Privacy policy

Courtesy translation — the French version prevails.

Français · English

Version of 17 September 2026.

Publisher: Gate.IA — [Legal form and BCE number: registration in progress]
Registered office: [address to complete], Belgium
Contact: contact@gate-ia.be — gate-ia.be
Hosting: virtual private server (VPS) located in the European Union — [host to complete]
Publishing director: [to complete]

Gate Pulse is an application from the Gate.IA catalogue. VAT: [number to complete after BCE registration].

Version of 17 September 2026.

Controller: Gate.IA (details above).

DATA PROCESSED — account data (name, email, username, bcrypt-hashed password, language), optional business profile (city, profession, target audience), social tokens (AES-256-GCM encrypted at rest), your past posts (style analysis), uploaded content, server logs (max 12 months).

PURPOSES & LEGAL BASES — service provision and personalization (contract, art. 6.1.b GDPR), security (legitimate interest), billing (legal obligation).

DATA PROTECTION OFFICER — none appointed, and none is required here: a DPO is mandatory only for public authorities, for organisations whose core activity is large-scale monitoring of individuals, and for large-scale processing of sensitive data. Gate Pulse is none of these. Write to contact@gate-ia.be; the publisher answers.

PROCESSORS — a processor handles your data ON OUR BEHALF and on our instructions, under a data processing agreement. Full list, with role, data received and location:
• Anthropic PBC — United States. The writing engine (Claude models): analyses your style, studies your sector, drafts the proposals. Receives your business profile, the captions of your past posts, the text and images you submit, and your generation settings. Never your password, your social tokens or your payment details. Web-search queries also pass through it on the Pro and Max plans.
• Stripe — Ireland and United States [exact contracting entity to be completed from the publisher's Stripe agreement]. Subscription payment: checkout page, customer portal (card, invoices, cancellation), discount coupons. Receives your email address, an internal account identifier, the plan, the committed term, amounts and dates. YOUR CARD DETAILS ARE ENTERED AT STRIPE and never reach our servers.
• Gandi SAS — European Union (France). Delivery of our emails (verification code, security alerts, password reset). Receives your email address and the message sent to you.
• Resend — United States. Same role, only if this fallback transport is used instead of the above. [Transport actually in service in production: to be completed.]
• Airtable, Inc. — United States. Customer relationship tool, if enabled. Receives your name, email address, username, plan and sign-up date. No content, no images, no statistics.
• [Host to complete] — European Union. The virtual private server running the application and holding the database; by construction it holds everything the service records.
• Internal automation (n8n), if enabled — on our own server, in the European Union. Optional relay for calls to the writing engine; then receives the same items as Anthropic PBC.
These processors act only on our instructions. Other strictly technical providers may act occasionally; the list above is kept up to date. No data is sold, rented or transferred.

META IS NOT OUR PROCESSOR — Meta Platforms (Instagram, Facebook) used to be listed here; that was a mis-qualification, corrected. When you ask us to publish on your accounts, Meta does receive the post — but it processes it ON ITS OWN BEHALF, under its own terms, with no instruction from us. That makes it a SEPARATE controller: what we send and what we read back is on us; what Meta then does with it on its platforms falls under its privacy policy, not ours.

TRANSFERS OUTSIDE THE EU — some of these processors (Anthropic, Airtable, Stripe in part, Resend where applicable) are established in the United States, so your data may leave the European Economic Area. Such transfers rely on the appropriate safeguards provided for by the GDPR: the "EU-US Data Privacy Framework" adequacy decision where the provider is certified, and/or the European Commission's standard contractual clauses. Ask us for the safeguards applying to a given provider. The application's database itself stays hosted in the European Union.

