Gistilo — Privacy Policy

Last updated: 2025-10-09

Who we are

Gistilo ("we," "us," "our") provides an online tool that summarizes public video content and generates concise notes and insights.

Legal owner: Gistilo, British Columbia, Canada.

Contact: [email protected]

---

1) Scope

This policy explains what personal data we collect, how we use it, how long we keep it, and your rights. It applies to our website and app at Gistilo.ai and any connected endpoints we operate.

2) Data we collect

a) Account data (you provide)

• Email address and password (stored as a hash)
• Name
• Authentication timestamps

b) Usage & service data (automatic)

• IP address, device, and browser/OS information
• Session identifier (used to remember state)
• Request metadata (timestamps, response codes)
• Minute balance and ledger entries (grants, top‑ups, and usage)

c) Content you submit

• Links or prompts you provide (e.g., public video links)
• Results generated for you by the Service (e.g., summaries/notes)

d) Payments (via Stripe)

Payments are processed by Stripe. We do not collect or have access to complete payment card details (such as full card number or CVC). We may receive limited billing details (e.g., last four digits, card brand, expiry month/year) from Stripe for receipts and fraud prevention.

3) Why we process data (purposes & legal bases)

• Provide the Service (accounts, summaries/notes, usage tracking) — contract / legitimate interests
• Payments & billing — contract / legal obligations
• Security & abuse prevention (basic logging and anomaly detection) — legitimate interests
• Support & troubleshooting — legitimate interests
• Product analytics (aggregate, non‑advertising) — legitimate interests / consent where required

4) Cookies & similar tech

• Essential: session ID, CSRF, and settings needed for the app to function.
• Optional analytics (if enabled): we will disclose provider and provide an opt‑out.

We do not use third‑party advertising cookies.

5) Retention

• Account & billing records: while your account is active and as long as required by tax/financial laws.
• Minute ledger: retained for the current and prior billing cycles and as needed for audits.

6) Your rights

Depending on your location, you may have rights to access, correct, delete, or export your data, and object to/limit certain processing. To exercise rights, email [email protected] from the address associated with your account. We may verify your identity before acting.

• EU/EEA/UK: GDPR rights (access, rectification, erasure, restriction, portability, objection).
• California: CCPA/CPRA rights (know, delete, correct, opt‑out of "sale/share"). We do not sell personal information.

7) Security

We use reasonable safeguards: HTTPS in transit, hashed passwords, role‑limited access, and Stripe for payments. No method is 100% secure; report issues to [email protected].

8) Children

The Service is not directed to children under 13 (or the age required in your country). Do not use the Service if you are under that age.

9) Third‑party platforms

We may interact with third‑party platforms to fetch publicly available information that helps provide the Service (e.g., retrieving basic video metadata). Your use of those platforms remains subject to their terms and privacy policies. We do not connect to or access your personal accounts on those platforms.

10) International transfers

We may process data in Canada, the United States, or other countries where our providers operate. When transferring personal data, we use appropriate safeguards (e.g., contractual clauses).

11) Processors

Key providers include payment processors (e.g., Stripe) and hosting/infrastructure vendors. They process data on our behalf under appropriate agreements.

12) Changes to this policy

We may update this policy at any time without prior notice (unless notice is required by law). We will post the updated policy with a new "Last updated" date; continued use after the effective date means you accept the changes.

13) Contact

Email: [email protected]

---