Privacy Policy

1. Introduction

GILDA ("we", "our", or "us") is committed to protecting the privacy and personal data of every person who uses our platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over your data.

GILDA is a social network and content sharing platform that enables Creators to share and monetise their own content and enables Fans to subscribe to and view the content of Creators. This policy applies to all users of the GILDA website and web application, including registered Creators, Fans, and visitors.

By accessing or using GILDA, you acknowledge that you have read, understood, and agree to the practices described in this policy. We process personal data in accordance with this Privacy Policy, our Terms of Service, and applicable data-protection laws.

2. Data Controller

The data controller responsible for your personal data is:

You may contact our DPO directly for any data protection concerns or to exercise your rights.

3. Data We Collect

We collect personal data in the following categories:

3.1 Account and Identity Data

• Full name and display name
• Username (unique handle)
• Email address
• Age confirmation (must be 18+)
• Location (city/region, if you provide it)
• Profile photograph / avatar
• Biography and profile information you choose to provide
• Account type (Fan or Creator)

3.2 Financial and Payment Data

• Mobile phone number used for mobile money payments where applicable
• Transaction records, payment amounts, and currency (e.g. TSh)
• Subscription and purchase history
• Creator earnings records and wallet balances

Note: We do not store full mobile money account credentials. Payment processing is handled by our third-party payment processor. Please review the processor's privacy policy for their data practices.

3.3 Content Data

• Photos, videos, and other media you upload to the platform
• Captions, descriptions, and titles associated with content
• Comments, likes, and interactions with other users' content
• Messages sent through our private messaging system

3.4 Usage and Technical Data

• IP address and approximate geographic location
• Browser type and version, device type and operating system
• Pages visited, features used, and time spent on the platform
• Session data and authentication tokens
• Error logs and performance data

3.5 Age Verification and Consent Data

• Timestamp and record of age verification consent
• Acknowledgment of Terms of Service and this Privacy Policy

4. How We Use Your Data

4.1 Service Provision

• Creating and managing your account
• Enabling Creators to upload, share, and monetise their content
• Enabling Fans to discover, subscribe to, and view Creator content
• Processing payments and subscriptions through our payment partners
• Facilitating private messaging between users
• Displaying profiles and content to other users

4.2 Safety and Legal Compliance

• Verifying that all users are 18 years of age or older
• Detecting, investigating, and preventing fraud, abuse, and illegal activity
• Enforcing our Terms of Service and Content Policy
• Complying with legal obligations that apply to our operations
• Responding to lawful requests from law enforcement and regulatory authorities

4.3 Communications

• Sending account-related notifications (registration, payments, policy updates)
• Notifying you of activity on your content or profile
• Important security alerts and account updates

4.4 Platform Improvement

• Analysing usage patterns to improve features and performance
• Troubleshooting technical issues
• Conducting internal research and analytics (using anonymised data where possible)

We do not sell your personal data to third parties. We do not use your personal data for automated decision-making or profiling that produces legal effects.

5. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Consent: For age verification, marketing communications, and optional profile information. You may withdraw consent at any time by contacting us.
• Contractual Necessity: To perform our obligations under the Terms of Service, including enabling account creation, content hosting, and payment processing.
• Legal Obligation: To comply with applicable laws and lawful law enforcement or regulatory requests.
• Legitimate Interests: To prevent fraud, secure our platform, and improve our services, where such interests do not override your fundamental rights.

6. Data Sharing and Third Parties

We share your personal data only in the following limited circumstances:

6.1 Service Providers

• Supabase (Database & Authentication): Our cloud database and authentication provider. Data is stored on Supabase infrastructure with encryption at rest and in transit.
• Payment processor: Processes mobile money and related transactions. The processor receives your phone number, name, email, and transaction amount to complete payments and is bound by its own privacy policy and applicable rules.

6.2 Legal and Regulatory Disclosure

We may disclose your personal data to government authorities, law enforcement agencies, regulators, or courts when:

• Required by a valid court order, warrant, or legal obligation
• Necessary to prevent or detect a crime or protect national security
• Necessary to protect the safety of any person
• Required by a regulator in the exercise of lawful authority

6.3 Between Users

Your public profile information (username, display name, avatar, bio, content) is visible to other users on the platform. Private messages are only visible to sender and recipient.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same protections described here.

7. Cross-Border Data Transfers

Our platform infrastructure is hosted on Supabase cloud services, which may involve storage and processing of data in countries other than your own. Where personal data is transferred internationally, we use appropriate safeguards, including:

• Transfers to providers with strong security and privacy commitments
• Contractual clauses binding recipients to protect data consistent with this policy
• Your explicit consent where required

8. Data Retention

• Account data: Retained for the duration of your account, plus a reasonable period after closure for legal, security, and dispute purposes
• Payment records: Retained as long as needed for accounting, fraud prevention, and legal compliance (typically up to 7 years)
• Content: Retained until deleted by you or removed by us for policy violations
• Messages: Retained for 1 year from date of sending, unless earlier deletion is requested
• Age verification consent records: Retained for the lifetime of the account for compliance purposes
• Usage/technical logs: Retained for up to 12 months

When data is no longer needed, we securely delete or anonymise it.

9. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion where there is no longer a legal basis for processing
• Right to Restriction: Request that we restrict processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on our legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing
• Right to Lodge a Complaint: Lodge a complaint with a relevant data protection authority where applicable

To exercise any of these rights, contact our DPO at dpo@gilda.app. We will respond within 30 days.

10. Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-Level Security (RLS) policies ensuring users only access their own data
• Secure authentication via Supabase Auth with industry-standard session management
• Access controls limiting who within our organisation can access personal data
• Regular security reviews and monitoring

In the event of a personal data breach that poses a risk to you, we will notify affected users and relevant authorities within a reasonable time, and in any event as required by applicable law.

11. Cookies and Local Storage

We use cookies and browser local storage to operate our platform:

• Essential cookies: Authentication session tokens required to remain logged in. These cannot be disabled without affecting core functionality.
• Preference storage: Theme preferences (dark/light mode) stored locally on your device.
• Age verification consent: A record of your age verification stored locally to avoid repeated prompts (expires after 30 days).

We do not use third-party advertising cookies or tracking pixels. You can clear cookies and local storage through your browser settings, but this will log you out and reset your preferences.

12. Children's Privacy

GILDA is a platform strictly restricted to persons aged 18 years and older. We do not knowingly collect, process, or retain personal data from anyone under 18.

If we become aware that a user is under 18, we will immediately suspend their account and delete all associated personal data. If you believe a minor has registered on our platform, please report it immediately to safety@gilda.app.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email and/or in-app notification at least 14 days before changes take effect
• Where required by law, obtain fresh consent

Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

14. Contact Us & Data Protection Officer

If you are not satisfied with our response, you may lodge a complaint with a competent data protection or consumer authority where you live.