Privacy Policy

To operate the Service — authenticate you, show you deals you're a party to, notify counterparties of activity by email, and memorialize signed contracts. We do not sell your data and do not use deal content for advertising.

Deal content is shared only with the counterparties named on that deal (supplier, agent, and — where applicable — a brand manager on the same brand). Row-level security enforces this at the database layer.

We use a small number of infrastructure providers to run the Service: Lovable Cloud (application hosting and database), Supabase (managed Postgres and authentication), and Lovable Email (transactional and authentication emails from notify.gadabout.io).

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access within the app is scoped by row-level security to the parties on each deal. Passwords are checked against the Have I Been Pwned database at signup.

Account and deal data are retained while your account is active. Signed contracts are retained for the term of the agreement plus the notice period. You may request deletion of your account; signed contracts may be retained where required by law or by the other party's contractual rights.

You may access, correct, export, or request deletion of your personal data by emailing us. We aim to respond within 30 days.

We use only strictly necessary cookies and local storage for authentication and session management. No third-party analytics or advertising cookies are set.

We will announce material changes to this policy in the app or via email.

Privacy questions: privacy@gadabout.io.