Privacy policy

01Who we are

Who is responsible for your data.

Gemmein is operated by Gemmein Limited, a company registered in England and Wales (company number 17339623). Gemmein Limited is registered with the Information Commissioner's Office (ICO), registration reference ZC241461.

For the purposes of the UK GDPR, and the EU GDPR where it applies, we are the data controller for the personal data described in this policy.

02What we collect

In short: your email, IP addresses recorded on security events (deleted after 30 days), the devices you're signed in on, what Stripe needs to bill you, any feedback you choose to send us and, if you join our affiliate programme, what we need to pay you.

Building locally with the Gemmein CLI is local-first: when you run gemmein dev, your app and its data stay on your own machine. The local engine sends only the pseudonymous milestones described under Local engine below; everything else in this section applies once you connect to Gemmein's hosted service — for example, by taking your app live.

We collect and process the following personal data:

Email address

Used for sign-in codes, account identification, and service communications. This is the only directly identifying information we store. When you create a Gemmein account you may receive up to three onboarding emails from Gemmein about getting started, sent on the basis of our legitimate interest in helping account holders use the service (Article 6(1)(f)). Each one has an unsubscribe link, and unsubscribing does not affect sign-in codes or account emails.

IP addresses

Recorded only when a security event happens: sign-in code requests and verifications (successful or refused), new sessions, sign-outs, blocked or rate-limited attempts, extra verification checks, export and erasure requests, starting a checkout, and security actions in the console such as creating, rotating or revoking secret keys, refused access and Live-change approvals. A secret key also records the IP address it was last used from. Event records don't capture an IP address when you, or your app's members, simply read or write data. We use IP addresses for security only: rate limiting, abuse and fraud detection, spotting hijacked sessions, blocking malicious traffic and investigating incidents. IP addresses in event records are deleted automatically after 30 days; the record that the event happened is kept without them (see section 6).

Signed-in devices

For each device you're signed in on, we keep a short label for the browser and operating system (for example, “Chrome on macOS”), the approximate country of the sign-in, the IP address of the sign-in, and the most recent IP address seen on that session (one value, replaced as the session is used, not a history). We take these from the request your browser already sends. We never store the full browser identifier (user-agent) string or any location more precise than a country. You can see your devices and sign out of one or all of them. When a new device signs in, we email you its browser and country, never its IP address. When a session ends, the device record and its IP addresses are deleted straight away. Your sign-in history in the audit log keeps the browser label and country of each sign-in for the audit-log period, without the IP address after 30 days (see section 6).

Protecting the service

To keep Gemmein secure for every customer, our firewall and edge network check the IP address of every request to Gemmein, including requests from people using apps built on Gemmein. We use addresses, or hashed or masked versions of them, to apply rate limits, block attacks and investigate abuse. We do this for security only, never to profile, advertise to or track anyone. Rate-limit counters exist only for their time window (at most an hour), then are deleted. Hashed or masked addresses on approval and security records are removed after 30 days. Request and infrastructure logs that may contain IP addresses are kept for the periods in section 6.

Usage metrics

Counts of API requests, storage writes, auth events and stored records, tracked per app for billing and quota enforcement. These are aggregate numbers, not behavioural profiles.

Billing information

If you take an app live, Stripe collects and processes your payment details. We store your Stripe customer ID and subscription status. We never see or store your card number.

Subscription records

If you enable payments for your app, we store the email address, plan name, and Stripe customer reference of each person who pays, so your app can check their subscription. This is stored inside your app's own isolated data and deleted with it.

Local engine

To improve what we deliver, the local engine sends pseudonymous milestones — for example, that an app's sign-in or payments were set up — so we can see where building gets harder and fix it. Each milestone is recorded once per install, and we store exactly four things: a random install ID created on your machine (not derived from the machine), the milestone's name, the CLI version, and the first day it was seen. No code, app data, email address or other personal details are sent, and no IP address or user agent is stored. We process these on the basis of our legitimate interest in improving the service (Article 6(1)(f)). To turn them off, run gemmein telemetry off, or set GEMMEIN_TELEMETRY=0 or DO_NOT_TRACK=1; turning them off stops them, and nothing is sent in CI.

Feedback you send us

If you use the feedback widget on this site or in the CLI, we collect the message you write and, optionally, your email address, so we can read it and reply if you asked us to.

AI calls

If you add an AI provider key and create tools, the inputs your app sends pass through our server to your provider, on your key. We store one record per call inside your app's data: the tool, the model, tokens in and out, the credits it cost, and how it ended. The prompt and the answer are stored only for a tool where you switched on record calls; it is off by default. Files an AI run produces are stored inside your app's data as sealed files linked to that person.

