Privacy Policy

Last updated: September 2026

How We Collect Personal Data

Personal data is collected when you submit it through Gitana's website (contact or sign-up forms) or through use of the Gitana platform. This policy describes how that data is used and on what basis.

How We Use Personal Data

Gitana processes personal data for the following purposes:

  • Providing and improving services, enabling account access, processing transactions, and responding to support requests — performance of a contract (Art. 6(1)(b)).
  • Marketing and promotional communications — legitimate interests (Art. 6(1)(f)). Gitana's legitimate interest is in informing existing and prospective business customers about relevant products and services. You may opt out at any time via support@gitana.io or the unsubscribe link in any marketing email, and we will stop processing your data for this purpose.
  • Monitoring usage trends to improve the service, investigating fraud, and preventing unauthorized access — legitimate interests (Art. 6(1)(f)). Gitana's interest in maintaining a secure and reliable service does not override your data protection rights.

Cookies

This site does not set any cookies — no session cookies, no analytics cookies, no tracking cookies. CSRF protection is implemented via server-side tokens in form fields, not cookies. No cookie consent mechanism is required.

Data Storage

Personal data is processed by the following categories of third-party sub-processors: cloud infrastructure and storage (Amazon Web Services); transactional email delivery; and payment processing (a PCI DSS Level 1 certified provider). Gitana owns the application code and databases; users retain all rights to their content data. A current list of sub-processors is available on request from legal@gitana.io.

Data Retention

Personal data is retained only as long as necessary for the purposes described in this policy, or as required by applicable law. The following periods apply:

  • Account and profile data — retained for the duration of the account and deleted within 30 days of account closure, unless a longer period is required by law.
  • Billing and transaction records — retained for 7 years from the date of the transaction to meet statutory accounting and tax obligations.
  • Content stored in the platform — deleted within 30 days of account termination. Customers may request earlier deletion at any time.
  • Support communications — retained for 3 years from the date of resolution.
  • Marketing and contact inquiries — retained for 3 years from last contact, or until you opt out, whichever is earlier.
  • Application audit logs (content operations, user permission changes, and AI retrievals) — retained permanently as a matter of governance record. Personal identifiers within audit log entries are pseudonymized upon account closure so that the audit trail is preserved without retaining linked personal data.
  • Infrastructure and access logs (server request logs, IP addresses) — retained for 12 months for security purposes.

Where personal data must be retained beyond these periods due to a legal obligation or dispute, it will be restricted from further processing until it can be deleted.

Sale of Personal Information

Gitana does not sell personal information and does not share personal information with third parties for cross-context behavioral advertising purposes.

Disclosure

Personal information may be disclosed to comply with subpoenas or when user actions violate the Terms of Service.

Your Privacy Rights

Upon request, Gitana provides information about held personal data. Account holders can update information by editing profiles or contacting support@gitana.io. Data deletion requests are processed within 30 days.

Security: Information is protected during transmission and storage. Security questions should be directed to legal@gitana.io.

EEA and UK Additional Rights: If you are located in the European Economic Area or the United Kingdom, you have the following additional rights under applicable data protection law. We will respond to all rights requests within one month of receipt, as required by GDPR Article 12(3). Where a request is complex or we receive a high volume of requests, we may extend this period by a further two months and will notify you of any such extension within the first month.

  • Right to access the personal data we hold about you
  • Right to rectification of inaccurate personal data
  • Right to erasure in certain circumstances
  • Right to object to processing
  • Right to restrict processing
  • Right to data portability
  • Right to lodge a complaint with your national data protection authority

California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights regarding your personal information.

Categories of personal information collected:

  • Identifiers — name and email address, collected when you submit a contact or sign-up form.
  • Internet or network activity — server access logs (IP address, request path, timestamp), retained for 12 months for security purposes.
  • Commercial information — records of services purchased and billing records, for customers of the Gitana platform.
  • Professional information — job title or company name, where voluntarily provided in a contact form.

Business purpose: Personal information is collected to provide and improve the Gitana platform, respond to inquiries, process transactions, and maintain security. It is not used for cross-context behavioral advertising.

Sale or sharing: Gitana does not sell personal information and does not share it for cross-context behavioral advertising. No opt-out action is required, but you may confirm this in writing by contacting legal@gitana.io.

Your California rights:

  • Right to know what personal information has been collected about you
  • Right to delete personal information we hold, subject to certain exceptions
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information (Gitana does not sell or share; no action required)
  • Right to non-discrimination for exercising any of these rights

To submit a California privacy request, contact legal@gitana.io. We will verify your identity and respond within 45 days, with a possible 45-day extension where permitted by law.

Business Transactions

The company may assign this policy and related user data to entities acquiring substantially all business assets or stock. Where required by applicable law, affected users will be notified before their personal data is transferred to a new controller and, where applicable law provides, given an opportunity to object or withdraw their data before the transfer takes effect.

Children's Personal Information

Services are not directed to individuals under 16. If we become aware that personal data has been collected from a child under 16, we will delete it promptly. Please contact support@gitana.io if you believe this has occurred.

Changes To This Policy

Updates to this policy will be posted on this page with a revised "Last updated" date. For material changes — those affecting how we collect, use, or share your personal data — we will provide prominent notice via email or an in-product notification at least 14 days before the change takes effect. Prior versions are archived and available on request from legal@gitana.io.

Dispute Resolution

Unresolved complaints are settled through American Arbitration Association rules. This arbitration clause does not apply to EEA or UK residents in respect of disputes arising from the processing of their personal data — such residents may instead lodge a complaint directly with their national data protection supervisory authority. EEA and UK data subjects may at any time lodge a complaint with their national supervisory authority; this right is not affected by any other provision of this policy.

Data Controller

The data controller for personal data collected through gitana.io is Gitana Software, Inc., 22 Boston Wharf Road, 7th Floor, Boston, MA 02210, USA. For inquiries about this policy or to exercise your rights, contact legal@gitana.io.

Gitana Software, Inc. does not currently maintain a designated EU/EEA representative under GDPR Art. 27. EEA residents may direct inquiries to legal@gitana.io and may at any time contact their national data protection authority.

Gitana Software, Inc. does not currently maintain a designated UK representative under UK GDPR Art. 27. UK residents may direct inquiries to legal@gitana.io and may at any time contact the Information Commissioner's Office (ICO) at ico.org.uk.

Contact

Legal inquiries: legal@gitana.io

Gitana Software, Inc.
22 Boston Wharf Road, 7th Floor
Boston, MA 02210, USA