Gamdo Privacy Policy

1. Information We Collect

Account data

• Email address
• Password, if you sign up with email, stored only as a bcrypt hash (we never store plaintext passwords)
• If you sign in with Google, Apple, Kakao, or LINE: your email address, your name (for Kakao, your nickname; for LINE, your display name), and an account identifier from that provider (for LINE, your LINE user ID). We do not receive your profile photo, and we do not store the provider’s sign-in tokens, with one exception: for LINE, we store an encrypted LINE token that is used only to disconnect LINE when you delete your account.
• Optional display name and brand details you enter
• A record of your agreement to our Terms of Service and this Privacy Policy: a hashed form of your email address, the versions you agreed to, the time, and how you signed up

Subscription and purchase data

• Your plan, subscription status, billing period, whether a cancellation is scheduled, when a payment failed, when your trial ends, and promotion codes you used
• Stripe customer, subscription, and price identifiers
• A history of credits added, used, and returned
• Editing styles you bought, with the credits charged and the date

Payments are processed by Stripe. Your card details, billing country, and invoices are kept by Stripe and are not stored by us.

Videos, audio, and other media you provide

• Videos, images, audio, and music files you upload or select
• Results of analyzing reference videos for editing styles, such as cuts, pacing, text placement, fonts, colors, and the type of sound used
• Transcripts of speech in your videos
• Narration scripts, generated narration audio, and subtitles
• Messages you send when editing a style with Gamdo AI, and the drafts it produces
• AI-generated background music you create, and the prompt used to create it
• Records of the requests we send to our AI providers and their responses, which we keep to improve how we instruct the AI

Videos and audio can include the faces and voices of people who appear in them. You may upload them only with the permission described in our Terms of Service. We do not use facial recognition, speaker identification, or voice cloning. When analyzing a video, our AI provider classifies whether people appear on screen (for example, a face, a body, or only hands) and estimates the gender of a voice to suggest a default narration voice. This is not used to identify anyone.

Instagram integration data (only when you connect an Instagram account)

• Instagram user ID
• Instagram username (@handle)
• Instagram account type (Business or Creator)
• Long-lived OAuth access token

Instagram comment data (only when you use the comment reply workbench or comment auto-replies)

• Comments on posts you published: the comment text, the commenter’s @handle, and the comment timestamp, temporarily cached to power the comment reply workbench
• On posts where you turn on comment auto-replies: every comment on that post, with the comment text, the commenter’s @handle, and the automatic classification result (for example, whether the comment needs your own reply)
• Replies you send through the workbench and auto-replies sent on your behalf (reply text and time sent)

Cached comments are used to show you your comments, to send the auto-replies you turned on, and to improve the accuracy of automatic comment classification (service quality improvement). They are used only internally and are never shown to other users or third parties. Cached comments are automatically deleted after 90 days, or immediately when you delete your account. Instagram remains the source of truth: deleting our cache does not delete the comment on Instagram. This feature requires the instagram_business_manage_comments permission.

Gamdo Influencer and marketplace data (only when you apply to sell editing styles)

• Your Instagram user ID, username, and follower count, with the time the follower count was checked
• For the posts you select: the post ID, link, like and comment counts, posting date, a thumbnail, and a copy of the video. We do not store captions.
• The name, description, and tags of your editing styles, and their review results
• Sales of your editing styles

X integration data (only when you connect an X account)

• X user ID, handle, and display name
• X profile image URL
• OAuth access token (encrypted)

TikTok integration data (only when you connect a TikTok account)

• TikTok account identifier (open_id)
• TikTok display name
• TikTok profile image URL
• OAuth access token

Threads integration data (only when you connect a Threads account)

• Threads user ID, username, display name, and profile picture URL
• Threads access token (encrypted), its expiry time, and the permissions you granted
• For posts you publish to Threads through the Service: the Threads post ID, its link, the time it was published, and the caption that was sent

When you open the Threads activity screen, the Service reads replies to your posts published through the Service (reply text, author username and profile picture, time) and the metrics of your Threads account and those posts (followers, profile views, likes, replies, reposts, quotes, clicks, and per-post views and shares). This data is fetched from Threads each time you open the screen to show it to you; the Service does not store it. The Service does not read your Threads direct messages, follower lists, or any Threads account other than the ones you connect yourself.

