UTM Registry

Privacy

Last updated: 15 October 2026

Who is responsible

UTM Registry is operated by Web Wombats LLC. For any privacy matter: analytics@webwombats.com.

What the tool does

UTM Registry generates campaign links and keeps a registry of who created which link and when. It processes only what that takes.

What data there is

  • Access. Your work email address, your role, your markets and divisions, your language, the time of your invitation and of your last sign-in. Created when an administrator of your company invites you.
  • Sign-in. Sign-in works through Google only. We receive your verified email address and your name from Google; no password, and no access to your Google account beyond that.
  • Registry. Every copied link with its parameters, landing page, platform, campaign, market, your address as its author and the time. The registry is the purpose of the tool; entries can be deleted and restored, administrators can remove them for good.
  • Feedback. If you send feedback: your text, your address, the page, your browser and any screenshots you attach.
  • Access requests. What you enter in the request form: company, work email, markets, contact person, note.
  • Technical. Short-lived server logs of the hosting (IP address, requested address, time) and an internal log of failed sign-ins and failed saves, used to spot problems. When someone signs in without access, Web Wombats receives an email with that address so the person can be invited.
  • Page views. Anonymous counts through Vercel Web Analytics: the path visited, country, device type and browser, without cookies and without anything after the path. Individual people cannot be identified from it.

Cookies

Without your consent, only what the tool needs to work: a session cookie after sign-in, a cookie for your chosen language and one that remembers your cookie choice (ww_consent, 12 months, for every utmregistry.com address). One-time hints are remembered locally by your browser. No advertising cookies.

Microsoft Clarity, only with consent. If you accept in the cookie notice, Microsoft Clarity records how pages are used: clicks, scrolling, mouse movement, page changes, device and browser. All text and all input is hidden in your browser before anything is sent; campaign names, links and email addresses never leave it. Clarity sets the cookies _clck (up to 1 year) and _clsk (1 day) on this site, Microsoft also sets its own cookies on bing.com and clarity.ms (MUID, CLID and SRM_B up to 13 months, MR 7 days, SM for the session, ANONCHK 10 minutes), and Clarity sends the data to Microsoft. The full list with purpose and duration is under “Cookie settings”. The legal basis is your consent; you can withdraw it at any time through “Cookie settings” in the page footer or the profile menu, which stops Clarity and deletes its cookies on this site; Microsoft's cookies on bing.com and clarity.ms can only be cleared in your browser. Without consent, Clarity is not loaded at all.

Record of your choice. Every cookie decision is stored as proof (Art. 7(1) GDPR): a random consent ID, the time, your choice, the version of the notice, the language and the page path. No IP address, no browser details, no name. We keep the record for three years, then it is deleted automatically.

Where the data lives

  • Database and sign-in: Supabase, Frankfurt region (EU). Each company sees only its own data; the database itself enforces that.
  • Application: Vercel, functions in Frankfurt (EU), delivered through a global network.
  • Email: Resend, for invitations and feedback notifications.
  • Sign-in: Google, for Sign in with Google.
  • Usage analytics, only with consent: Microsoft Clarity (Microsoft Corporation). Data may be transferred to the USA; Microsoft is certified under the EU-US Data Privacy Framework.

These providers act as processors on our instructions. We do not sell data and do not share it for advertising.

For how long

  • Registry entries: as long as the workspace exists, unless someone deletes them.
  • Access data: as long as access exists; ended access is kept with its start and end as the billing basis.
  • Feedback and screenshots: 365 days.
  • Access requests: 90 days after handling, 365 days if never handled.
  • Internal problem log: 90 days.

Legal basis

Processing serves the contract with your company (Art. 6(1)(b) GDPR) and our legitimate interest in a secure service (Art. 6(1)(f) GDPR); for users in Switzerland the FADP applies accordingly.

Your rights

Access, rectification, erasure, restriction, portability and objection, as far as the law provides. Write to the address above; for data inside your workspace, your company's administrator is your contact as well.