Inbox conversations

Replies people send to your app's emails, and your answers, are stored as threads in your app's Inbox, inside your app's own isolated data.

Emails your app sends

Each email your app sends to a person through Gemmein is recorded inside your app's data — recipient, subject, text and outcome — so you can see what was sent.

Relays

When you map a relay to call a URL you chose, the event's data goes to that URL. You choose the receiving service, and it processes that data under your agreement with it.

Affiliates

If you apply to or join our affiliate programme, we keep what you send us (your name, email address and where you promote Gemmein), your referral code, the referrals and commission linked to it, the payout details you give us, and any tax details we ask for before your first payout (for example a US W-9 or W-8). We use it to run the programme and pay you, under the Affiliate Terms.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Some protections run automatically: rate limits, refusing new sign-ins or uploads once a plan's limit and grace period are used up, pausing Live after a failed payment, and stopping emails to an address that has hard-bounced. Each is temporary or can be reversed, and you can contact us about any of them.

03What we don't collect

Data we do not collect.

We don't collect any of this:

• Passwords — there is no password database. Sign-in uses sign-in codes only, and nothing gets stored that could be breached.
• Tracking — no Google Analytics, no Mixpanel, no Hotjar, no pixel, no fingerprinting, and no cookie or identifier on any visit. We count page views, how far down a page people scroll, which buttons are clicked, how long a page stays in view (in bands: 10, 30, 60 and 180 seconds), which sections of a page are reached, the name of the site a visit came from (never its address), the previous page when it was one of ours and the device type (phone or computer). Each is a daily total per page, with nothing that identifies a visitor and nothing stored in your browser.
• Advertising data — we don't run ads, sell data, or share anything with advertisers. There is no ad-tech on this service.
• Unnecessary personal data — no name, no phone number, no address, and no date of birth. We ask for an email because sign-in requires one. The affiliate programme is the one exception (see section 2).
• Your users' personal data — we process the data your app stores on behalf of your users, but that data belongs to you. We act as a data processor for your end-user data under a separate Data Processing Agreement. That includes the device records and security-event IP addresses created when your app's members sign in: they follow the same 30-day IP schedule, appear in your dashboard and in member exports, and are deleted when a member is erased. You decide how to use them, as the controller. Separately, we use the IP addresses of requests to your app ourselves, as controller and only to protect the security of Gemmein (see “Protecting the service” in section 2).

04Why we process your data

UK GDPR requires a legal reason for every piece of data we hold. Here are ours.

Article 6(1)(b) — performance of a contract

Your email address, usage metrics and billing information are processed because they are necessary to provide the service you signed up for and to fulfil our Terms of Service. The same basis covers affiliate programme details, to run the programme under the Affiliate Terms.

Article 6(1)(c) — legal obligation

Billing and tax records, and affiliate payout records, are kept because UK tax and company law require it.

Article 6(1)(f) — legitimate interest

Signed-in device records, the IP addresses recorded on security events, and the IP addresses of requests to the service (used for firewalling and rate limiting) are processed for security purposes: rate limiting, detecting abuse and fraud, investigating incidents, alerting you to new sign-ins, and protecting accounts and the service. Feedback you send us is processed on the same basis, so we can improve the service and reply if you asked to hear back, as are local engine milestones and the daily page counts (views, scroll depth, clicks, time-on-page bands, sections reached, the referring site's name and device type), so we can see where building gets harder and how people find us. We have assessed that these interests do not override your rights, because the data is used solely for these stated purposes, is not shared beyond what's described in section 7, and is retained only for the limited periods set out in section 6.

05How we store your data

Where and how your data is stored.

All account and app data is stored in the United States, with Amazon Web Services, Inc. Websites you publish on Gemmein are served, and their public files cached, from the global network of Cloudflare, Inc. so they load quickly for visitors everywhere.

At rest

AES-256 encryption on the database, container images, file storage and access logs.

In transit

TLS 1.3 between your browser and our edge network, between the edge and our load balancer, and SSL with certificate validation between the application and the database. Your data is encrypted on every hop.

Infrastructure

The database and application servers sit in private subnets with no public IP addresses. They are not directly reachable from the internet.

Credentials

Database credentials and API tokens are stored in a managed secrets store, injected at runtime, and never committed to source code or environment variables.

06How long we keep your data

How long each kind of data is kept.

Account data — 30 days + 7

Email, apps, collections and records are retained while your account is active. If you delete your account, we remove your data within 30 days, plus up to 7 further days as encrypted database backups age out on this schedule. Billing records are kept as set out below. If your account ends any other way, you can ask us for an export of your data at support@gemmein.com during any notice period and for 30 days after the account ends, before deletion starts, as set out in section 8 of our Terms.

