Skip to main content

Privacy Policy

Last updated: 2026-10-15

Last Updated: October 15, 2026

Effective Date: October 15, 2026

GigTry ("GigTry," "we," "us," or "our") operates the website gigtry.com and related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect personal information - and it describes the specific rights available to you under the privacy laws of your region, including the EU/EEA General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), China's Personal Information Protection Law (PIPL), Japan's APPI, South Korea's PIPA, Singapore's PDPA, and others listed in Section 12.

1. Who We Are (Data Controller)

The data controller for the Services is GigTry. You can reach our privacy contact at privacy@gigtry.com for any privacy question, request, or complaint. We respond to all privacy requests within the timelines required by your local law (see Section 11).

2. Scope of This Policy

This policy applies to all visitors, registered users, free-plan users, paid subscribers, and pay-as-you-go customers worldwide. It covers information collected through the website, the AI tools, the marketplace, account creation, checkout, and support channels. It does not cover third-party services that operate under their own privacy policies, such as Stripe or PayPal when you interact directly with their hosted checkout pages (see Section 7).

3. Information We Collect

3.1 Information You Provide

  • Account information: name (or username), email address, and password when you register
  • Payment information: billing details collected at checkout - payments are processed by our payment processors (Stripe and PayPal); we do not store full card numbers on our servers
  • Content you process: the text, prompts, and inputs you provide to AI tools and the outputs generated for you
  • Communications: messages you send to support, feedback, and survey responses

3.2 Information Collected Automatically

  • Usage data: pages visited, tools used, generations performed, and features accessed
  • Device and log data: browser type, operating system, device type, IP address, referring URLs, access times, and error logs

3.3 Cookies and Similar Technologies

We use cookies and local storage for essential site functions and - only with your consent, where consent is required - for analytics and marketing measurement. Full details, including the specific cookies used, are in our Cookie Policy.

4. How We Use Your Information and Why (Legal Bases)

We process personal information for the following purposes. Where the GDPR applies, each purpose is paired with its legal basis under Article 6:

  • To provide the Services - operate accounts, run AI tools, deliver generated content, process payments, prevent abuse. (GDPR basis: performance of a contract, Art. 6(1)(b))
  • To secure and maintain the platform - security monitoring, fraud prevention, debugging, enforcing our Terms. (GDPR basis: legitimate interests, Art. 6(1)(f), and compliance with legal obligations, Art. 6(1)(c))
  • To communicate with you - transactional messages about your account, subscriptions, and payments; responses to support requests. (GDPR basis: performance of a contract, Art. 6(1)(b))
  • To send marketing communications - product updates and offers, where permitted. Every marketing email includes an unsubscribe link, and residents of regions requiring prior opt-in receive marketing only after opting in. (GDPR basis: consent, Art. 6(1)(a), or legitimate interests where permitted by local e-marketing law)
  • To measure and improve - aggregate analytics about how the Services are used, collected via Google Analytics 4 only after you grant analytics consent where consent is required. (GDPR basis: consent, Art. 6(1)(a))
  • To comply with law - tax, accounting, and other legal obligations. (GDPR basis: legal obligation, Art. 6(1)(c))

We do not sell your personal information, and we do not use your AI inputs or outputs to train AI models (see Section 5).

5. AI Processing

5.1 Inputs and Outputs

When you use an AI tool, your input is sent to the AI model provider selected for that tool, strictly to generate your result. We do not use your inputs or outputs to train AI models.

5.2 Provider Conditions

We work with established AI service providers under terms intended to restrict the use of customer content, including training on your inputs. Provider arrangements may change as we add or switch providers; this section will be updated if material changes occur.

5.3 Sensitive Inputs

Do not submit sensitive personal information (for example, government ID numbers, health data, or special-category data as defined in Article 9 GDPR) as tool inputs. If you submit it anyway, it is processed as ordinary content under this policy, and you should delete it via your account history where possible.

