Privacy Policy

Information we collect

• Account & profile data — when a creator signs up, we collect your email address and the profile details you choose to publish (display name, headline, bio, portfolio samples, tools, and service listings).
• Contact & request data — when you join the waitlist or send a hire request, we collect your email, your message/brief, and any optional details such as budget.
• Order & delivery data — buyer contact details, the purchased listing snapshot, price, licence, brief, delivery, revisions, dispute reason, status history, and Stripe transaction references. Stripe—not GenGigsAI—collects full card and bank details.
• Consent data — what you agreed to, the consent version/source and time, and any unsubscribe request.
• Usage & security data — basic device/request information collected by our hosting providers. Abuse-prevention buckets use a one-way hash of request identifiers rather than storing raw IP addresses or emails.
• Email operations data — if transactional email is activated, we retain a one-way recipient hash, template and authorization identifiers, delivery state, retry state, suppression status, and privacy-minimized signed-webhook events. We do not put email subject/body content, clicked URLs, IP addresses, or user-agent strings in the operational email ledger.

How we use your information

• To operate the marketplace — create accounts, publish creator profiles and listings, and connect buyers with creators.
• To respond to hire requests, waitlist signups, and support enquiries.
• To maintain the security, integrity, and performance of the Service.
• To process test or live payments when enabled, manage creator transfers, refunds, disputes, fraud prevention, and accounting.
• To send marketing only where we have a lawful consent basis, and to honour unsubscribe choices.

How we share information

We do not sell your personal information. We share data only with service providers that help us run the Service:

• Supabase — database and authentication.
• Vercel — application hosting and content delivery.
• Stripe — checkout, connected-account onboarding, payment processing, transfers, refunds, disputes, and fraud controls.
• Resend — transactional sending, signed delivery events, suppression, and inbound routing only after the email domain, database schema, exact authorization, and canaries are enabled. Provider sending remains disabled until those gates pass.

Creator profiles, listings, and portfolio samples that you publish are public by design. A buyer's contact details and brief are disclosed to the selected creator as needed to respond or deliver. We may also disclose information if required by law or to protect users and the Service.

Cookies and measurement

We use a small number of essential cookies or local-storage records, primarily to keep the site working and remember required settings. A submitted customer brief is first-party operational data. Allowlisted campaign fields are retained with that brief only after the corresponding database schema has been explicitly applied and verified; if that schema is unavailable, the brief is retained without campaign attribution. This first-party capture does not depend on optional analytics consent.

When optional measurement is configured, Google Analytics remains blocked until you make an affirmative choice in the cookie settings panel. After that choice, Google may measure page views and the successful submission of a customer brief as a generate_lead event. Advertising storage, ad user data, ad personalization, Google signals, and Meta tracking remain disabled. Analytics events do not include your email, name, brief text, or reference URL.

Your choice is stored in first-party local storage, and you can change or withdraw it from the cookie settings panel. Withdrawing after tags have loaded reloads the page so the third-party code is no longer active.

Campaign measurement is limited to allowlisted UTM fields. Brief text, email addresses, and other direct personal information must not be placed in analytics event names, parameters, or campaign URLs. We will update this policy and the consent version before materially changing the optional providers or purposes.

Email delivery and engagement

Requested-service acknowledgements are transactional and are kept separate from lifecycle or outreach email. Transactional open and click tracking are disabled. If the transactional lane is activated, signed provider events may record accepted, delivered, delayed, bounced, complained, failed, suppressed, and inbound-routing states against a known GenGigsAI message. Unknown events from a shared provider account are quarantined or ignored and cannot create a GenGigsAI suppression.

Lifecycle, promotional, and outreach email remain separately gated. They require an applicable consent or other documented legal basis, a working unsubscribe and suppression path, and a separate exact authorization before sending or engagement tracking can be enabled.

Data retention & security

• Waitlist/marketing records: until you unsubscribe or after 24 months without engagement; a minimal suppression record may remain so we continue to honour your choice.
• Unconverted hire requests and managed briefs: up to 24 months after the last activity.
• Active account/profile/listing data: while the account is active, then targeted for deletion or anonymization within 30 days of a verified request, subject to legal exceptions and backup expiry.
• Order, payment, refund, transfer, dispute, and other financial records: generally six years from the end of the relevant tax year, or longer for an unresolved dispute, chargeback, legal hold, or other required period.
• Rate-limit buckets: normally no more than 24 hours.

We use row-level access controls, server-only payment credentials, scoped HttpOnly buyer cookies, input limits, and audit logs. No method of transmission or storage is 100% secure. Operational deletion and backup procedures are documented internally.

Your rights

You may request access to, correction of, export of, or deletion of your personal information by emailing hello@gengigsai.com. We verify requests before acting. We may retain the minimum records required for tax, fraud, payment, dispute, safety, or legal obligations and will explain any exception.

Marketing choices

Waitlist marketing uses an unchecked-by-default express opt-in. Marketing sending is not active during validation. Before any marketing email is enabled, it must identify the sender and provide a working one-click unsubscribe plus the visible preference link. You may also email hello@gengigsai.com; unsubscribe requests are targeted for completion immediately and no later than 10 business days. Transactional order or support messages may still be sent.

Children

The Service is only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date above.

Contact

The Service is operated by Krishna Dogra, operating as GenGigsAI, 5 Defries Street, Toronto, Ontario M5A 0W7, Canada.

Questions about privacy? Email hello@gengigsai.com.