Skip to content
Gamify It.
Connect

Legal

Privacy Policy

Last updated

Draft

Draft for review with counsel. Not yet in effect.

The short version: we collect what we need to run your account and bill you; from your assistant we receive summaries and aggregates, never code or your users’ personal data; we don’t sell personal information or train AI models on your data; and we honor Global Privacy Control.

1. Who we are

The party responsible for the personal data described here (the “controller”) is the company that operates Gamify It, based in Mexico. This policy covers the gamifyit.co website and the Gamify It MCP service. Contact us about privacy at jmdg@svenson.com.mx.

2. What we collect

  • Account data. Your name, email address, profile image and an account identifier from the identity provider you sign in with, and which assistants you connected.
  • Billing data. Your plan, billing country, invoices and payment status. Stripe processes your payment details; we never see or store your full card number.
  • Product data you choose to save. Product descriptions, evidence summaries, aggregate metrics, Stage Cards, experiments and learnings. Diagnostic tools store nothing until you save.
  • Usage data. An allow-listed record of tool calls (which tool, when, how long it took, the assistant and any error), without the content of your requests.
  • Website data. Standard server logs (such as IP address and browser type, kept briefly for security) and, where enabled, the Meta Pixel described below.
  • Messages. What you send to support, and your email preferences.

3. What we don’t collect

The Service is built to receive summaries and aggregates. We do not receive your source code, raw analytics events or personal data about your own users, and the Service rejects inputs that look like them. Your AI assistant reads your code and data on your side, under your agreement with that assistant’s provider.

We do not use your data to train AI models, and there is no AI model running on our side.

4. How we use personal data

  • To provide the Service: sign-in, your saved history, weekly briefs and readout reminders you turn on.
  • To bill you and meet tax and accounting obligations.
  • To keep the Service secure, prevent abuse and fix problems.
  • To answer support requests and send service notices.
  • To measure our own advertising, as described in “Cookies and the Meta Pixel”.
  • To improve the Service using aggregated, de-identified usage statistics.

6. Who we share it with

We share personal data only with service providers that process it on our behalf, under contract:

  • Vercel: Website and MCP endpoint hosting (United States).
  • Supabase: Database hosting (accounts, products, saved history) (United States).
  • Stripe: Payments, invoices and sales tax (United States and Mexico).
  • Resend: Transactional email (sign-in, receipts, the Monday brief) (United States).
  • Sentry: Error monitoring, with customer content scrubbed (United States).
  • Meta: Ad measurement on the website (the Pixel), only where enabled (United States).

We may also disclose data when the law requires it, to protect rights and safety, or as part of a merger or acquisition, with notice to you. We do not sell personal information. Using the Meta Pixel may count as “sharing” for cross-context behavioral advertising under some US state laws; you can opt out as described below.

7. Cookies and the Meta Pixel

  • Essential. Sign-in and security cookies that the Service needs to work.
  • Preferences. Your light or dark theme, stored in your browser.
  • Advertising measurement. Where enabled, the Meta Pixel sets cookies (such as _fbp) so we can see which ads lead to sign-ups and subscriptions. We send no names, email addresses or product data through the Pixel.
  • Our own attribution cookies. When you arrive on our website, we set first-party cookies that hold no personal data: gi_aid (a random visitor id), gi_utm (the campaign that brought you, such as the ad and source) and, when you arrive from a Meta ad, _fbc (Meta’s click id). They last 90 days. If you sign up, we link them to your account so we know which ad brought you.

Conversions sent from our server. When you create an account or start a subscription, our server tells Meta about that event so we can measure which ads work. It sends your email address and account id only in hashed form (SHA-256), together with the attribution ids above, your IP address and browser type, and, for subscriptions, the amount and currency. Meta uses this to match the event to an ad; it never receives your product data.

We honor the Global Privacy Control signal: if your browser sends it, we set none of the advertising cookies above, the Meta Pixel does not load, and we don’t send your conversions to Meta. You can also opt out by emailing jmdg@svenson.com.mx.

8. International transfers

We are based in Mexico, and our main providers host data in the United States. When personal data moves across borders, we rely on safeguards the law recognizes, such as contractual clauses with our providers.

9. How long we keep it

  • Account and saved product data: while your account is open. You can delete products or your account at any time.
  • After deletion: removed from live systems right away and from backups as they rotate, within about 30 days.
  • Billing records: as long as tax and accounting law requires (in Mexico, generally five years).
  • Server and security logs: about 30 days, unless needed to investigate an incident.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, to withdraw consent, and to opt out of the sale or sharing of personal data for targeted advertising. In Mexico these include your ARCO rights (access, rectification, cancellation and opposition). We won’t treat you differently for exercising them.

You can export or delete your data in your account, or email jmdg@svenson.com.mx. We may need to verify your identity, and we respond within the time the law requires. If we decline a request, you can appeal by replying to our answer, and you can complain to your local data-protection authority.

11. Security

Data is encrypted in transit and at rest. Every database query is bound to your account by row-level security that fails closed, the MCP service holds no billing or administrator credentials, and logs and error reports are scrubbed of customer content. No system is perfectly secure; if a breach affects your data, we will notify you as the law requires. More detail is on our security page.

12. Children

The Service is for businesses and professionals and is not directed to children. We do not knowingly collect personal data from anyone under 16, and accounts require users to be at least 18.

13. Changes to this policy

We will post updates here and change the date above. For material changes, we will notify account holders by email before they take effect.

14. Contact

Privacy questions and requests: jmdg@svenson.com.mx.