6. Cookies and Consent Management

We use a consent banner that lets you Accept All or Reject All non-essential cookies, or manage categories individually:

  • Essential (always active): login session, security, and core platform functions
  • Analytics: Google Analytics 4 - loaded in Consent Mode v2 with all non-essential storage denied by default; analytics identifiers are only set after you accept analytics cookies. Where consent is denied, aggregate cookieless measurement may still occur (this is the GDPR-compliant Consent Mode behavior)
  • Marketing: advertising and campaign measurement - denied until you opt in
  • Functional: preference features such as the support chat widget

You can change or withdraw consent at any time via the Cookie Policy page. Consent is re-requested every 180 days. Where local law sets a higher bar (for example, age-of-consent rules for children in some EU member states), we apply the local standard.

7. Information Sharing and Recipients

We do not sell personal information. We share it only with:

  • Payment processors: Stripe, Inc. and PayPal - to process your payments and subscriptions. They act as independent controllers for fraud and compliance on their platforms
  • Hosting: Vercel Inc. - application hosting and global content delivery (see Section 8 on transfers)
  • Analytics: Google (Google Analytics 4) - only where analytics consent has been granted where consent is required
  • AI service providers - to process tool inputs and return outputs (Section 5)
  • Communication tools - email delivery for transactional and (where consented) marketing messages
  • Professional advisers and authorities - auditors, lawyers, and law enforcement or regulators, only where required by law, legal process, or to protect rights, property, or safety
  • Business transfers - in connection with a merger, acquisition, or asset sale, with notice via this policy

8. International Data Transfers

GigTry operates globally. Your information is processed in the United States and other countries where our providers operate, which may not offer the same level of data protection as your home country. Where personal data is transferred out of your region, we rely on appropriate safeguards:

  • From the EU/EEA: adequacy decisions where available, otherwise the European Commission's Standard Contractual Clauses (SCCs), supplemented where needed by transfer risk assessments and additional technical measures
  • From the UK: the UK International Data Transfer Addendum to the EU SCCs and the UK Extension to the EU-US Data Privacy Framework where applicable
  • From Switzerland: the revised Federal Act on Data Protection (revFADP) and the Swiss-US Data Privacy Framework where applicable
  • From other regions: the mechanisms required by local law - for example, PIPL cross-border mechanisms for mainland China residents, and consent-based or adequacy-based mechanisms for other jurisdictions

You may contact privacy@gigtry.com for information about the safeguards applied to your transfer.

9. Data Retention

  • AI inputs and outputs: retained in your history for 90 days, then deleted
  • Account data: retained while your account is active, then deleted 30 days after account deletion (except where retention is legally required)
  • Payment records: retained as long as required by applicable tax and accounting laws
  • Analytics data: aggregated, anonymized usage data may be retained indefinitely; consent-bound analytics identifiers are deleted or de-identified per Google Analytics retention settings
  • Support communications: retained as long as needed to resolve your request and for a reasonable period thereafter

10. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls and authentication, least-privilege access for staff and contractors, rate limiting and abuse monitoring, and regular dependency and security reviews. No method of transmission or storage is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the relevant supervisory authority as required by applicable law.

11. Your Privacy Rights and How to Exercise Them

Depending on where you live, you have some or all of the rights below. To exercise any of them, email privacy@gigtry.com with the subject line "Privacy Request." We will verify your identity (for example, by confirming account ownership) and respond within the statutory deadline of your region - typically 30 days under GDPR, 45 days under CCPA, 30 days under LGPD, and similar periods elsewhere. You will not be discriminated against for exercising your rights.