FOUR RECORDS WE KEEP THAT YOU NEVER SEE — none of them profiles or tracks you; they exist for security, accounting and proof, and we describe them including where no clean-up is in place.
• Known devices. At each login we compute a SHA-256 fingerprint from your browser's user-agent and the first three numbers of your IP address — never the full address — plus a readable device label and dates. Purpose: alerting you when a login comes from a device we have never seen (legitimate interest, art. 6.1.f). Retention: as long as your account exists; erased with it. To be exact: NO AUTOMATIC PURGE removes old devices before that. We say so rather than announce a clean-up that does not exist.
• AI call log. One line per generation: function, model, tokens, duration and cost in euros. No post content. Purpose: measuring what the service costs and billing correctly (legal obligation for the accounting part, art. 6.1.c; legitimate interest for capacity planning, art. 6.1.f). Retention: on account deletion the field identifying you is cleared and the line survives ANONYMOUS. That accounting line is kept with no fixed duration — it is a bookkeeping record, no longer personal data.
• Consent log. Each acceptance of the terms records the version accepted, the date and time, and your browser. Purpose: being able to show WHICH text you accepted and WHEN (art. 6.1.b and 6.1.f). Retention: as long as your account exists; erased with it. It is included in your data export, so you can check it yourself.
• Meta deletion requests. When you remove Gate Pulse from Facebook or Instagram, Meta sends us a deletion request. We keep a trace: your Facebook identifier IN CLEAR as Meta transmits it, a confirmation code, the date and the outcome. Purpose: Meta requires that code to stay verifiable, and it is our proof of deletion (art. 6.1.c and 6.1.f). Retention: [to be defined] — today NO PURGE IS SCHEDULED and that trace remains. Again, we say so rather than state a deadline the service does not keep. Write to us to have it removed.

RETENTION — account and content: kept as long as your account exists; ending a subscription erases nothing by itself. ACCOUNT DELETION IS IMMEDIATE: once you confirm it in the app, the account, posts, uploaded images, style profiles and social tokens are erased at once — no grace period, no recycle bin, no restore on our side. Encrypted backups are kept 14 days before being replaced, so data you have just deleted survives in those archives for at most 14 days. Social tokens: revoked on disconnection. Logs: 12 months.

YOUR RIGHTS (art. 15-22) — access, rectification, erasure, restriction, portability, objection: contact@gate-ia.be. We answer within ONE MONTH; where a request is complex, or where you send several, that period may be extended by up to two further months (art. 12.3 GDPR) — we tell you within the first month, with reasons. We may ask you to prove your identity, so as not to hand your data to someone else. Complaints: Belgian Data Protection Authority (APD/GBA).

No data is sold. No fully automated decision with legal effect is made: every publication requires your approval.

FREE-TRIAL ABUSE PREVENTION
When you link an Instagram or Facebook account we store a non-reversible cryptographic fingerprint of that account's identifier, to check that the same social account is not used to open several free trials. We keep the fingerprint, the platform and the first/last-use dates — not the account name, your content or your statistics. Legal basis: legitimate interest (art. 6.1.f GDPR). Retention: 24 months from last use. This fingerprint is kept even if you disconnect the social account or delete your Gate Pulse account — that is what makes the safeguard work. To link an account reserved to a Gate Pulse account you no longer control, write to us and we release it after verification. You may object to this processing by writing to us; we will assess your request against the compelling grounds justifying the safeguard and answer with reasons.

Version of 17 September 2026.

Gate Pulse uses NO tracking, advertising or third-party analytics cookies.

Strictly necessary storage (consent-exempt under ePrivacy art. 5.3): localStorage session tokens (this is what keeps you signed in between visits), interface language, and the service-worker cache for offline use. These do not track your browsing and are cleared on logout or by clearing site data. Should audience-measurement cookies ever be added, a compliant consent banner would be deployed first.

Version of 17 September 2026.

Gate Pulse uses AI models (Anthropic Claude) to analyze your style, study your niche and generate content proposals. Under Regulation (EU) 2024/1689 ("AI Act"), article 50 — applicable from 2 August 2026 — AI-generated content is subject to transparency obligations. Gate Pulse SYSTEMATICALLY adds the notice "Generated using AI tools." to every generated publication — the wording follows your interface language. It cannot be disabled: no setting removes it. NO INVISIBLE MARK: that written notice is the only marking Gate Pulse applies. Your posts carry no watermark, technical signature or hidden character that would let an automated tool recognise them as AI-generated — and a text copied from the app and pasted elsewhere would not keep such a mark anyway. Gate.IA follows the European guidance on this point and will adapt the app if it requires it. No deepfakes: Gate Pulse does not generate representations of real people.

Version of 17 September 2026.

HTTPS/TLS in transit (HSTS) · bcrypt password hashing (12 rounds) · social tokens encrypted AES-256-GCM at rest · rotating, revocable refresh tokens (remote logout of all devices) · rate limiting and temporary lockout after repeated failed logins · CSP and security headers · daily encrypted backups kept 14 days, EU hosting.

Report a vulnerability or incident: security@gate-ia.be. Data breaches presenting a risk are notified to the supervisory authority within 72 h (GDPR art. 33-34).

To delete your data, see data deletion instructions.