Legal

Privacy Policy

Version 1 · in effect 17 Oct 2026 — 4 Nov 2026
Archived — replaced by version 2 on 4 Nov 2026Read the current version

Effective Date: Mart 19, 2026

1. General Information

This Privacy Policy defines how personal data is collected, used, stored, and protected within the GDHub platform.

The document is designed in accordance with GDPR (EU Regulation 2016/679) and reflects best practices for digital platforms, including those participating in EU funding and grant programs (e.g. AMIF, EIT, Creative Europe).

2. Data Controller

Operator (Data Controller):

Individual Entrepreneur Dzmitry Drynau (individual entrepreneur), legal entity code 306422564

Registered office address: Police Street I Dead End, N5, Samgori District, Tbilisi 0182, Georgia

Email: office@gdhub.io

3. Categories of Data

3.1 Public Profile Data

This data is visible to other users of the platform:

  • First name, last name
  • Profile photo
  • Skills, experience, portfolio links
  • Tools and technologies used
  • Availability (time commitment)
  • Participation in projects Purpose: collaboration, team formation, visibility in the ecosystem

3.2 Private Data (Restricted Access)

This data is not publicly visible:

  • Email address
  • Year of birth
  • IP address
  • Technical logs
  • Account activity Purpose: authentication, security, analytics

3.3 Communication Data

  • Telegram / Discord username
  • Messages or interactions (if applicable in future features) Purpose: enabling collaboration and communication

3.4 Checkpoint Data

When a project runs a Checkpoint:

  • the goal card, devlogs, evidence, weekly check-ins and the verdict
  • call recordings (audio) and their transcripts, made when the curator joins a call; the room says so before anyone joins
  • the call notes written from the transcripts
  • the names of those who join a call, shown to the curator Purpose: running the Checkpoint and keeping its record. The recording and the transcript are not shown to anyone; they are kept with the Checkpoint's record unless you ask us to delete them.

3.5 Optional Data

  • City / country Purpose: improving matching, localization

4. Purposes of Processing

Data is processed for:

  1. Providing core platform functionality
  2. Enabling collaboration between users
  3. Supporting user accounts and authentication
  4. Improving the Service (analytics, UX)
  5. Ensuring security and fraud prevention
  6. Complying with legal obligations

5. Legal Basis

Processing is based on:

  • Contract (Terms of Service)
  • Consent
  • Legitimate interest (platform development, security)

6. Infrastructure & Subprocessors

To operate the platform, GDHub uses third-party services (“subprocessors”).

Core Infrastructure:

  • Cloud Hosting: Vercel
  • Database: PostgreSQL (managed hosting providers)
  • Authentication & APIs: custom backend services
  • Analytics (optional): may include tools like Google Analytics or similar
  • Communication tools: Telegram / Discord (user-initiated)
  • Payments: Paddle.com, our reseller and Merchant of Record (vacancy listings, AI Checkpoints and other purchases); Paddle processes payment data as an independent controller under its own privacy notice
  • Video calls: Daily.co (Checkpoint calls, their recording and transcription)
  • AI processing: OpenAI (the AI curator's reviews, Checkpoint call notes, and checks of text entered in forms) These providers may process data on behalf of the Operator under contractual agreements.

7. Data Processing Agreement (DPA)

If GDHub provides services to organizations (e.g. studios, universities, incubators), a Data Processing Agreement (DPA) may apply.

In such cases:

  • GDHub acts as a Data Processor

  • The client organization acts as a Data Controller The DPA includes:

  • scope and purpose of processing

  • data categories

  • security measures

  • confidentiality obligations

  • subprocessors list

  • data subject rights support

  • breach notification procedures A standard DPA can be provided upon request at privacy@gdhub.io

8. Data Retention

Data is retained:

  • while the account is active

  • up to 30 days after deletion (for recovery/security)

  • longer if required by law After retention period:

  • data is deleted or anonymized

9. Cross-Border Transfers

Data may be transferred outside the user’s country, including outside the EU.

Safeguards include:

  • Standard Contractual Clauses (SCCs)
  • GDPR-compliant providers
  • secure infrastructure

10. Security Measures

GDHub applies:

  • HTTPS encryption
  • access control (role-based)
  • secure authentication
  • infrastructure monitoring
  • regular updates

11. Cookies

Cookies are used for:

  • session management
  • preferences
  • analytics Users can disable cookies in browser settings.

12. Data Sharing

Data may be shared:

  • with infrastructure providers (hosting, analytics)
  • when required by law
  • with user consent GDHub does not sell personal data.

13. User Rights

Users have the right to:

  • access their data
  • correct inaccuracies
  • delete data
  • restrict processing
  • transfer data
  • object to processing
  • withdraw consent Requests: privacy@gdhub.io

Users may also contact their local Data Protection Authority (DPA).

14. Breach Notification

In case of a data breach:

  • users will be notified if required by law
  • authorities will be informed where applicable

15. Changes

This Policy may be updated.

Latest version is always available on the platform.