Privacy Policy
Last updated: 10 October 2026
1. Information We Collect
We collect information you provide directly:
- Account information: email address, name, organisation name
- Files you upload to the Service
- Lead data collected through your gated files (names, emails, company names)
We also collect usage data automatically:
- File view and download events
- Device and browser information
- IP addresses (for analytics and security)
- Counts of how shared pages are used, such as how often a gate is shown and passed
- Which features of the app you and your team use, such as copying a link or opening the leads page. We record that it happened, who did it and when, kept for 12 months; never the contents of your files or anything you type
2. How We Use Your Information
We use collected information to:
- Provide and maintain the Service
- Process file sharing and lead capture
- Generate analytics and reports for your dashboard
- Send transactional emails (magic links, notifications)
- Send getting-started emails to people who create an organisation
- Improve the Service and develop new features
When someone opens a page you have shared, we count that a gate was shown and whether it was passed. We keep these as daily counts per organisation and use them only to understand, in aggregate, how the Service is used. They do not identify your recipients: no name, email address, IP address or cookie is recorded with them. The detail behind the counts is deleted within 30 days. To have your organisation’s shared pages left out, contact us.
When you create an organisation, we send you up to three getting-started emails in your first two weeks, to help you share your first link. People invited to an organisation do not get them. Which of them you get depends on what your own account has done: whether a file is ready to share, and whether anyone has got through a gate on something you shared. We do not use this to send you anything else.
Every one of these emails has an unsubscribe link, and you can stop them at any time from your Account page. Emails about your account, such as sign-in links and notifications, still arrive.
3. Data Storage and Security
Your files are encrypted at rest and in transit. GateDocs runs on Supabase, which runs on AWS — we do not run our own servers or data centres. Access to your data is restricted to authorised personnel only.
4. Lead Data
When you enable lead capture on a file, visitors who complete the form consent to sharing their information with you (the file owner). You are responsible for how you use this lead data. We store it securely on your behalf and you may export or delete it at any time.
5. Data Sharing
We do not sell your personal information. We may share data with third-party service providers who help us operate the Service (hosting, email delivery, payment processing, website analytics). These providers are bound by data processing agreements.
Notifications and getting-started emails are delivered by Resend, which processes and stores data in the United States. Resend receives your email address and the content of each email we send you, and tells us whether it was delivered, bounced or was marked as spam.
6. GDPR Compliance
We process data in accordance with GDPR requirements. You have the right to access, correct, or delete your personal data. You may also request data portability or object to processing. Contact us to exercise these rights.
7. Data Retention
We keep your data for as long as your account exists. Cancelling a paid plan moves your organisation to the Free plan; it does not delete your files, leads or settings. Files you move to the trash are permanently deleted after 30 days. Deleting your account removes it straight away. If you are the last member of an organisation, its files and leads are deleted with it; otherwise they stay with the organisation. You may ask us to delete your data at any time.
We keep a copy of each getting-started email for 30 days after it is sent, and a record of which were sent or skipped, and whether they arrived, for 12 months. Deleting your account removes both.
If you unsubscribe, or an email to your address bounces or is marked as spam, we keep a scrambled form of the address that cannot be turned back into it, so that we do not send these emails to that address again. If the address turns out not to exist, we stop sending notifications to it as well. This is kept after your account is deleted. If you tell us why you unsubscribed, that answer is kept with it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email. Continued use of the Service after changes constitutes acceptance.
10. Contact
For privacy-related questions or to exercise your data rights, contact us at hello@gatedocs.io.