PRIVACY POLICY

GDPR Compliance Statement

1. Information We Collect
   1. You provide: Name, contact info, payment details, account content (e.g., uploaded photos).
   2. Automatic collection: IP, device/browser, cookies, site and feature usage data.
   3. From third parties: Partners and vendors as permitted by law.
2. Facial Recognition & Biometric Data
   1. We process biometric data including facial attributes from photos for our AI-powered search and tagging features.
   1. 1. Lawful Basis: Biometric data is only processed with your explicit, informed, opt-in consent (GDPR Articles 6, 9)
      2. How consent works: You must actively agree before any facial recognition is enabled or your images are analyzed; this consent can be withdrawn at any time in your account settings.
      3. DPIA: All facial recognition is subject to regular Data Protection Impact Assessments as required by the GDPR.
3. Use of Content
   1. We use client-uploaded content only to provide, secure, and operate the Gump Platform. We do not use client-uploaded media to train or fine-tune our AI models, and we do not use such content for marketing, demos, or other promotional purposes without prior written consent.
4. How We Use Data
   1. Provide, operate, and improve Gump’s products and services
   2. Account management and customer support
   3. Communications, billing, and security
   4. Personalization
   5. Legal and regulatory compliance
5. Cookies & Tracking
   1. Cookies are used for analytics, essential features, and personalization. See our Cookie Policy for details.
6. Data Sharing & Disclosure
   1. Affiliates, contractors, and providers as needed to operate our services
   2. Required disclosures to regulators or during business transfers
   3. Never: We do not sell your personal data
7. Retention and Deletion
   1. Client content remains in the account until it is deleted by the client or removed in accordance with our retention policy. Deleted content will be removed from our active systems within a reasonable period, subject to backup cycles, legal obligations, or contractual requirements.
8. Access and Security
   1. Access to client data is restricted to authorized personnel only, for support, maintenance, security, and compliance purposes. We protect data using appropriate technical and organizational security measures, including encryption and access controls.
9. International Transfers
   1. Where data is moved internationally, Gump.gg ensures GDPR-standard safeguards are in place.
10. Your Rights
    1. You may request to:
    2. 1. Confirm if we hold your data
       2. Access, correct, delete, or export your data
       3. Withdraw consent (including for biometric/facial processing)
       4. Object to or restrict data use
       5. Lodge a complaint with a data protection authority
    3. Contact hello@gump.gg to exercise these rights.
11. Children’s Privacy
    1. Our platform is not intended for those under age 18. We delete any such data if discovered.
12. Third-Party Services
    1. We are not responsible for privacy practices or content of external services linked on our site.
13. Changes to this Policy
    1. We will notify users of key changes. Use after such notice constitutes acceptance.
14. Contact
    1. Questions, concerns, or requests regarding privacy may be sent to: hello@gump.gg.