Soft-deleted records — 30 days

When you or your app deletes a record, it is soft-deleted (marked as deleted but retained). After 30 days, soft-deleted records are permanently purged.

Audit logs — 12 months; IP addresses — 30 days

Audit records are kept for 12 months in total: the first 90 days in the live database, then in encrypted cold storage, then deleted. Sign-in events keep the device's browser label and approximate country for this whole period. Any IP address in a record is removed after 30 days, so archived records never contain one. Erasing a person also removes their IP addresses.

Signed-in devices — until the session ends

The signed-in device record (label, country and IP addresses) is deleted as soon as its session ends, whether by sign-out, revocation or expiry. Sign-in events in the audit log keep the label and country, as described above. While a session is active, the sign-in IP address is removed after 30 days, and the most recent IP address is removed if it hasn't been refreshed for 30 days. The remaining bare session row (a token hash and timestamps) is deleted 7 days later.

Firewall and request logs — 30 days

Our firewall logs and application logs record the full IP address of requests, including requests to apps built on Gemmein. They are retained for 30 days and used only for security and operating the service.

Infrastructure access logs — 90 days

Load balancer access logs record the full IP address of each request. They are retained encrypted for 90 days and used only for security and investigating incidents.

Site page counts — 400 days

The raw per-page rows (for each page and day: views, scroll depth, clicks, time-on-page bands, sections reached, the referring site's name, the previous page on our site and device type) are deleted 400 days after the day they count. Aggregate daily counts, which carry no identifiers, may be kept.

Local engine milestones — 400 days

Each milestone record (install ID, milestone name, CLI version and first day seen) is deleted 400 days after the day it was first seen.

Billing records — up to 6 years

Invoices and payment records for your Gemmein plan are held by Stripe; we keep your Stripe customer ID and billing status alongside them. These tax and accounting records are kept for up to 6 years after the end of the financial year they relate to, as UK tax law requires.

Affiliate records — up to 6 years after the last payout

Commission and payout records are kept for up to 6 years after the last payout for UK tax and accounting purposes; other programme details are deleted when you leave the programme.

Feedback messages

Retained for as long as needed to review and respond to what you sent, and then deleted; we don't keep a standing feedback archive beyond that.

Your app's operating records

AI call records, Inbox threads and sent-email records live inside your app's data: a person's rows are removed when you erase that person, and all of it is removed with the app on the account schedule above. Our email provider, Plus Five Five, Inc., also keeps a copy of each email sent or received through Gemmein, with its delivery details, for 30 days after it was sent, then deletes it; erasing a person doesn't remove those copies sooner.

07Who else handles your data

The five companies we choose — Amazon Web Services, Inc., Cloudflare, Inc., Google Cloud EMEA Limited, Plus Five Five, Inc. and Stripe Payments UK Ltd — and the two kinds of service you can connect yourself. We use no analytics vendors or ad networks.

That is the complete list of processors we choose. We do not use analytics services, error-tracking services, or any other third-party processors. Services you connect yourself — an AI provider on your key, a URL a relay calls, a store or payment provider feeding a relay — are your choice and process under your agreement with them. We give Gemmein customers at least 30 days' email notice before adding or replacing a subprocessor; questions to legal@gemmein.com.

08AI assistants you connect

What an AI assistant you connect can see and do, where that information goes, and what we keep.

You can connect an AI assistant, such as ChatGPT or Claude, to your Gemmein account through the Gemmein connector (https://api.gemmein.com/mcp). This section explains what a connection can see and do, what happens to the information it handles, and how long we keep records of it.

What a connection can do. A connection works on one app: the app you approve in your Gemmein dashboard. With that approval it can build and test the app in Development for 30 days. It can't change your live app: each change to Live is a separate request that you approve in your browser. It never receives your secret keys.

What it can read. In Development, it reads your app's settings, test data, test members and logs. It reads your live app only if you allow that when you approve the connection. It then reads your app's business numbers, errors, usage, email delivery, Inbox, records and logs. Your customers' personal details, such as names and email addresses, are hidden or masked (for example a•••@gmail.com) unless you turn them on in your dashboard. You can turn them off again at any time; that applies to new reads straight away.

Where that information goes. What a connection reads is sent to the AI assistant you connected and to its provider, such as OpenAI or Anthropic, because you asked for it. The provider handles it under its own terms and privacy policy, and Gemmein doesn't control how it's used or kept. Once your assistant has read something, we can't change or delete it there.

