Privacy Policy

1. Data we process

• Account: email address, name and picture of your Google account if you sign in with Google, language, sign-up date.
• Profile and product: your niche, the TikTok or Instagram profile you connect (username and public profile data), your product's website and the product sheet we draw from it.
• Usage: searches, saved videos, generated ideas and scripts, credit use, team seats.
• Subscription: plan, status, period dates and payment identifiers sent by Whop or Stripe. We never receive your card details.
• Studio: your script text, the transcripts of your footage, the versions of your edit and the descriptions of b-roll to generate. For transcription, we receive the audio track of your footage and pass it to ElevenLabs (or, when it does not answer, to a transcription model through OpenRouter), without keeping it.
• Conversations with Gumpilote: your messages, its replies and the changes it makes to your project, kept on our servers so that you find your history on all your devices and so that we can improve Gump. You can delete a conversation at any time from Gumpilote's history.
• Technical data: server logs (IP address, requests, errors), kept for security and reliability.

2. Why (and on what basis)

• To provide the service, your account and your subscription (performance of the contract).
• To tailor searches and recommendations to your niche and product (performance of the contract).
• To keep your history with Gumpilote on all your devices (performance of the contract) and to improve Gump from these conversations (legitimate interest).
• To bill, prevent fraud and meet our accounting obligations (legal obligation, legitimate interest).
• To secure and improve the service and understand cancellations (legitimate interest).

We do not sell your data or use it for targeted advertising.

3. With whom

We share data only with the providers the service needs, who process it on our behalf:

• Supabase (accounts and database, Sweden region), Google Cloud (API, Belgium region), Vercel (website);
• ElevenLabs: transcription of the audio track of your footage;
• OpenRouter and the AI model providers it routes requests to (Anthropic, OpenAI, Google, Microsoft, ByteDance): transcription when ElevenLabs does not answer, analyses, scripts, Gumpilote, image and clip generation;
• Whop and, for earlier subscribers, Stripe: payments and subscriptions;
• providers of public social media data (ScrapeCreators, TikHub, RapidAPI) and Firecrawl (reading your product page).

Some of these providers are located outside the European Union, notably in the United States. These transfers rely on the European Commission's standard contractual clauses or the Data Privacy Framework.

4. How long

• Account and usage data: for as long as your account exists, then deleted within 30 days of its deletion.
• Conversations with Gumpilote: for as long as your account exists, then deleted within 30 days of its deletion. You can also delete a conversation yourself at any time.
• Billing data: 10 years, for our accounting obligations.
• The audio track sent for transcription is not kept after transcription.
• Technical logs: 12 months at most.

5. Your rights

You can access, correct and delete your data, restrict or object to its processing, or ask for its portability. You can delete your account yourself from Settings, or write to us at support@gump.si. We reply within one month.

If you live in the European Union and believe your rights are not respected, you can lodge a complaint with your country's data protection authority.

6. Security and minors

Data is encrypted in transit, database access is restricted and protected, and API keys are kept in a secrets vault.

The service is not intended for anyone under 16. If you believe a minor has sent us data, write to us and we will delete it.

7. Changes

We update this policy as the service evolves; the date at the top shows the latest version.