Privacy notice

What this notice covers

Gistful is operated by SPACE CADET d.o.o. This notice explains how we handle personal data when you use Gistful, contact us, or use a paid plan. It does not replace the privacy notices of services you choose to connect with or visit.

Data we handle

We process account and workspace information needed to provide Gistful: sign-in identifiers supplied through the sign-in service; the profile, public links, target topics and questions you save; scan answers and cited-source links; generated drafts and actions; and support messages.

For subscriptions, we receive and keep the billing account and subscription state needed to determine access and plan allowances. Payment details are handled by Polar during checkout; Gistful does not ask you to enter card details into the app.

We also keep a small first-party product-measurement record linked to your account. It records when we first observe an authenticated account after this measurement is enabled, whether a workspace was created, a successful scan finished, results were first opened, an upgrade or checkout was first started, a subscription was activated, and a later successful scan finished. The first-authenticated measure is not account registration or a historical account count. It does not contain your questions, answers, drafts, profile details, email address, payment details, or provider response data.

Why we use it

We use this information to authenticate you, keep your workspace private, run the scans and draft requests you initiate, show saved results, provide support, prevent misuse, administer an active subscription, and understand whether the product helps people reach and revisit results.

Our bases for processing are performance of our agreement with you, our legitimate interests in operating and protecting the service, and legal obligations where they apply. We do not use workspace content to make automated decisions with legal or similarly significant effects.

Who processes it

We use service providers to operate the service: Clerk for sign-in, Convex for application storage and server operations, DataForSEO for the measurement requests that make up a scan and for draft generation, Polar for billing and the customer portal, and Vercel for website hosting. Resend is used for enabled account and service notifications. Product updates or upgrade reminders require your opt-in. You can manage email preferences in your account and unsubscribe from marketing emails. Email delivery uses your verified account email address and limited notification information, not your questions, answers or drafts. Operational alert emails contain a limited incident reference and failure summary. A profile, question, and context needed for a request may be sent to the processing partners involved in that request. Provider information is available from Clerk, Convex, DataForSEO, Polar, Vercel, and Resend. Payment providers also process information for their own payment, tax and fraud-prevention responsibilities.

We may also disclose information where required by law or where necessary to protect the service, people, or our rights. We do not sell workspace content.

Connecting an AI assistant

If you choose to connect Gistful to ChatGPT, you authorize the assistant to request your saved professional profile, questions, scan status and results available under your plan. Those requested records are shared with OpenAI to answer you in that conversation. Permission to start scans is separate and uses your existing Gistful allowance. The connection cannot edit your profile, publish content, manage billing or read another account.

You can disconnect the integration in the assistant. For help revoking Gistful access, contact hello@gistful.co. Disconnecting does not remove information already included in an assistant conversation. The assistant provider controls those copies under its own privacy notice and account settings. See OpenAI’s privacy policy.

Browser storage

The browser demo saves workspace data on your device. For a signed-in account, this tab can temporarily store unsaved edits so they can be recovered after a connection problem. Those recovery copies are cleared after a successful save. Sign-in uses session technology provided by our authentication service. Removing workspace data from Gistful does not remove files you have downloaded or copies stored on another device.

Your workspace and publishing

Your saved profile, questions, answers, drafts and actions remain in your workspace until you edit or delete them, subject to the retention information below. Gistful does not automatically publish content for you. If you publish content yourself, that publication is controlled by the place where you publish it.

Retention and deletion

You can export your workspace and request workspace erasure in the app. Workspace erasure removes workspace records; it does not close the sign-in account or cancel a subscription. Account also provides a separate closure request. If automatic closure is unavailable, use the contact link there. Before full closure, we check for an active subscription or unfinished checkout so deletion does not leave you paying for an inaccessible account. Cancel renewal through Manage billing. For earlier closure, an erasure request, or help with a blocked request, contact hello@gistful.co.

Some operational records are retained briefly to apply daily limits: an identity reference, operation type, request ID and timestamps are kept for up to 24 hours. Verified billing webhook receipts are kept for 7 days to prevent duplicate processing. Subscription-period allowance counts are retained until 30 days after their period ends. The account-linked product-measurement record described above is retained for up to 180 days and is removed during full account closure. If an account remains open after that period, later eligible milestones can begin a new measurement window. Daily aggregate totals contain no account identifier and are retained for up to two years. Minimal account-level usage safeguards and a record of your successful free scan are kept for the life of your account so deleting a workspace does not reset the free allowance. Customer email records are kept for up to 90 days after their scheduled send time; email preferences are kept until account closure or updated by you.

Account-closure records are limited to the identifiers and status needed to finish deletion and prevent a closed session from restoring access.

Where Croatian accounting law requires it, documents supporting our accounting entries and their limited personal data are retained for at least 11 years from the end of the relevant financial year.

Written consumer complaint records are retained for at least one year from receipt. Other support correspondence is kept while handling your request and for any applicable dispute or legal obligation; it is reviewed when the request is resolved.

We retain required transaction and accounting records separately from workspace content; deleting an account does not erase an invoice or a payment provider’s legally required records. Where a dispute or legal obligation requires retention, access is restricted to that purpose. Copies in provider backups are subject to the provider’s backup and deletion processes, rather than an immediate deletion promise.

Your choices and rights

Depending on applicable law, you may ask for access, correction, deletion, restriction, portability, or object to certain processing. Contact hello@gistful.co with your request. We may need to verify that you control the account before acting on it. You may also complain to your local data-protection authority, including the Croatian Personal Data Protection Agency (AZOP).

Service providers and their subprocessors may process data outside your country, including in the United States. This service does not promise EU-only storage. Where a transfer requires safeguards, the applicable provider agreements describe mechanisms such as standard contractual clauses or an applicable adequacy decision. Contact us for the safeguards relevant to your data; provider notices do not replace our responsibility for lawful processing. Do not include special-category or confidential information in your profile, questions, or draft brief unless it is necessary and you are comfortable providing it for the requested service.

Changes and contact

We may update this notice when the service or legal requirements change. The version shown on this page is effective on 1 October 2026. For privacy questions, contact hello@gistful.co.