  • Access / know: get a copy of the personal information we hold about you
  • Rectification: correct inaccurate personal information
  • Erasure / deletion: request deletion of your personal information (subject to legal retention duties)
  • Portability: receive your data in a structured, commonly used, machine-readable format
  • Restriction / limitation: ask us to pause processing in certain circumstances
  • Objection: object to processing based on legitimate interests, including profiling
  • Withdraw consent: withdraw a previously given consent at any time (this does not affect prior lawful processing)
  • Opt out of marketing: unsubscribe via any marketing email link or your account settings
  • Deletion of account: self-service account deletion where available, or by request

If you are unhappy with our response, you may lodge a complaint with your local supervisory authority - for example, your national data protection authority in the EU/EEA, the Information Commissioner's Office (ICO) in the UK, the Federal Trade Commission or your California Attorney General in the US, the ANPD in Brazil, the CAC in China, the PPC in Japan, PIPC in South Korea, or the PDPC in Singapore.

12. Regional Privacy Disclosures

This section describes additional rights and obligations that apply because of where you live. Where a local law gives you rights beyond those in Section 11, this section describes them.

12.1 European Union and European Economic Area (GDPR)

  • We process personal data only on the legal bases listed in Section 4
  • You have the full set of GDPR data subject rights (Section 11), the right to lodge a complaint with your national supervisory authority, and the right to judicial remedy
  • Automated decision-making: we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (Article 22)
  • Data protection impact assessments are performed where processing is likely to result in high risk

12.2 United Kingdom (UK GDPR and Data Protection Act 2018)

  • The same rights and legal bases apply as in the EU/EEA
  • You can complain to the Information Commissioner's Office (ICO)
  • Transfers from the UK rely on the UK Addendum and UK Extension to the EU-US Data Privacy Framework where applicable

12.3 Switzerland (revFADP)

  • Swiss residents have rights equivalent to those in Section 11
  • Transfers rely on Swiss adequacy decisions, the Swiss-US Data Privacy Framework, or equivalent safeguards

12.4 United States (CCPA/CPRA and US State Privacy Laws)

  • We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months
  • California residents have the right to know, delete, correct, port, limit the use of sensitive personal information, and opt out of sale/sharing. Analytics and marketing cookies are opt-in via our consent banner, which functions as your opt-out tool
  • We honor the rights of residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Florida) - including rights to confirm processing, correct, delete, port, and opt out of targeted advertising and profiling. We do not process the personal data of known minors under 16 for targeted advertising
  • "Shine the Light" (California Civil Code 1798.83): we do not disclose personal information to third parties for their direct marketing purposes
  • Authorized agents may submit requests on your behalf with proof of authorization

12.5 Canada (PIPEDA)

  • We collect, use, and disclose personal information with meaningful consent, limited to purposes a reasonable person would consider appropriate
  • You may access your information, challenge its accuracy, and withdraw consent (subject to legal and contractual restrictions)
  • Complaints may be directed to the Office of the Privacy Commissioner of Canada

12.6 Brazil (LGPD)

  • Legal bases are the LGPD's legal grounds, including consent, contract performance, legitimate interests, and legal compliance
  • You have rights of confirmation, access, correction, anonymization/blocking/deletion, portability, information about sharing, and review of automated decisions
  • The national authority is the ANPD (Autoridade Nacional de Protecao de Dados)

12.7 Mainland China (PIPL)

  • Personal information is processed only for clear, reasonable purposes with your consent or another PIPL legal basis, and we apply the principle of minimum necessity
  • For cross-border transfers, we rely on the applicable PIPL mechanism (standard contract filing, certification, or separate consent where required) and will provide the recipient's details on request
  • You have rights to access, copy, correct, delete, withdraw consent, and request an explanation of our processing rules
  • We do not provide personal information to foreign judicial or law-enforcement authorities without complying with applicable Chinese law

12.8 Japan (APPI)

  • We handle personal information within the purposes of utilization described in this policy and keep data accurate and secure
  • You may request disclosure of retained personal data, correction, suspension of use, and information about third-party provision records
  • Cross-border transfers include informed consent or equivalent safeguards; complaints may be directed to the Personal Information Protection Commission (PPC)

