Privacy, briefly
Gaitkit works without an account, sets no tracking cookies and shows no ads. This page lists the little we do collect.
01The short version
- No tracking cookies and no ad networks. Fonts and scripts are served from our own domain. We count visits with Cloudflare Web Analytics, which sets no cookies and does not fingerprint you.
- Browsing, the lab, the describe box matcher and the agent tools work without telling us who you are.
- We store an email address only when you join the launch list or buy a plan.
- Payments are handled by Paddle; we never see your card.
- We do not sell personal data, and we do not use it to train AI models.
02Who is responsible
The controller of your personal data is Ümit, trading as Gaitkit, Konya, Türkiye. Contact for anything about privacy: hello@gaitkit.com.
03What we collect and why
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address (launch list) | To send one email at launch with the founder seat link | Consent; withdraw any time | Until launch + 90 days, or until you unsubscribe |
| Account: email, plan, API key hashes, download history | To run your account, check your plan and show your downloads | Contract | While the account exists + 30 days |
| Billing records from Paddle: name, email, country, plan, invoice ids | To give you what you paid for and keep tax records | Contract; legal obligation | 10 years for invoices (Turkish tax law), otherwise while the account exists |
| Requests for missing specimens (text you typed, time) | To decide what to build next; we keep no name or address with them | Legitimate interest | Until the specimen ships or 24 months |
| Descriptions sent to the forge (text you typed) | To write the specimen with an AI model (see processors) | Legitimate interest; contract when you are on a plan | 30 days in our logs; the resulting specimen is kept |
| Server logs: IP address, time, URL, user agent | To keep the service secure and working, and to enforce rate limits | Legitimate interest | 30 days |
| Visit counts: page, referrer, country, browser type, page speed (Cloudflare Web Analytics, no cookies, no IP stored) | To see which pages people use and how fast they load | Legitimate interest | Aggregated; Cloudflare keeps the raw events about 6 months |
| Emails you send us | To answer you | Legitimate interest; contract | 24 months after the conversation ends |
Agents calling the MCP server or REST API send search words, specimen ids and descriptions. These are handled like the requests and server logs above. Do not put personal information into them.
05Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Paddle.com Market Ltd | Checkout, payment, tax, invoices, subscription management. Paddle is the Merchant of Record and an independent controller for payment data; see Paddle's privacy notice. | UK, EU, US |
| Anthropic, PBC | Runs the AI model that turns a forge description into specimen code. It receives the description text only, and does not train on it. | US |
| Cloudflare, Inc. | Hosting, CDN, the database for requests and the launch list, and cookieless visit counts (Web Analytics). | Global |
| Email provider | Sending the launch email and account sign-in links. We will name it here before the first email goes out. | EU or US |
Where data leaves the EU, UK or Türkiye, we rely on the provider's standard contractual clauses or an adequacy decision, and on your explicit consent where Turkish law requires it.
06Your rights
Under the GDPR, the UK GDPR and Türkiye's KVKK (Law No. 6698) you can ask us to:
- tell you what we hold about you and give you a copy;
- correct it, or delete it when we no longer need it;
- restrict or object to how we use it, and withdraw consent at any time;
- send it to you or another provider in a machine-readable format.
Write to hello@gaitkit.com from the address the request is about. We answer within 30 days. You can also complain to your local data protection authority, or in Türkiye to the Personal Data Protection Authority (KVKK).
07Security
Everything is served over HTTPS. API keys are stored only as hashes and shown once. Access to personal data is limited to the people who run Gaitkit. If a breach puts your data at risk, we tell you and the authorities as the law requires.
08Children
Gaitkit is not aimed at children under 16, and we do not knowingly collect their personal data. If you think a child has given us their email, tell us and we will delete it.
09Changes
When we change this policy, we update the date at the top. If a change affects how we use data you already gave us, we email you before it takes effect.