Privacy Policy

1. General Information

This Privacy Policy explains how personal data is collected, used, stored and protected on gdhub.io (the "Platform"). It is written to meet the Law of Georgia on Personal Data Protection and, for users in the European Union, the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. Data Controller

Individual Entrepreneur Dzmitry Drynau (individual entrepreneur), legal entity code 306422564

Registered office address: Police Street I Dead End, N5, Samgori District, Tbilisi 0182, Georgia

Email for data-protection requests: privacy@gdhub.io

Representative in the European Union (Article 27 GDPR): VšĮ Žaidimų Kūrėjų Hubas, legal entity code 307277444, Giedraičių g. 39-R53, LT-09302 Vilnius, Lithuania, privacy@gdhub.io. Users in the EU and supervisory authorities may address it on any question about the processing of personal data on the Platform. It acts only as our representative and is not the controller or the seller.

3. Categories of Data

3.1 Public Profile Data

Visible to other users of the Platform:

• First name, last name
• Profile photo
• Skills, experience, portfolio links
• Tools and technologies used
• Availability (time commitment)
• Participation in projects

Purpose: collaboration, team formation, visibility in the community.

3.2 Account Data (not public)

• Email address
• Year of birth
• Sign-in data from Google, where you sign in with it
• IP address and technical logs
• Account activity

Purpose: authentication, security, operating the Platform.

3.3 Communication Data

• Messages in the Platform's chat
• Telegram / Discord username, where you add it

Purpose: collaboration and communication between users.

3.4 Project and Checkpoint Data

• Project pages, devlogs, vacancies and applications
• In an AI Checkpoint: the goal card, devlogs, evidence, weekly check-ins, the AI curator's reviews and the verdict

Purpose: running the Platform's features and the Checkpoint, and keeping the Checkpoint's record and certificate.

3.5 Payment Data

Payments are taken by Paddle.com, our reseller and Merchant of Record. Your card details go to Paddle and never reach us. We receive the name, email, country, product, amount and transaction reference of a purchase.

Purpose: delivering what you bought, refunds, accounting.

3.6 Optional Data

• City / country

Purpose: improving matching and localisation.

4. Purposes and Legal Basis

5. Service Providers

The Platform uses these providers to operate. They process data on our behalf under contractual terms, except Paddle, which acts as an independent controller under its own privacy notice.

• Hosting: Vercel
• Database and cache: managed PostgreSQL and Redis hosting
• Files and images: Sanity
• Search: Typesense
• Sign-in: Google (where you choose to sign in with Google)
• Email and notifications: our email delivery provider, Novu, Firebase (web push)
• Newsletter: Brevo, which with your consent also connects visits to the Platform with the newsletter
• Chat: Matrix
• Payments: Paddle.com, reseller and Merchant of Record for vacancy listings and AI Checkpoints
• AI processing: OpenAI — the AI curator's reviews and checks of text entered in forms. Under its API terms OpenAI does not use this data to train its models.
• Analytics and marketing, only with your consent (through Google Tag Manager, see the Cookie Policy): Google Analytics, Google Ads, Google AdSense, Meta Pixel, Plerdy
• Support chat: Crisp, only with your consent

6. Data Retention

• Account data: while the account is active, and up to 30 days after it is deleted (for recovery and security).
• Content you contributed to shared work (e.g. devlogs, project pages): may be kept in anonymised form, as the Terms of Use describe.
• The record and certificate of a closed Checkpoint: kept after the Checkpoint ends, including after the account is closed, as the Checkpoint Purchase Terms describe.
• Payment and accounting records: for the period tax and accounting law requires.

After that, data is deleted or anonymised.

7. Cross-Border Transfers

The controller is established in Georgia, and several providers are in the United States or elsewhere outside your country. Transfers rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework), Standard Contractual Clauses, or the provider's equivalent safeguards.

8. Security Measures

• HTTPS encryption
• Role-based access control
• Secure authentication
• Infrastructure monitoring
• Regular updates

9. Cookies

How cookies are used, and how to choose which ones, is described in the Cookie Policy.

10. Data Sharing

Data is shared only with the providers in Section 5, with other users as the features you use require, when required by law, or with your consent. We do not sell personal data.

11. Age

The Platform is for people aged 16 or over, as the Terms of Use set out. We do not knowingly collect data of younger children.

12. Your Rights

You have the right to:

• access your data
• correct inaccuracies
• delete your data
• restrict processing
• receive your data in a portable form
• object to processing based on legitimate interest
• withdraw consent at any time, without affecting processing before it

Requests: privacy@gdhub.io. We answer within one month.

You may also complain to the Personal Data Protection Service of Georgia or, if you are in the European Union, to the data protection authority of your country.

13. Breach Notification

In case of a data breach we notify the competent authority and the affected users where the law requires it.

14. Changes

We may update this Policy. Each version is published here with the date it takes effect.