• Your own account details are sent to fulfil your request, as part of providing the service to you (UK GDPR and EU GDPR Article 6(1)(b)).
• Your customers' data belongs to you as the data controller. Turning on customer details is your instruction to us to share that data with the assistant you chose. The assistant's provider is not one of our subprocessors (see our Data Processing Agreement). If you turn it on, your own privacy policy should tell your customers that you use AI assistants.

What we record. For each connection we record the AI assistant's name, when you approved it, and a masked version of the IP address it was approved from. We also record every change it makes and every read of your live app on your app's Logs. We don't receive or store your conversations with your AI assistant, only the requests it sends to Gemmein. These records follow our audit log schedule: 90 days in the live database, then encrypted archive storage for up to 12 months in total. Any IP address is removed after 30 days. See How long we keep your data. If you turn on customer details, we also record your confirmation (who, when, and the wording you agreed to) and keep it for as long as your account exists and 12 months after it ends.

What we don't do. We don't use anything received or sent through the connector to train AI models, we don't sell it, and we don't use it for advertising.

Ending a connection. Revoke it in your dashboard under Approvals and it ends straight away. Disconnecting Gemmein in your AI assistant stops that assistant using it. An approval also ends by itself after 30 days. To ask about or delete connection records, use your rights in section 10 or email privacy@gemmein.com.

09International data transfers

Your data moves from the UK (or the EU) to the US. Here is the legal basis for that transfer.

Gemmein is a UK-based controller, and our infrastructure is hosted in the United States. Transfers of personal data from the UK to the US are covered by the UK-US Data Bridge, an extension to the EU-US Data Privacy Framework.

Requests to Gemmein and to websites you publish pass through the global network of Cloudflare, Inc., which may process them in the data centre nearest the visitor.

Our subprocessors are covered by recognised UK-US transfer safeguards — certification under the EU-US Data Privacy Framework with the UK Extension where held, and international data transfer agreements otherwise. Your data receives an adequate level of protection as recognised by the UK Government.

If you are in the EU, transfers of your data to us in the UK rely on the European Commission's adequacy decision for the UK, and onward transfers to the US on the EU-US Data Privacy Framework.

We do not currently offer an EU-hosted region. If demand warrants it, we will make EU data residency available in the future.

10Your rights

Your rights under the UK GDPR and, where it applies to you, the EU GDPR.

Under UK GDPR (and the EU GDPR, where it applies to you), you have the following rights:

Right of access

You can view your account data at any time through the dashboard. The API also provides a currentUser endpoint that returns your stored profile. Your signed-in devices are listed in the dashboard, and member exports include device records and security-event IP addresses.

Right to rectification

To change your email address, email support@gemmein.com from the address you sign in with. You can also ask us to correct anything else we hold about you.

Right to erasure

You can ask us to delete your account by emailing support@gemmein.com from the address you sign in with. This removes your data within 30 days (plus the 7-day backup tail described above). Your end-users can delete their account programmatically via the SDK's g.account.delete().

Right to data portability

You can request an export of your records and account data in a machine-readable format by emailing privacy@gemmein.com. We will provide it within 30 days.

Right to restrict processing

You can ask us to limit how we use your data while a concern is being resolved.

Right to object

You can object to processing based on legitimate interest (such as the security IP logging described in section 4).

Right to complain

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. If you are in the EU, you can also complain to the data protection authority in your country.

To exercise any of these rights, email privacy@gemmein.com. We will respond within 30 days.

11Cookies and local storage

We set one strictly necessary cookie. Apps built on Gemmein keep one session entry in localStorage on their own domain.

12Children

This service is for builders who are at least 18 years old.

Gemmein is a backend service for application builders. You must be at least 18 years old to create an account, because using the service involves entering into a paid contract.

If you build an app on Gemmein that serves end users, you warrant (in our Terms of Service) that your app is not directed at children and that your users meet the applicable minimum age requirements (13 in the United States and United Kingdom, 16 in the European Union, or the minimum age required by the laws of their jurisdiction, whichever is higher).

13Changes to this policy

If we change something, we'll tell you in advance.

If we make material changes to this privacy policy, we will email you at the address associated with your account. Changes take effect 30 days after notice is sent. Continued use of the service after that date constitutes acceptance of the updated policy.

Non-material changes (typos, formatting, clarifications that don't affect your rights) may be made without notice, but the "last updated" date at the top of this page will always reflect the most recent revision.

14Get in touch

A person reads every email sent to this address.

Company information

Company

Gemmein Limited

Registered in

England and Wales

Company number

17339623

Registered office

82a James Carter Road, Mildenhall, IP28 7DE

ICO registration

ZC241461