Privacy Policy

1. Who we are

GAMADS ("we", "us") is operated by Bulzay Solutions FZE (UAE trade licence no. 4423425.01), registered at Al Zahia Area, Entrance No. 2, Ground Floor, Sheikh Mohammed Bin Zayed Rd, Sharjah, United Arab Emirates. For any question about this policy or your data, contact ciprian@gamads.net.

2. What we collect

• Account data — the email address you sign up with, a hashed password, and the timestamp you accepted our Terms + this Policy.
• Usage data — counters of generations you run (images, copy, research), per-account, so we can enforce free-tier limits and bill Founder licenses.
• Third-party API keys — the keys you add for OpenRouter, Kie.ai, or Apify. These are AES-GCM encrypted at rest and never returned to your browser after you save them.
• Billing data — if you buy a Founder license, Stripe processes your payment; we store your Stripe customer id but never your card details.
• Content you generate — the prompts, briefs, and outputs you create inside GAMADS are stored in your workspace so you can revisit them.

3. Why we process it

• To operate your account (authentication, password reset, magic-link login).
• To enforce free-tier caps and process Founder license purchases.
• To send you transactional and occasional product emails (see §7).
• To provide customer support when you reach out.
• To comply with our legal obligations.

Legal bases under the GDPR: performance of the contract with you (running the service you signed up for) and our legitimate interest in operating and improving GAMADS securely.

4. Sub-processors

The following third-party services process data on our behalf:

• Supabase — authentication, database, file storage. Primary region: United States.
• Vercel — web hosting and edge network for the GAMADS app.
• Stripe — payment processing for Founder licenses.
• Resend — transactional and product emails.
• Your AI providers — OpenRouter, Kie.ai, Apify. You hold these accounts directly; we relay your prompts to them under your API keys.

5. How we protect your API keys

Your third-party API keys are encrypted with AES-GCM before being written to the database. The encryption key lives only in our server environment. Your keys are decrypted only on the server, at the moment a generation is dispatched to the third-party API, and never exposed back to the browser. Even we cannot bulk-export readable keys from our own database.

6. Your GDPR rights

If you are in the EU, EEA, or UK, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data ("right to be forgotten").
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw your consent at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these, email ciprian@gamads.net. We respond within 30 days.

7. Email

You will receive transactional email from GAMADS (confirmation, login links, billing receipts, security notices) as long as you have an active account. You may also receive product-update or feedback emails from Ciprian directly. These are low-volume, reply-friendly, and never tracked with pixels or wrapped links.

8. Data retention

We keep your account data for as long as your account is active. If you delete your account, we purge your workspaces, API keys, and personal data within 30 days, except where we are legally required to retain certain records (e.g. billing and tax records under UAE law, and, where applicable, EU record-keeping obligations).

9. International transfers

Your data may be processed outside the EU, primarily in the United States (where Supabase, Vercel, Stripe, and Resend operate). These transfers happen under the Standard Contractual Clauses approved by the European Commission.

10. Cookies

We set a small number of cookies, all strictly necessary: an authentication session cookie and a CSRF-protection cookie. We do not set marketing or analytics tracking cookies on this domain.

11. Children

GAMADS is not directed at children. You must be 18 or older to use the service.

12. Changes to this Policy

Material changes will be versioned and notified by email or in-app. Continued use after notice means you accept the revised Policy.