Privacy policy

01Who we are

Here's who is responsible for your data.

Gemmein is operated by Gemmein Limited, a company registered in England and Wales (company number 17339623). Gemmein Limited is registered with the Information Commissioner's Office (ICO), registration reference ZC241461.

For the purposes of UK GDPR, we are the data controller for the personal data described in this policy.

02What we collect

The short version: your email, IP addresses in security logs, whatever Stripe needs to bill you, and anything you choose to send us as feedback.

Building locally with the Gemmein CLI is local-first: when you run gemmein dev, your app runs entirely on your own machine and nothing described in this section is collected until you connect to Gemmein's hosted service — for example, by taking your app live.

We collect and process the following personal data:

Email address

Used for login (OTP codes), account identification, and service communications. This is the only directly identifying information we store.

IP addresses

Recorded in audit logs when you sign in or perform actions. We store IP addresses because they are necessary for security: rate limiting, abuse and fraud detection, blocking malicious traffic, and investigating incidents. They are kept for a limited period (see section 6) and used for nothing else.

Usage metrics

Counts of API requests, storage writes, auth events and stored records, tracked per app for billing and quota enforcement. These are aggregate numbers, not behavioural profiles.

Billing information

If you take an app live, Stripe collects and processes your payment details. We store your Stripe customer ID and subscription status. We never see or store your card number.

Subscription records

If you enable payments for your app, we store each paying customer's email address, plan name, and Stripe customer reference so your app can check their subscription. This is stored inside your app's own isolated data and deleted with it.

Feedback you send us

If you use the feedback widget on this site or in the CLI, we collect the message you write and, optionally, your email address, so we can read it and reply if you asked us to.

AI calls

If you add an AI provider key and create tools, the inputs your app sends pass through our server to your provider, on your key. We store one record per call inside your app's data: the tool, the model, tokens in and out, the credits it cost, and how it ended. The prompt and the answer are stored only for a tool where you switched on record calls; it is off by default.

Customer conversations

Messages your customers send through your app's support door, and your replies, are stored as threads in your app's Inbox, inside your app's own isolated data.

Emails your app sends

Each email your app sends to a person through Gemmein is recorded inside your app's data — recipient, subject, text and outcome — so you can see what was sent.

Relays

When you map a relay to call a URL you chose, the event's data goes to that URL. The receiving service is your choice and processes under your agreement with it, not ours.

03What we don't collect

Most of the data companies collect, we chose not to collect.

We don't collect any of this:

• Passwords — there is no password database. Login is email codes only, and nothing gets stored that could be breached.
• Analytics or tracking — no Google Analytics, no Mixpanel, no Hotjar, no pixel, and no fingerprinting.
• Advertising data — we don't run ads, sell data, or share anything with advertisers. There is no ad-tech on this service.
• Unnecessary personal data — no name, no phone number, no address, and no date of birth. We ask for an email because login requires one.
• Your users' personal data — we process the data your app stores on behalf of your users, but that data belongs to you. We act as a data processor for your end-user data under a separate Data Processing Agreement.

04Why we process your data

UK GDPR requires a legal reason for every piece of data we hold. Here are ours.

Article 6(1)(b) — performance of a contract

Your email address, usage metrics and billing information are processed because they are necessary to provide the service you signed up for and to fulfil our Terms of Service.

Article 6(1)(f) — legitimate interest

IP addresses in audit logs are processed for security purposes: rate limiting, detecting abuse, investigating incidents, and protecting accounts. Feedback you send us is processed on the same basis, so we can improve the service and reply if you asked to hear back. We have assessed that these interests do not override your rights, because the data is used solely for these stated purposes, is not shared beyond what's described in section 7, and is retained only for the limited periods set out in section 6.

05How we store your data

Your data lives in one place, encrypted in two ways.

All data is stored in the United States, with a leading cloud infrastructure provider.

At rest

AES-256 encryption on the database, container images, file storage and access logs.

In transit

TLS 1.3 between your browser and our edge network, between the edge and our load balancer, and SSL with certificate validation between the application and the database. Your data is encrypted on every hop.