YouTube (Google) integration data (only when you connect a YouTube channel)

When you connect a YouTube channel, we receive and store: your channel ID, your channel handle (@name) or channel title, your channel avatar URL, and OAuth access and refresh tokens (encrypted at rest). We request two scopes:

• https://www.googleapis.com/auth/youtube.upload: to upload the video you created in the Service to your channel.
• https://www.googleapis.com/auth/youtube.readonly: used solely at the moment you connect your channel, to call channels.list and read your channel’s name, handle and avatar so that the Service can show you which channel it will publish to.

We do not read, collect, or store your YouTube videos, video analytics, comments, subscriber lists, playlists, watch history, or any other YouTube data. We do not access YouTube data on a schedule or in the background; YouTube API calls occur only when you connect a channel or when you initiate a publish.

The Service’s YouTube features use YouTube API Services, so the Google Privacy Policyalso applies to your YouTube data. You can revoke the Service’s access to your YouTube channel at any time, either from the Service’s integrations settings page or through the Google security settings page.

Service usage data

• Content you create (topics, slide text, AI-generated images, videos, layout settings)
• Publishing history (post URLs, scheduled times, publishing status)
• Direct message automation rules you create (trigger keywords, the message template to send, and rule settings)
• Notification channels you connect: for Discord, your Discord user ID, an access token, and the webhook URL you enter; for Slack, your Slack user and workspace IDs, the workspace name, and a bot token
• Referral data: the referral code and referral source used when you signed up, and the invitations you sent that led to sign-ups

Automatically collected data

• Server access logs, including your IP address, timestamps, and request information, used for security and incident response
• Onboarding usage records: which onboarding screens you viewed and which steps you chose or skipped, linked to your account. We do not record the text you type in these records.
• Website interaction data collected by Microsoft Clarity, such as pages viewed, clicks, scrolling, and mouse movements, together with device, browser, and approximate location information. Clarity can replay these interactions as a session recording. Text you type into input fields is masked and is not collected.
• Visit data collected by the Meta Pixel: pages viewed, whether you completed sign-up, device and browser information, IP address, cookie identifiers, and, when you sign up, a hashed email address and your account ID. Your email address is sent only as a hashed value, and we do not send your name.
• Visit data collected by Google Analytics: pages viewed, how you arrived (advertising campaign names and the site you came from), whether you started sign-up or checkout, device and browser information, approximate location, and cookie identifiers. We do not send your name, email address, or account ID to Google Analytics, and Google Analytics does not store IP addresses.
• Data kept in your browser, described in Section 4

Other than the cached comments and the marketplace data described above, the Service does not collect Instagram or TikTok direct message contents, insights, follower lists, videos, or any data from social media accounts other than your own connected accounts. Incoming comment and message events that trigger an automation rule are processed in real time and are not stored. If an automation rule includes a follow condition, the Service checks in real time whether that specific user follows your account at that moment; the result is not stored, and we never collect or store follower lists.

2. How We Use Information

• Email, hashed password, and sign-in provider data: creating your account, signing you in, identifying you, and contacting you about your account.
• Record of agreement: showing which versions of our terms and this policy you agreed to and when.
• Subscription and purchase data: managing your plan, credits, and payments, providing editing styles you bought, and preventing fraud.
• Videos, audio, and other media: creating editing styles by analyzing how a reference video is edited, creating subtitles from speech, applying editing styles, generating narration, and producing, previewing, and publishing the videos you request.
• Records of AI requests and editing style conversations: improving the instructions we give to our AI providers. We do not use the content you upload to train AI models, but we may use it to improve the Service, for example by looking at how a request and its result went.
• Instagram, TikTok, and X OAuth tokens: publishing content to your own connected account, executed only upon your individual approval of each post.
• Instagram username and account type; TikTok and X display name and profile image: displaying the connected account in the UI and confirming that publishing occurs only to the intended account.
• Threads (threads_basic): showing your connected Threads account (username and profile picture) and confirming that publishing goes to the intended account.
• Threads (threads_content_publish): publishing content to your own Threads profile, only when you choose to publish now or schedule a post, and posting the first reply you wrote on that post.
• Threads (threads_read_replies): showing the replies to your posts published through the Service.
• Threads (threads_manage_replies): posting a reply you write, and hiding or unhiding replies on your own posts when you choose to.
• Threads (threads_manage_insights): showing your account and post metrics in the Service.
• Gamdo Influencer and marketplace data: checking eligibility, reviewing editing styles, showing your listings to other users, providing editing styles to buyers, and recording sales.
• Content and publishing history: providing you access to your own creations and history.
• Cached comments: showing comments on your posts in the reply workbench, sending the comment auto-replies you turned on, improving the accuracy of automatic comment classification, and, only when you request it, drafting a suggested reply with AI.
• Direct message automation rules: sending the message you pre-wrote when a comment on your post matches the keywords you configured.
• Notification channels: sending the notifications you turned on. These can include the topic, status, and a link to the result of content you created; the platform, account name, and post link of a published post; and, for review requests and results, the email addresses of the requester and reviewer. Discord publishing notifications can also include the caption, first comment, and links to images or videos.
• Referral data: recording who invited you and granting referral rewards.
• Email address: sending verification codes and password reset emails.
• Server logs: maintaining account security, detecting misuse, and protecting the reliability of the Service.
• Onboarding usage records and Clarity interaction data: understanding where people get stuck or leave and improving the Service. We do not use them for advertising.
• Meta Pixel visit data: measuring how our advertising performs by counting how many people visit or sign up after seeing an ad, and optimizing who our ads are shown to.
• Google Analytics visit data: counting visits by campaign and page and how many visitors start sign-up or checkout, so we can compare our advertising and improve the website. We do not use it for ad personalization.

