how well our Facebook and Instagram ads work and to build audiences for similar ads. The pixel sets the _fbp cookie, and a click on one of our ads may set the _fbc cookie from fbclid. When you submit a form, our server also reports the same conversion event (event name, time, and a shared event ID) directly to Meta, together with your browser's user agent, IP address, and those two cookie values, so the two reporting paths are counted once. We do not send your name or email address to Meta, hashed or unhashed. Loaded only with Marketing consent.

3.7 ChatGPT Ads Measurement Pixel and Conversions API

We use OpenAI's ChatGPT Ads Measurement Pixel and Conversions API to measure how well our ads in ChatGPT work. The pixel may set the __obref and __oppref cookies, and a click on one of our ads adds an oppref reference to the link. Besides form conversions, the pixel sends page views and engagement signals: the type of page you open (such as a customer case or the demo page), scrolling past 75 percent of a page, keeping a page open for 60 seconds, and starting the demo form. Each signal is sent at most once per page view. When you submit a form, our server also reports the same conversion (event type, time, shared event ID, page URL, user agent, IP address, those references and a SHA-256 hash of your email address) to OpenAI, so the two reporting paths are counted once. All of this happens only with Marketing consent; you can withdraw at any time in Cookie settings.

3.8 Rule (Email Marketing)

We use Rule for selected email marketing and automation. Rule may collect engagement data (opens, clicks) to help us improve our communications.

3.9 Google reCAPTCHA Enterprise

We use Google reCAPTCHA Enterprise to protect our forms from spam and abuse. reCAPTCHA collects hardware and software information (such as device and browser data, mouse and keyboard interactions, and IP address) and sends it to Google for risk analysis. This data is subject to Google's Privacy Policy and Terms. Loaded only with Functional consent.

3.10 Backend Functions & Server-Side Processing

Form submissions are processed by our serverless backend functions (hosted on Lovable Cloud / Supabase infrastructure within the EU). These functions validate input, perform reCAPTCHA verification, apply rate limiting, and forward your data to HubSpot and other downstream services. We do not store form submissions in a long-term database: personally identifiable form data is forwarded to HubSpot and not retained on our backend (a "zero-storage" approach for PII).

3.11 Cookies & Local Storage

We use cookies, similar tracking technologies, and browser storage (localStorage) to remember your preferences, store cookie consent choices, persist marketing attribution parameters, and enable analytics and advertising. Our cookie banner lets you accept all, reject all, or customize by category (Necessary, Analytics, Marketing, Functional). You can change your choices at any time via "Cookie Settings" in the footer. The main marketing cookies are listed below; all of them are set only after you accept Marketing cookies.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send promotional communications (with your consent)
• Respond to your comments, questions, and support requests
• Analyze usage patterns to enhance user experience
• Detect, prevent, and address technical issues
• Comply with legal obligations
• Serve targeted advertisements on third-party platforms

5. Information Sharing and Disclosure

We may share your information in the following situations:

• Service Providers: With trusted third-party vendors that process data on our behalf, including HubSpot (CRM & marketing automation), Google (Analytics, Tag Manager, Ads, reCAPTCHA Enterprise), LinkedIn (Insight Tag & Ads), Meta (Facebook & Instagram ads & measurement), OpenAI (ChatGPT Ads measurement), Rule (email marketing), and our cloud and hosting providers (Lovable Cloud / Supabase, hosted within the EU)
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Requirements: When required by law or to protect our rights
• With Your Consent: When you have given us permission to share your information

We do not sell your personal information to third parties.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer need your information, we will securely delete or anonymize it.

8. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR):

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Restriction: Request restriction of processing
• Portability: Request transfer of your data to another service
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where we relied on consent

To exercise these rights, please contact us at privacy@etals.com.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: