Privacy Policy

Gathery ("we", "us", or "our") provides a secure client document intake portal that lets account owners ("Owners") collect documents and information from their clients ("Clients") through configurable web portals. This Privacy Policy describes how we collect, use, share, and protect personal information in connection with the Gathery website, applications, and services (collectively, the "Service").

This Policy applies to (a) Owners and prospective customers who interact with our website or sign up for the Service, and (b) Clients who upload documents through portals operated by Owners. For Client uploads and Client-provided information, the Owner is the party that determines what is collected and why; Gathery acts on the Owner's behalf as described in Section 2.

• "Personal Information" means information that identifies, relates to, or could reasonably be linked to a particular individual or household.
• "Account Data" means information about Owners and their Gathery accounts (e.g., name, email, billing details, usage data). Gathery determines how Account Data is processed.
• "Client Data" means files, form responses, and other information that Clients submit through portals operated by Owners. The Owner determines what Client Data is collected and how it is used; Gathery processes Client Data on the Owner's behalf.
• "Portal" means a public intake page that an Owner configures within Gathery to receive Client uploads.
• "Sub-processor" means a third-party service provider engaged by Gathery to help operate the Service.

The Service is offered from the United States to users located in the United States and other jurisdictions where it is lawful to do so. The Service is intended only for individuals who are 18 years of age or older.

The Service is not directed to, and we do not knowingly offer the Service to, residents of the European Economic Area (EEA), the United Kingdom, or Switzerland. If you are located in those regions, please do not create an account or upload documents through Gathery.

We use the information described above to: provide, operate, and maintain the Service (including authentication, processing uploads, virus scanning, and enforcing retention rules); process payments and manage subscriptions through our payment processor; communicate with you about your account, security alerts, product changes, and support requests; detect, investigate, and prevent fraud, abuse, and security incidents and enforce our terms; analyze aggregated usage to improve the Service, debug issues, and develop new features; send marketing communications about Gathery in accordance with your preferences (see Section 14); and comply with legal obligations.

We do not use the contents of uploaded documents (Client Data) for analytics, marketing, advertising, or to train artificial-intelligence or machine-learning models.

We do not sell or rent Personal Information. We share information only as described below.

We retain Personal Information for the periods set out below, and longer where required by law (for example, to comply with tax, accounting, or legal-hold obligations).

When data is deleted from our active systems, residual copies may persist in encrypted backups until those backups age out under the schedule above.

We use technical and organizational safeguards designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. These include: encryption in transit using TLS 1.3 and at rest using AES-256; passwords stored only as Argon2id hashes; role-based access controls and least-privilege principles; multi-factor authentication for administrative access; automated virus scanning of all uploaded files in a quarantine area before they are made available for download; strict per-tenant isolation in the application and database layers; and short-lived, pre-signed download URLs for files.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

If we become aware of a security incident that materially affects the confidentiality, integrity, or availability of your Personal Information, we will notify affected users by email without undue delay, describe what happened, the data involved (to the extent known), the steps we are taking, and recommended actions.

The Service uses the following cookies. Strictly-necessary cookies are required for the Service to function. You can control non-essential cookies through your browser settings; doing so may affect parts of the Service.

Where applicable, we treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of Personal Information for cross-context behavioral advertising.

Subject to applicable law, you may exercise the following rights with respect to your Personal Information: access (request a copy), correct inaccurate data, delete (subject to legal retention), portability, opt out of marketing, and withdraw consent where we rely on it.

To submit a request, email privacy@gathery.app. We will respond within 30 days. We may need to verify your identity (typically by confirming control of the email associated with your account) before fulfilling a request.

If you are a Client who uploaded documents through a Portal, please direct requests about that data to the Owner who operates the Portal. We will help the Owner respond where appropriate.

This section provides additional disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the CCPA).

Gathery does not make decisions about you that produce legal or similarly significant effects through solely automated means.

Gathery does not use Customer Data, uploaded documents, or the contents of Client submissions to train, fine-tune, or evaluate artificial-intelligence or machine-learning models, and we do not provide such data to third parties for those purposes.

We send two types of email: (a) transactional emails about your account, security, and billing, which are required to operate the Service and cannot be opted out of while your account is active; and (b) marketing emails about Gathery features, news, and offers.

You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing message, by adjusting the marketing preference in your account settings, or by emailing us at the address in Section 19. Opting out of marketing emails does not affect transactional emails.

Gathery's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Specifically, when you sign in with Google, the basic profile information we receive (name, email address, profile picture) is used only to create and authenticate your Gathery account. We do not transfer that data to others except as necessary to provide or improve user-facing features, and we do not use it for serving advertisements, for human reading, or to develop, improve, or train generalized artificial-intelligence or machine-learning models.

The Service is intended only for individuals 18 years of age or older. We do not knowingly collect Personal Information from anyone under 18. If we learn that we have collected Personal Information from a person under 18, we will delete that information.

If your organization requires a Data Processing Agreement (DPA) describing how Gathery processes Personal Information on your behalf, please email privacy@gathery.app and we will work with you to put a DPA in place.

We may update this Privacy Policy from time to time. When we make material changes, we will notify Owners by email and update the "Last updated" date at the top of this page. Your continued use of the Service after a change becomes effective constitutes your acceptance of the updated Policy.

Gathery is operated in the United States. If you have questions, requests, or concerns about this Privacy Policy or our handling of Personal Information, contact us at: