This policy explains how [COMPANY LEGAL NAME], registered at [REGISTERED ADDRESS] under company number [COMPANY REGISTRATION NUMBER] ("we", "us"), handles personal data when you use Gem0 (gem0.dev, app.gem0.dev, api.gem0.dev). We are the controller for the data described below. You can reach us at [CONTACT EMAIL].
1. What we collect
- Account data. Your email address, name, password hash, and company or team details you provide when you sign up or invite members.
- Content you store. The schemas, documents and assets you put into your projects. This may include personal data of your end users; for that data you are the controller and we process it on your behalf (see section 6).
- Usage and log data. API request logs (timestamps, project, API key ID, endpoint, response status, IP address), dashboard activity and audit trail events. We use these to operate the Service, meter plan usage, debug problems and detect abuse.
- Billing data. Payments are handled by Stripe. We do not store your full card details; we keep subscription status, invoices and the billing information needed for tax and accounting.
- Communication. Emails you send us and transactional emails we send you (for example, invitations and password resets).
We do not use advertising trackers and we do not sell personal data.
2. Why we process it (lawful bases)
- Contract (art. 6(1)(b) GDPR): providing the Service, managing your account and subscription, support.
- Legal obligation (art. 6(1)(c)): invoicing, tax and accounting records.
- Legitimate interest (art. 6(1)(f)): securing the platform, preventing abuse, keeping operational logs, and improving the Service based on aggregate usage. You may object to processing based on legitimate interest (see section 7).
- Consent (art. 6(1)(a)): only where we ask for it separately, for example product news emails. You can withdraw consent at any time.
3. Processors we use
We share personal data only with processors that help us run the Service, under data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and subscription billing | EU/US (see section 5) |
| Postmark | Transactional email (invitations, password resets, billing notices) | US (see section 5) |
| Cloudflare | Hosting, CDN and DDoS protection | EU edge, global network (see section 5) |
We may disclose data where the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply to the data.
4. How long we keep data
- Account data: for as long as your account exists, then deleted within 90 days of account deletion.
- Customer Content: until you delete it or your account is closed; after closure you have 30 days to export, after which content is deleted. Encrypted backups roll off within a further 90 days.
- API and access logs: up to 13 months, then deleted or anonymised.
- Invoices and billing records: as long as tax law requires (in Belgium, generally 7 years).
5. International transfers
We host the Service in the EU. Some processors (Stripe, Postmark, Cloudflare) may process data in the United States or other countries outside the EEA. Where that happens, transfers rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the processor is certified) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
6. Your end users' data
Content you store in Gem0 may contain personal data of your own users. For that data, you are the controller and we are your processor: we process it only on your instructions, as set out in our data processing terms (available with a DPA on Agency and Enterprise plans). Requests from your end users about their data should go to you; if they reach us, we will forward them to you.
7. Your rights under the GDPR
As a data subject you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten") where no legal ground requires us to keep it;
- receive your data in a portable, machine-readable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- restrict processing while a dispute about the data is resolved;
- withdraw consent where processing is based on consent.
To exercise a right, email [CONTACT EMAIL]. We respond within one month. We may ask you to verify your identity first. If you believe we handle your data unlawfully, you can lodge a complaint with your local supervisory authority; in Belgium that is the Gegevensbeschermingsautoriteit (data protection authority), gegevensbeschermingsautoriteit.be.
8. Security
We protect data with measures appropriate to the risk, including encryption in transit, encrypted backups, access controls with per-project API keys, audit logging and the principle of least privilege for staff access. No system is completely secure; if a breach affects your personal data, we will notify you and the supervisory authority as the GDPR requires.
9. Changes to this policy
We may update this policy as the Service or the law changes. For material changes we will notify you by email or in the dashboard before they take effect. The date at the top shows the latest revision.
10. Contact
Privacy questions and data subject requests: [CONTACT EMAIL], or by post to [COMPANY LEGAL NAME], [REGISTERED ADDRESS].