12.9 South Korea (PIPA)

  • We collect personal information lawfully with consent where required, notify items collected and purposes, and limit retention to the necessary period
  • You have rights to access, correction/deletion, suspension of processing, and consent withdrawal
  • Cross-border transfers are made with informed consent or under PIPA's permitted exceptions; complaints may be directed to the Personal Information Protection Commission (PIPC) or KISA

12.10 Singapore (PDPA)

  • We notify purposes and obtain consent before collection, use, or disclosure, except where the PDPA permits otherwise
  • You may withdraw consent, request access and correction, and ask about our data protection policies; our data protection contact is privacy@gigtry.com
  • Complaints may be directed to the Personal Data Protection Commission (PDPC)
  • We do not send marketing messages to Singapore numbers registered on the Do Not Call registry without checking the registry or obtaining clear unambiguous consent

12.11 Malaysia (PDPA 2010)

  • We provide notice and choice, limit processing to notified purposes, and apply security and retention principles
  • You have rights of access and correction, and may withdraw consent in writing to privacy@gigtry.com

12.12 Thailand (PDPA)

  • We process personal data on the PDPA's legal bases (including consent and contract) and honor rights of access, portability, objection, erasure, suspension, and rectification
  • Complaints may be directed to the Personal Data Protection Committee (PDPC Thailand)

12.13 India (Digital Personal Data Protection Act, 2023)

  • We process personal data for lawful purposes with notice and, where required, consent
  • You may request access, correction, completion, updating, erasure, and nominate another individual to exercise your rights
  • Grievances may be sent to privacy@gigtry.com and escalated to the Data Protection Board of India

12.14 Other Asia-Pacific

  • Indonesia (PDP Law), Philippines (Data Privacy Act), and Vietnam (PDPD/Decree 13): we apply notice, purpose limitation, consent, security, and your rights of access, correction, deletion, and objection consistent with each law
  • Australia (Privacy Act 1988 / APPs) and New Zealand (Privacy Act 2020): we handle personal information openly, allow access and correction, and do not use or disclose it for direct marketing without a lawful basis and a working opt-out

12.15 Middle East

  • United Arab Emirates (Federal PDPL, Law No. 45 of 2020): we process personal data fairly and lawfully with notice, purpose limitation, and security, and honor access, correction, and deletion requests
  • Saudi Arabia (PDPL, Royal Decree M/19): we process with consent or another permitted basis, honor access, correction, deletion, and withdrawal-of-consent rights, and apply required transfer safeguards
  • Qatar (Law No. 13 of 2016): we apply notice, consent, security, and retention duties and honor access and correction requests

12.16 Africa

  • South Africa (POPIA) and Nigeria (NDPA 2023): we apply lawful processing, purpose specification, security safeguards, and your rights of access, correction, deletion, and objection to direct marketing

13. Children's Privacy

The Services are not directed to children. We do not knowingly collect personal information from children under 13 (or under the higher age set by your local law - for example 14 in some jurisdictions, or 13-16 depending on the EU member state for consent-based processing). If we learn we have collected a child's personal information without proper consent, we will delete it promptly. Parents and guardians may contact privacy@gigtry.com.

14. Automated Decision-Making and Profiling

We do not engage in automated decision-making that produces legal effects or similarly significantly affects you. We use automated tools for fraud prevention, abuse detection, and credit/rate limiting; where these affect your access, a human review is available on request at privacy@gigtry.com.

15. Changes to This Policy

We may update this Privacy Policy as our services, providers, or laws change. Material changes will be posted on this page with an updated "Last Updated" date, and where required we will notify you directly (for example, by email) or re-request consent. The version posted here is the current version.

16. Contact Us

  • Privacy requests and questions: privacy@gigtry.com
  • Data protection matters (EU/UK/Swiss-style requests): privacy@gigtry.com with the subject line "Privacy Request"
  • Billing and payment questions: billing@gigtry.com
  • Legal questions: legal@gigtry.com