We do not use Instagram, TikTok, or Threads data for advertising, profiling, or training AI models. We use it only to provide the features you request: publishing posts you approved, operating the comment reply workbench, running the direct message automations you configure, showing replies and metrics for your Threads posts, and, for posts you select as a Gamdo Influencer, creating and listing editing styles.

YouTube data is used only to (a) identify the channel you selected as the publishing destination, and (b) upload the video you asked us to publish. It is never used for advertising, profiling, or training AI models, and it is not sent to OpenAI or Google Gemini.

Decisions made automatically

Some marketplace decisions are made automatically, without review by a person:

• an application to sell editing styles is declined if your Instagram account has fewer followers than required, you are on the free plan or a trial, or we cannot check your follower count;
• a post cannot be selected if it is not a video, has already been used, is not your own post, or is too long; and
• your listings are hidden if you move to a plan that is not eligible or your Instagram connection is removed or expires.

Rejections of editing styles and requests for changes are made by the Gamdo team. If you have a question about a decision, contact us at support@earthmera.com.

3. How We Share Information

We do not sell your personal information. We share data only with the following service providers and recipients, strictly for the purposes listed:

• Meta Platforms (Instagram API): receives the image or video URLs, caption, and your Instagram OAuth access token solely during a publishing action you approved.
• TikTok (Content Posting API): receives the images or video, caption, and your TikTok OAuth access token solely during a publishing action you approved.
• X (X API): receives the content, caption, and your X OAuth access token solely during a publishing action you approved.
• Threads (Threads API by Meta): receives the images or video, caption, and your Threads access token solely during a publishing, reply, or hide action you take, and receives requests to read replies and metrics when you open the Threads activity screen.
• OpenAI:receives your topic and brand inputs to generate text and images. To transcribe speech in your videos, only the audio track is sent to OpenAI. In addition, when you use the AI reply assistant in the comment reply workbench, the text of the comment you are replying to is sent to OpenAI to draft a suggested reply. When you turn on comment auto-replies for a post, the text of comments on that post is sent to OpenAI to classify them (for example, as a question or as praise). In both cases, the commenter’s identity (username, profile, or follower information) is never sent.
• Google (Gemini API): receives the video file and frame images of reference videos to analyze how they are edited, transcripts of your videos when an editing style is applied, and the text of your messages when you edit a style with Gamdo AI. When the Gemini provider is selected, it also generates text and images from your topic and brand inputs. Comment data is never sent to Gemini.
• Google Cloud and Microsoft Azure (Text-to-Speech): receive narration scripts to generate narration audio.
• Google (YouTube Data API): when you publish, we transmit the video file you created and its title and description to YouTube using your OAuth access token, in order to upload it to your channel. Your channel identifiers are exchanged with Google only for this purpose.
• Stripe: processes subscription payments. Stripe receives the payment details you enter, your email address, and your subscription details, and sends receipts and other payment emails.
• Google, Apple, Kakao, and LINE (LY Corporation) (sign-in): verify your identity when you choose to sign in with them.
• Discord and Slack: receive the notifications described in Section 2 for the destinations you connect.
• Zoho: sends verification codes and password reset emails to your email address.
• Amazon Web Services (AWS): hosting, database, file storage, content delivery (Amazon CloudFront), and log management.
• Cloudflare: delivering and protecting the Gamdo website.
• Microsoft (Clarity): receives the website interaction data described in Section 1 to provide usage analytics, heatmaps, and session recordings, as described in Section 4.
• Meta Platforms (Meta Pixel): receives the visit data described in Section 1 to measure advertising performance and optimize ad audiences, as described in Section 4.
• Google (Google Analytics, United States): receives the visit data described in Section 1 to count visits and sign-up and checkout starts by campaign and page, as described in Section 4. We turn off ad personalization, Google signals, data sharing with Google, and the link to Google Ads.
• Other users of the Service: if you list an editing style, other users can see the listing, including its name, description, thumbnails and playback of the reference videos, your Instagram username and follower count, and the like and comment counts of the selected posts.

