Privacy Policy

Who we are

Gauntlyt is a service provided by Gauntlyt, operated from the United States. Gauntlyt is the data controller for the personal data described here and decides why and how it is processed. Data is stored and processed on servers in the United States and, for some providers, elsewhere; where data leaves your region we rely on our providers' standard contractual safeguards. Contact: gauntlyt@gmail.com

What we collect and why

Account details: your email address and login credentials, handled by our authentication provider, so we can create and secure your account. Legal basis: performance of our contract with you.

Profile details you choose to add: username, forum nickname, pixel avatar, and bio, used to show you inside the product and in community spaces. Legal basis: contract, and your consent for anything optional.

Idea submissions: your answers to the intake questions, the critique generated from them, and your mentor conversations, used to produce and store your results. Legal basis: contract.

Community content: bases you create or join, posts, and comments. Legal basis: contract.

Usage and technical data: first-party analytics events, device and browser information, and IP address, used for security, fraud prevention, and improving the product. Legal basis: our legitimate interests in running a safe, working service.

Purchase data: if you buy coins or Pro, we store your order and subscription status, the plan purchased, and an identifier from our payment provider, so we can grant and renew what you paid for. Legal basis: contract and legal obligation. We never see or store your full card details.

Payments and our Merchant of Record

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

When you check out, the billing details you enter, including your name, email, billing address, country, and payment method, are collected and processed by Paddle as part of taking payment, calculating tax, invoicing, and preventing fraud. Paddle shares back with us only what we need to fulfil the order: your email, the plan or pack bought, the amount, country for tax, and subscription status. Paddle's own privacy notice is at paddle.com/legal/privacy.

AI processing

Your intake answers and mentor messages are sent to an AI model provider so a critique can be generated. We currently use Google Gemini, accessed through Lovable, for this. They are not used by us to train public models, and we send only what the critique needs. The provider may retain data for a limited time under its own terms.

Who else we share data with

Service providers acting as processors on our instructions: hosting and database, authentication, AI model provider, market research provider, and email delivery.

Paddle, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance, and invoicing.

Professional advisers such as legal or accounting support, and public authorities where we are legally required to disclose.

We do not sell your personal data and do not run advertising trackers.

Who can see your ideas

Your ideas, critiques, and mentor threads are private to your account by default. Only content you post inside a base is visible to members of that base, and only verdicts you explicitly share are public.

How long we keep it

Account, profile, idea, and community data is kept while your account is active. If you delete your account, or ask us to, we delete or anonymise it within 30 days, except where we must keep records longer: order and tax records are retained for up to 7 years to meet accounting obligations, and security logs for up to 12 months. Analytics events are anonymised if you turn on the anonymity setting.

Security

We use appropriate technical and organisational measures: encryption in transit (HTTPS) and at rest, row-level access rules so one account cannot read another's data, hashed credentials handled by our auth provider, private storage with short-lived signed links, and least-privilege access to production systems.

International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Your rights and choices

You can edit your username, avatar, and bio at any time in Setup, delete an individual idea, turn on anonymous analytics, or wipe your account and its data yourself with the End Game control in your settings.

Depending on where you live, you can also request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests, and withdraw consent at any time. Email gauntlyt@gmail.com and we will respond within one month. You may also complain to your local data protection authority.

Cookies and storage

We use essential cookies and local storage to keep your login session and a local draft of an idea you started before signing in, and first-party analytics storage to count product usage. We do not use marketing or advertising cookies. Paddle sets its own cookies during checkout to process your payment and prevent fraud. You can clear cookies in your browser at any time, though essential ones are needed to stay signed in.

Young founders

Gauntlyt is built for young entrepreneurs. You must be at least 13 years old to create an account. If you are under the age of digital consent where you live, ask a parent or guardian before signing up, and ask them to help you understand how your data is used.

Changes and contact

If we change this notice we update the date above and, for material changes, tell you in the product. Privacy questions or deletion requests: gauntlyt@gmail.com