Privacy Policy

1. Data we process

• Account: email address, name and picture of your Google account if you sign in with Google, language, sign-up date.
• Profile and product: your niche, the TikTok or Instagram profile you connect (username and public profile data), your product's website and the product sheet we draw from it.
• Usage: searches, saved videos, generated ideas and scripts, credit use, team seats.
• Subscription: plan, status, period dates and payment identifiers sent by Whop or Stripe. We never receive your card details.
• Studio: your footage and projects stay in your browser. We receive the audio track to transcribe it (without keeping it), your script text, your messages to Gumpilote and the descriptions of b-roll to generate.
• Technical data: server logs (IP address, requests, errors), kept for security and reliability.

2. Why (and on what basis)

• To provide the service, your account and your subscription (performance of the contract).
• To tailor searches and recommendations to your niche and product (performance of the contract).
• To bill, prevent fraud and meet our accounting obligations (legal obligation, legitimate interest).
• To secure and improve the service and understand cancellations (legitimate interest).

We do not sell your data or use it for targeted advertising.

3. With whom

We share data only with the providers the service needs, who process it on our behalf:

• Supabase (accounts and database, Sweden region), Google Cloud (API, Belgium region), Vercel (website);
• OpenRouter and the AI model providers it routes requests to (Anthropic, OpenAI, Google, Microsoft, ByteDance): transcription, analyses, scripts, Gumpilote, image and clip generation;
• Whop and, for earlier subscribers, Stripe: payments and subscriptions;
• providers of public social media data (ScrapeCreators, TikHub, RapidAPI) and Firecrawl (reading your product page).

Some of these providers are located outside the European Union, notably in the United States. These transfers rely on the European Commission's standard contractual clauses or the Data Privacy Framework.

4. How long

• Account and usage data: for as long as your account exists, then deleted within 30 days of its deletion.
• Billing data: 10 years, for our accounting obligations.
• The audio track sent for transcription is not kept after transcription.
• Technical logs: 12 months at most.

5. Your rights

You can access, correct and delete your data, restrict or object to its processing, or ask for its portability. You can delete your account yourself from Settings, or write to us at support@gump.si. We reply within one month.

If you live in the European Union and believe your rights are not respected, you can lodge a complaint with your country's data protection authority.

6. Security and minors

Data is encrypted in transit, database access is restricted and protected, and API keys are kept in a secrets vault.

The service is not intended for anyone under 16. If you believe a minor has sent us data, write to us and we will delete it.

7. Changes

We update this policy as the service evolves; the date at the top shows the latest version.