Infrastructure

The database and application servers sit in private subnets with no public IP addresses. They are not directly reachable from the internet.

Credentials

Database credentials and API tokens are stored in a managed secrets store, injected at runtime, and never committed to source code or environment variables.

06How long we keep your data

We keep data for as long as it's useful, then we delete it. Here are the exact timeframes.

Account data — 30 days + 7

Email, apps, collections and records are retained while your account is active. If you delete your account, we remove your data within 30 days, plus up to 7 further days as encrypted database backups age out on this schedule.

Soft-deleted records — 30 days

When you or your app deletes a record, it is soft-deleted (marked as deleted but retained). After 30 days, soft-deleted records are permanently purged.

Audit logs — 12 months

Retained for 12 months total. The first 90 days are held in the live database for fast access; after that, logs are archived to encrypted cold storage for the remainder of the 12-month period, then deleted.

HTTP request logs — 30 days

Retained in centralized logs for 30 days.

Infrastructure access logs — 90 days

Retained encrypted for 90 days.

Feedback messages

Retained for as long as needed to review and respond to what you sent, and then deleted; we don't keep a standing feedback archive beyond that.

Your app's operating records

AI call records, Inbox threads and sent-email records live inside your app's data: a person's rows are removed when you erase that person, and all of it is removed with the app on the account schedule above.

07Who else handles your data

Four companies, each doing one job. No analytics vendors, no ad networks, no one else.

That is the complete list of processors we choose. We do not use analytics services, error-tracking services, or any other third-party processors. Services you connect yourself — an AI provider on your key, a URL a relay calls, a store or payment provider feeding a relay — are your choice and process under your agreement with them. The named subprocessor list, with 30 days' notice of changes, is available to customers on request at legal@gemmein.com.

08International data transfers

Your data moves from the UK to the US. Here is the legal basis for that transfer.

Gemmein is a UK-based controller, and our infrastructure is hosted in the United States. Transfers of personal data from the UK to the US are covered by the UK-US Data Bridge, an extension to the EU-US Data Privacy Framework.

Our subprocessors are covered by recognised UK-US transfer safeguards — certification under the EU-US Data Privacy Framework with the UK Extension where held, and international data transfer agreements otherwise. Your data receives an adequate level of protection as recognised by the UK Government.

We do not currently offer an EU-hosted region. If demand warrants it, we will make EU data residency available in the future.

09Your rights

You own your data. Here is everything you can do with it.

Under UK GDPR, you have the following rights:

Right of access

You can view your account data at any time through the dashboard. The API also provides a currentUser endpoint that returns your stored profile.

Right to erasure

You can delete your account through the dashboard. This removes your data within 30 days (plus the 7-day backup tail described above). Your end-users can delete their account programmatically via the SDK's g.account.delete().

Right to data portability

You can request an export of your records and account data in a machine-readable format by emailing privacy@gemmein.com. We will provide it within 30 days.

Right to restrict processing

You can ask us to limit how we use your data while a concern is being resolved.

Right to object

You can object to processing based on legitimate interest (such as the security IP logging described in section 4).

Right to complain

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

To exercise any of these rights, email privacy@gemmein.com. We will respond within 30 days.

10Cookies and local storage

One cookie. One localStorage entry. Both strictly necessary. That's the whole list.

11Children

This service is for builders who are at least 18 years old.

Gemmein is a backend service for application builders. You must be at least 18 years old to create an account, because using the service involves entering into a paid contract.

If you build an app on Gemmein that serves end users, you warrant (in our Terms of Service) that your app is not directed at children and that your users meet the applicable minimum age requirements (13 in most jurisdictions, 16 in parts of the EU under local GDPR implementations).

12Changes to this policy

If we change something, we'll tell you in advance.

If we make material changes to this privacy policy, we will email you at the address associated with your account. Changes take effect 30 days after notice is sent. Continued use of the service after that date constitutes acceptance of the updated policy.

Non-material changes (typos, formatting, clarifications that don't affect your rights) may be made without notice, but the "last updated" date at the top of this page will always reflect the most recent revision.

13Get in touch

Every question sent to this address is read by a person.