Instagram-derived data is shared only with Meta Platforms, with OpenAI in the single case of comment text used to draft an AI reply, and, for posts you select as a Gamdo Influencer, with the AI providers described above to analyze them and with other users through your listing. TikTok-derived data is shared only with TikTok. Threads data is shared only with Meta Platforms. Publishing data is sent to each platform only at the moment a publishing action is executed. Platform data is not shared for any other purpose. We may also disclose information if required by law or to protect our rights, users, or the public.

Google API Services User Data Policy

Gamdo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Cookies and Browser Storage

We use a sign-in cookie and your browser’s local storage only for functions the Service needs:

• keeping you signed in;
• saving drafts in progress and remembering your language and interface settings; and
• holding a referral link you opened until you sign up, then removing it; and
• holding the details of the link you first arrived from (advertising campaign names such as UTM values, an advertising click ID, and the address of the site you came from) on this device until you sign up, after which we store them with your account information.

When you sign in with Google, Apple, Kakao, or LINE, those providers may set their own cookies under their own privacy policies. You can clear cookies and local storage in your browser settings, which will sign you out.

Microsoft Clarity

We use Microsoft Clarity to understand how people use the Gamdo website and Service. Clarity uses cookies and similar technologies to collect the interaction data described in Section 1, and it masks text you type into input fields. Microsoft processes this data under the Microsoft Privacy Statement. You can block or delete these cookies in your browser settings.

Meta Pixel

We use the Meta Pixel to measure how our advertising performs and to optimize who our ads are shown to. The Meta Pixel uses cookies to collect the visit data described in Section 1. Meta processes this data under the Meta Privacy Policy and may link it with its own account information. You can block or delete these cookies in your browser settings.

Google Analytics

We use Google Analytics to understand how many people visit Gamdo from each advertising campaign and page, and how many start sign-up or checkout. Google Analytics uses cookies to collect the visit data described in Section 1. We do not use it for ad personalization, and Google processes this data under the Google Privacy Policy. You can block or delete these cookies in your browser settings, or install the Google Analytics opt-out browser add-on.

5. How We Protect Information

• All traffic between your browser, our servers, and third parties uses HTTPS.
• OAuth access tokens for Instagram, TikTok, X, YouTube, and Threads, the LINE sign-in token, and access tokens for Discord and Slack, are encrypted at the application layer before being stored.
• Passwords are stored as bcrypt hashes.
• Database access is restricted to a least-privilege application user.
• Administrator access is separated by role, and administrator actions such as credit adjustments and review decisions are recorded.

Sensitive information is encrypted and stored securely. No method of transmission or storage is completely secure, but we work to protect your information with appropriate technical and organizational measures.

6. Data Retention

When you request deletion of your account, it is deleted 72 hours later. Unless a different period is stated below, data is kept while your account is active and deleted with your account.

