Privacy Policy

1. Who is responsible

The data controller is TODO: legal entity name, TODO: registered address, tax ID TODO: VAT / tax ID. Contact for privacy requests: TODO: privacy@meetgami.com.

2. What we collect and why

When you create an account: your full name, company (optional), email address and password. The password is stored only as a salted hash by our authentication provider; we never see it. Purpose and legal basis: to create and run your account and provide the service you asked for (contract, art. 6(1)(b) GDPR).

When you use the service: the suppliers and products you save, notes, labels and order estimates; your credit balance and the history of credit purchases, grants, unlocks and refunds; the suppliers whose contact you unlocked and the message you generated; reviews, reports and replies you submit; your language and currency choices. Legal basis: contract (art. 6(1)(b)); for fraud prevention and abuse limits (unlock limits, reply-claim checks) our legitimate interest (art. 6(1)(f)).

Company verification: your work-email domain, and optionally a VAT number. For EU VAT numbers we check validity with the European Commission VIES service. Purpose: to grant welcome credits once per company and prevent abuse. Legal basis: legitimate interest (art. 6(1)(f)).

Payments (when enabled): purchases are handled by Stripe. Gami receives only the payment reference, amount, plan, billing name and country, and VAT number; card numbers never reach Gami. Legal basis: contract and legal obligation (invoicing and tax records, art. 6(1)(c)).

Emails: transactional messages about your account (sign-in codes, reply reminders, credit returned, supplier suspended, renewal and expiry notices). We keep a log of messages sent. We do not send marketing email without your separate consent.

Technical and usage data: anonymous page-view counts and QR-scan counts per supplier, and first-party product analytics events (such as viewing the pricing page) stored in our own database. We do not use Google or Meta advertising or analytics services. Legal basis: legitimate interest (art. 6(1)(f)) in operating and improving the service.

Cookies and local storage: only essential items (login session, language choice, your cookie preference, and saved favourites on your device before you sign in). See section 8.

3. What we do not collect

We do not sell personal data, we do not run advertising profiles, and we do not collect identity documents or biometric data from buyers. Supplier contact details are never shown publicly; they are shown only to a signed-in buyer who unlocked them.

4. Who receives your data

Our service providers, acting on our instructions as processors:

• Supabase (database, authentication, file storage)
• Vercel (website hosting and delivery)
• Resend (sending transactional email)
• Stripe (payments, when enabled)

When you unlock a supplier, that supplier may receive a notice that a buyer unlocked their contact. We do not give the supplier your email or contact details; the supplier sees your name or company only in the message you choose to send them yourself outside Gami.

We may disclose data if required by law or to protect our rights, for example to handle fraud reports.

5. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where this happens we rely on adequacy decisions or the European Commission's Standard Contractual Clauses. Suppliers are located in China: no personal data of yours is sent to a supplier unless you copy and send them a message yourself.

6. How long we keep data

• Account profile and saved items: until you ask us to delete your account.
• Credit ledger, purchases and invoices: as long as accounting and tax law requires (in Italy generally 10 years).
• Email log and anonymous analytics events: up to 24 months.
• Anonymous scan and page-view counts: aggregated, no retention limit as they are not personal data.
• Reviews you wrote may be kept in anonymised form after account deletion.

7. Your rights

You may ask us at TODO: privacy@meetgami.com to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent you can withdraw it at any time. We answer within one month. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

You can edit your name and company and change your password yourself on the Account page.

8. Cookies

We use only essential cookies and similar storage: the sign-in session (set by our authentication provider), your language, your cookie choice, and, before you sign in, your saved favourites kept on your device. These do not require consent. We do not use advertising or cross-site tracking cookies.

9. Security

Connections use HTTPS. Passwords are hashed. Access to the database is restricted by row-level security so each account sees only its own data, and supplier contacts are readable only through a server function that checks you unlocked them. No system is perfectly secure: if a breach affects you we will notify you and the authority as the law requires.

10. Children

Gami is a business service and is not intended for people under 18.

11. Changes

We may update this policy. Material changes are announced on this page with a new date, and, where required, by email or by asking you to accept the new version.