Privacy notice

What this notice covers

Gistful is operated by SPACE CADET d.o.o. This notice explains how we handle personal data when you use Gistful, contact us, or use a paid plan. It does not replace the privacy notices of services you choose to connect with or visit.

Data we handle

We process account and workspace information needed to provide Gistful: sign-in identifiers supplied through the sign-in service; the profile, public links, target topics and questions you save; scan answers and cited-source links; generated drafts and actions; and support messages.

For subscriptions, we receive and keep the billing account, subscription state and verified order information needed to determine access, apply plan allowances and process any creator attribution you have chosen. Payment details are handled by Polar during checkout; Gistful does not ask you to enter card details into the app.

We also keep a small first-party product-measurement record linked to your account. It records when we first observe an authenticated account after this measurement is enabled, whether a workspace was created, a successful scan finished, results were first opened, an upgrade or checkout was first started, a subscription was activated, and a later successful scan finished. The first-authenticated measure is not account registration or a historical account count. It does not contain your questions, answers, drafts, profile details, email address, payment details, or provider response data.

Why we use it

We use this information to authenticate you, keep your workspace private, run the scans and draft requests you initiate, show saved results, provide support, prevent misuse, administer an active subscription, and understand whether the product helps people reach and revisit results.

Our bases for processing are performance of our agreement with you, our legitimate interests in operating and protecting the service, and legal obligations where they apply. Optional website analytics and creator attribution rely on your consent. We do not use workspace content to make automated decisions with legal or similarly significant effects.

Who processes it

We use service providers to operate the service: Clerk for sign-in, Convex for application storage and server operations, DataForSEO for the measurement requests that make up a scan and for draft generation, Polar for billing and the customer portal, and Vercel for website hosting. Resend is used for enabled account and service notifications. Product updates or upgrade reminders require your opt-in. You can manage email preferences in your account and unsubscribe from marketing emails. Email delivery uses your verified account email address and limited notification information, not your questions, answers or drafts. Operational alert emails contain a limited incident reference and failure summary. A profile, question, and context needed for a request may be sent to the processing partners involved in that request. Provider information is available from Clerk, Convex, DataForSEO, Polar, Vercel, and Resend. Payment providers also process information for their own payment, tax and fraud-prevention responsibilities.

We use a self-hosted Umami installation on Vercel with a separate Neon database in Frankfurt, only after you choose analytics in the cookie settings. It measures public-page visits, referring websites and selected button clicks without sending account IDs, names, email addresses, scan questions, answers, drafts, or workspace content. The Cookie policy explains this separately from account-linked product measurement.

We may also disclose information where required by law or where necessary to protect the service, people, or our rights. We do not sell workspace content.

Optional creator attribution

If you choose creator attribution in Cookie settings, we use Trybe to connect a visit from a creator’s tagged link with your first paid subscription order. The pixel runs in a separate page on our public website. Trybe receives a browser visitor identifier and the creator’s tracking reference, together with the network information needed to receive that visit. We then send the verified order reference, amount, currency and order time from our server. We do not send your name, email address, profile, scan questions, answers or drafts to Trybe. Our checkout attribution links expire after seven days and order-attribution records after 30 days.

This choice is separate from website analytics and marketing emails. Rejecting it does not affect your account, scans or subscription. We respect supported Do Not Track and Global Privacy Control signals. Withdrawing consent stops new collection and suppresses pending order deliveries that have not already been sent. It does not remove records Trybe has already received. Contact us for help with those records. See Trybe’s privacy policy.

Connecting an AI assistant

If you choose to connect Gistful to ChatGPT, you authorize the assistant to request your saved professional profile, questions, scan status and results available under your plan. Those requested records are shared with OpenAI to answer you in that conversation. Permission to start scans is separate and uses your existing Gistful allowance. The connection cannot edit your profile, publish content, manage billing or read another account.

You can disconnect the integration in the assistant. For help revoking Gistful access, contact hello@gistful.co. Disconnecting does not remove information already included in an assistant conversation. The assistant provider controls those copies under its own privacy notice and account settings. See OpenAI’s privacy policy.

Browser storage

The browser demo saves workspace data on your device. For a signed-in account, this tab can temporarily store unsaved edits so they can be recovered after a connection problem. Those recovery copies are cleared after a successful save. Sign-in uses session technology provided by our authentication service. Removing workspace data from Gistful does not remove files you have downloaded or copies stored on another device.

Our Cookie policy explains the essential consent record, authentication-related browser storage, and the separate optional website analytics and creator-attribution choices.

Your workspace and publishing

Your saved profile, questions, answers, drafts and actions remain in your workspace until you edit or delete them, subject to the retention information below. Gistful does not automatically publish content for you. If you publish content yourself, that publication is controlled by the place where you publish it.

Retention and deletion

You can export your workspace and request workspace erasure in the app. Workspace erasure removes workspace records; it does not close the sign-in account or cancel a subscription. Account also provides a separate closure request. If automatic closure is unavailable, use the contact link there. Before full closure, we check for an active subscription or unfinished checkout so deletion does not leave you paying for an inaccessible account. Cancel renewal through Manage billing. For earlier closure, an erasure request, or help with a blocked request, contact hello@gistful.co.

Some operational records are retained briefly to apply daily limits: an identity reference, operation type, request ID and timestamps are kept for up to 24 hours. Verified billing webhook receipts are kept for 7 days to prevent duplicate processing. Subscription-period allowance counts are retained until 30 days after their period ends. The account-linked product-measurement record described above is retained for up to 180 days and is removed during full account closure. If an account remains open after that period, later eligible milestones can begin a new measurement window. Daily aggregate totals contain no account identifier and are retained for up to two years. Minimal account-level usage safeguards and a record of your successful free scan are kept for the life of your account so deleting a workspace does not reset the free allowance. Customer email records are kept for up to 90 days after their scheduled send time; email preferences are kept until account closure or updated by you.

Account-closure records are limited to the identifiers and status needed to finish deletion and prevent a closed session from restoring access.

Where Croatian accounting law requires it, documents supporting our accounting entries and their limited personal data are retained for at least 11 years from the end of the relevant financial year.

Written consumer complaint records are retained for at least one year from receipt. Other support correspondence is kept while handling your request and for any applicable dispute or legal obligation; it is reviewed when the request is resolved.

We retain required transaction and accounting records separately from workspace content; deleting an account does not erase an invoice or a payment provider’s legally required records. Where a dispute or legal obligation requires retention, access is restricted to that purpose. Copies in provider backups are subject to the provider’s backup and deletion processes, rather than an immediate deletion promise.

Your choices and rights

Depending on applicable law, you may ask for access, correction, deletion, restriction, portability, or object to certain processing. Contact hello@gistful.co with your request. We may need to verify that you control the account before acting on it. You may also complain to your local data-protection authority, including the Croatian Personal Data Protection Agency (AZOP).

Service providers and their subprocessors may process data outside your country, including in the United States. This service does not promise EU-only storage. Where a transfer requires safeguards, the applicable provider agreements describe mechanisms such as standard contractual clauses or an applicable adequacy decision. Contact us for the safeguards relevant to your data; provider notices do not replace our responsibility for lawful processing. Do not include special-category or confidential information in your profile, questions, or draft brief unless it is necessary and you are comfortable providing it for the requested service.

Changes and contact

We may update this notice when the service or legal requirements change. The version shown on this page is effective on 14 October 2026. For privacy questions, contact hello@gistful.co.