• Account data (email, hashed password, sign-in provider data, display name, brand details): deleted with your account.
• Record of agreement to our terms and this policy: kept for 6 years after your account is deleted, with your email address stored only in hashed form.
• Uploaded videos used to create content, generated videos, thumbnails, transcripts, narration audio, and subtitles: retained for 90 days after the content is created, then deleted. For scheduled posts, the 90 days start when the post is published.
• Uploads that are never used in any content: deleted 30 days after you upload them.
• AI-generated background music: kept while it is saved in one of your categories, and deleted when you remove it from there. Music used in a video is deleted together with that video. Music that is neither saved nor used is deleted 30 days after it is created.
• Reference videos, analysis results, and copies of Instagram posts used for editing styles: not deleted after a set period. They are kept until you delete the editing style or your account, including when an editing style is rejected or you disconnect Instagram. An editing style cannot be deleted while it is listed for sale. When your account is deleted, these videos are deleted with it, and people who bought your editing styles can no longer view the reference videos.
• Editing style conversations and records of AI requests: kept until your account is deleted.
• Gamdo Influencer and marketplace data: kept when you disconnect Instagram, and deleted with your account as described above. Records of marketplace purchases are kept after deletion but are no longer linked to the account.
• Subscription data and credit history we store: deleted with your account.
• Payment amounts and onboarding usage history: after account deletion, this history is kept only in de-identified form for statistics. It is no longer linked to your account or to any payment identifier. Payment processing records are retained by our payment processor (Stripe) under its own policies and legal obligations.
• Social media OAuth tokens (Instagram, TikTok, X, Threads):retained while the connection is active and refreshed as needed; promptly revoked and deleted upon disconnection or account deletion. The platform may retain or recognize the token on its own systems until it expires or you deauthorize the Service in the platform’s settings.
• Threads replies and metrics: not retained; they are fetched only while you view them.
• Threads connection data after removal on Threads: if you remove Gamdo from your Threads settings, Meta notifies us and we promptly delete the stored Threads connection data (user ID, username, display name, profile picture URL, and token). Records of posts you published remain in your publishing history until you delete your Gamdo account. Posts already published on Threads stay on Threads until you delete them there.
• LINE sign-in token: kept, encrypted, while your account is active and used only to disconnect LINE; deleted with your account.
• YouTube integration data (channel ID, handle, avatar, tokens):retained until you disconnect the channel or delete your account. On disconnect in Gamdo we revoke the token with Google and delete the record immediately. If you revoke Gamdo’s access from your Google Account security settings (https://myaccount.google.com/permissions), we detect it automatically and delete your YouTube integration data within 30 days.
• Social account identifier data (user IDs, usernames, account type, profile image URL): retained only while the connection is active; deleted or de-identified within 30 days after disconnection or account deletion, except for the marketplace data described above and where retention is required for security or legal compliance.
• Content and publishing history (including post URLs and scheduled posts): deleted with your account.
• Cached comments (comment reply workbench and comment auto-replies): retained for up to 90 days, then automatically deleted. Also deleted immediately upon account deletion.
• Direct message automation rules and notification channels: deleted with your account, or immediately when you delete the rule or disconnect the channel.
• Server logs: retained for 90 days for security and incident response, then deleted.
• Onboarding usage records: retained while we need them to analyze and improve the onboarding experience.
• Clarity interaction data: retained by Microsoft according to its own retention schedule for Clarity.
• Meta Pixel visit data: retained by Meta according to its own retention schedule.
• Google Analytics visit data: deleted by Google 14 months after it is collected.

7. Your Rights and Choices

• Access and correction:you can review and update your account information in the Service’s settings page, or contact us at support@earthmera.com to request access to, correction of, or deletion of your personal information. Depending on where you live, you may have additional rights under applicable data protection law, and we will honor them.
• Disconnecting a social account:remove the Instagram, TikTok, or X integration at any time via the Service’s settings page. The Service promptly revokes and deletes the stored OAuth token. To also revoke access on the platform side, remove the Service from Instagram’s “Apps and websites” settings or TikTok’s “Security > Apps” settings.
• Disconnecting Threads:remove the Threads account from the Service’s connected accounts page; the stored token and profile data are deleted. To also revoke access on Threads, go to Threads > Settings > Account > Website permissions and remove Gamdo.
• Notifications: disconnect Discord or Slack at any time from the settings page.
• Account deletion:request deletion of your Gamdo account at any time via the Service’s settings page. Your account is deleted 72 hours after your request, and you may cancel during that time by signing in. If you remove the Gamdo connection from your Apple ID settings, Apple notifies us and the same 72-hour deletion applies. When your account is deleted, your LINE connection is also disconnected and the information we received from LINE is deleted. Section 6 describes the records we keep after deletion. If you cannot access your account, email support@earthmera.com.
• People who appear in videos: if you appear in a video uploaded to Gamdo or shown in a marketplace listing and did not agree to it, email support@earthmera.com. The Gamdo team will review the request and may take action, such as removing the video.

For step-by-step data deletion procedures, see the Gamdo Data Deletion page.

8. Children's Privacy

The Service is not directed to children under 14, and we do not knowingly collect personal information from children under 14. If we learn that a child under 14 has provided personal information, we will delete it as quickly as reasonably practical.

9. International Data Transfers

Our servers, database, and file storage are located in the United States. The service providers listed in Section 3, including OpenAI, Google, Microsoft, Stripe, and Zoho, may process data in the United States or other countries. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in those countries, where data protection laws may differ from those of your jurisdiction. We protect your information as described in this policy regardless of where it is processed.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the “Last updated” date at the top of this page. If we make material changes, we will notify you through the Service or by email.

11. Contact Us

If you have questions or comments about this policy, or wish to exercise your privacy rights, contact us at:

EarthMera
1010 Bedford Avenue #206
Brooklyn, NY 11205, United States
support@earthmera.com