This page lists the personal data we hold, the legal reason for
holding it, and how long each kind is kept.
Last updated: 26 September 2026 UK GDPR · Gemmein Limited privacy@gemmein.com
On this page
01Who we are
Who is responsible for your data.
Gemmein is operated by Gemmein Limited, a company registered in England and Wales (company number 17339623). Gemmein Limited is registered with the Information Commissioner's Office (ICO), registration reference ZC241461.
For the purposes of UK GDPR, we are the data controller for the personal data described in this policy.
02What we collect
In short: your email, IP addresses in security logs, what Stripe needs to bill you, and any feedback you choose to send us.
Building locally with the Gemmein CLI is local-first: when you run gemmein dev, your app runs entirely on your own machine and nothing described in this section is collected until you connect to Gemmein's hosted service — for example, by taking your app live.
We collect and process the following personal data:
Email address
Used for sign-in codes, account identification, and service communications. This is the only directly identifying information we store. When you create a Gemmein account you may receive up to three onboarding emails from Gemmein about getting started, sent on the basis of our legitimate interest in helping account holders use the service (Article 6(1)(f)). Each one has an unsubscribe link, and unsubscribing does not affect sign-in codes or account emails.
IP addresses
Recorded in audit logs when you sign in or perform actions. We store IP addresses because they are necessary for security: rate limiting, abuse and fraud detection, blocking malicious traffic, and investigating incidents. They are kept for a limited period (see section 6) and used for nothing else.
Usage metrics
Counts of API requests, storage writes, auth events and stored records, tracked per app for billing and quota enforcement. These are aggregate numbers, not behavioural profiles.
Billing information
If you take an app live, Stripe collects and processes your payment details. We store your Stripe customer ID and subscription status. We never see or store your card number.
Subscription records
If you enable payments for your app, we store the email address, plan name, and Stripe customer reference of each person who pays, so your app can check their subscription. This is stored inside your app's own isolated data and deleted with it.
Feedback you send us
If you use the feedback widget on this site or in the CLI, we collect the message you write and, optionally, your email address, so we can read it and reply if you asked us to.
AI calls
If you add an AI provider key and create tools, the inputs your app sends pass through our server to your provider, on your key. We store one record per call inside your app's data: the tool, the model, tokens in and out, the credits it cost, and how it ended. The prompt and the answer are stored only for a tool where you switched on record calls; it is off by default. Files an AI run produces are stored inside your app's data as sealed files linked to that person.
Inbox conversations
Replies people send to your app's emails, and your answers, are stored as threads in your app's Inbox, inside your app's own isolated data.
Emails your app sends
Each email your app sends to a person through Gemmein is recorded inside your app's data — recipient, subject, text and outcome — so you can see what was sent.
Relays
When you map a relay to call a URL you chose, the event's data goes to that URL. You choose the receiving service, and it processes that data under your agreement with it.
03What we don't collect
Data we do not collect.
We don't collect any of this:
Passwords — there is no password database. Sign-in uses sign-in codes only, and nothing gets stored that could be breached.
Analytics or tracking — no Google Analytics, no Mixpanel, no Hotjar, no pixel, and no fingerprinting.
Advertising data — we don't run ads, sell data, or share anything with advertisers. There is no ad-tech on this service.
Unnecessary personal data — no name, no phone number, no address, and no date of birth. We ask for an email because sign-in requires one.
Your users' personal data — we process the data your app stores on behalf of your users, but that data belongs to you. We act as a data processor for your end-user data under a separate Data Processing Agreement.
04Why we process your data
UK GDPR requires a legal reason for every piece of data we hold. Here are ours.
Article 6(1)(b) — performance of a contract
Your email address, usage metrics and billing information are processed because they are necessary to provide the service you signed up for and to fulfil our Terms of Service.
Article 6(1)(f) — legitimate interest
IP addresses in audit logs are processed for security purposes: rate limiting, detecting abuse, investigating incidents, and protecting accounts. Feedback you send us is processed on the same basis, so we can improve the service and reply if you asked to hear back. We have assessed that these interests do not override your rights, because the data is used solely for these stated purposes, is not shared beyond what's described in section 7, and is retained only for the limited periods set out in section 6.
05How we store your data
Where and how your data is stored.
All data is stored in the United States, with a leading cloud infrastructure provider.
At rest
AES-256 encryption on the database, container images, file storage and access logs.
In transit
TLS 1.3 between your browser and our edge network, between the edge and our load balancer, and SSL with certificate validation between the application and the database. Your data is encrypted on every hop.
Infrastructure
The database and application servers sit in private subnets with no public IP addresses. They are not directly reachable from the internet.
Credentials
Database credentials and API tokens are stored in a managed secrets store, injected at runtime, and never committed to source code or environment variables.
06How long we keep your data
How long each kind of data is kept.
Account data — 30 days + 7
Email, apps, collections and records are retained while your account is active. If you delete your account, we remove your data within 30 days, plus up to 7 further days as encrypted database backups age out on this schedule.
Soft-deleted records — 30 days
When you or your app deletes a record, it is soft-deleted (marked as deleted but retained). After 30 days, soft-deleted records are permanently purged.
Audit logs — 12 months
Retained for 12 months total. The first 90 days are held in the live database for fast access; after that, logs are archived to encrypted cold storage for the remainder of the 12-month period, then deleted.
HTTP request logs — 30 days
Retained in centralized logs for 30 days.
Infrastructure access logs — 90 days
Retained encrypted for 90 days.
Feedback messages
Retained for as long as needed to review and respond to what you sent, and then deleted; we don't keep a standing feedback archive beyond that.
Your app's operating records
AI call records, Inbox threads and sent-email records live inside your app's data: a person's rows are removed when you erase that person, and all of it is removed with the app on the account schedule above.
07Who else handles your data
The four companies we choose, and the two kinds of service you can connect yourself. We use no analytics vendors or ad networks.
Sends sign-in code emails, the emails your app sends to people and your replies from the Inbox, and delivers feedback messages you submit through the site or CLI
United States
Stripe
Billing and payment processing. Stripe handles all card data, end to end; we never see or store card numbers
Only when you add your own key: your app's AI inputs are sent to that provider on your account, and its answer streams back through our server. You choose the provider and hold the agreement with it
The provider's own regions
Your own pipeline (if you configure one)
When a tool runs on a URL you provide, Gemmein sends that run's data, including your end user's id and email, to your endpoint. You choose that destination; what happens there is outside the service and your responsibility
Your infrastructure
That is the complete list of processors we choose. We do not use analytics services, error-tracking services, or any other third-party processors. Services you connect yourself — an AI provider on your key, a URL a relay calls, a store or payment provider feeding a relay — are your choice and process under your agreement with them. The named subprocessor list, with 30 days' notice of changes, is available to Gemmein customers on request at legal@gemmein.com.
08International data transfers
Your data moves from the UK to the US. Here is the legal basis for that transfer.
Gemmein is a UK-based controller, and our infrastructure is hosted in the United States. Transfers of personal data from the UK to the US are covered by the UK-US Data Bridge, an extension to the EU-US Data Privacy Framework.
Our subprocessors are covered by recognised UK-US transfer safeguards — certification under the EU-US Data Privacy Framework with the UK Extension where held, and international data transfer agreements otherwise. Your data receives an adequate level of protection as recognised by the UK Government.
We do not currently offer an EU-hosted region. If demand warrants it, we will make EU data residency available in the future.
09Your rights
Your rights under UK GDPR.
Under UK GDPR, you have the following rights:
Right of access
You can view your account data at any time through the dashboard. The API also provides a currentUser endpoint that returns your stored profile.
Right to erasure
You can delete your account through the dashboard. This removes your data within 30 days (plus the 7-day backup tail described above). Your end-users can delete their account programmatically via the SDK's g.account.delete().
Right to data portability
You can request an export of your records and account data in a machine-readable format by emailing privacy@gemmein.com. We will provide it within 30 days.
Right to restrict processing
You can ask us to limit how we use your data while a concern is being resolved.
Right to object
You can object to processing based on legitimate interest (such as the security IP logging described in section 4).
Right to complain
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
To exercise any of these rights, email privacy@gemmein.com. We will respond within 30 days.
10Cookies and local storage
We set one strictly necessary cookie. Apps built on Gemmein keep one session entry in localStorage on their own domain.
We use one strictly necessary session cookie to keep you signed in to the dashboard. It is a strictly necessary cookie under the Privacy and Electronic Communications Regulations (PECR) and does not require consent.
Apps built on Gemmein store their users' session token in the user's own browser (localStorage) — that storage lives inside your app, on your domain, not on our pages, and it is strictly necessary for your app's sign-in to work.
No analytics, no trackers and no cookie banner.
11Children
This service is for builders who are at least 18 years old.
Gemmein is a backend service for application builders. You must be at least 18 years old to create an account, because using the service involves entering into a paid contract.
If you build an app on Gemmein that serves end users, you warrant (in our Terms of Service) that your app is not directed at children and that your users meet the applicable minimum age requirements (13 in the United States and United Kingdom, 16 in the European Union, or the minimum age required by the laws of their jurisdiction, whichever is higher).
12Changes to this policy
If we change something, we'll tell you in advance.
If we make material changes to this privacy policy, we will email you at the address associated with your account. Changes take effect 30 days after notice is sent. Continued use of the service after that date constitutes acceptance of the updated policy.
Non-material changes (typos, formatting, clarifications that don't affect your rights) may be made without notice, but the "last updated" date at the top of this page will always reflect the most recent revision.
13Get in touch
A person reads every email sent to this address.
Questions about this policy, or about your data
If you have questions about this policy, about your data, or about anything else privacy-related, email us.