[{"data":1,"prerenderedAt":568},["ShallowReactive",2],{"legal-\u002Flegal\u002Fprivacy":3},{"id":4,"title":5,"body":6,"description":559,"extension":560,"meta":561,"navigation":562,"path":563,"seo":564,"stem":565,"updated":566,"__hash__":567},"legal\u002Flegal\u002Fprivacy.md","Privacy policy",{"type":7,"value":8,"toc":543},"minimark",[9,24,29,44,51,55,76,80,85,96,101,113,118,129,134,139,144,152,157,162,165,169,235,238,242,325,328,334,337,341,369,372,376,379,383,386,400,406,420,424,510,517,520,524,527,531,534,538],[10,11,12,13,17,18,23],"p",{},"This policy explains how personal data is handled when you visit gateroam.com, use the GateRoam app, or connect an AI app to the GateRoam MCP server (together, the ",[14,15,16],"strong",{},"Service","). It is part of our ",[19,20,22],"a",{"href":21},"\u002Flegal\u002Fterms","Terms of service",".",[25,26,28],"h2",{"id":27},"_1-who-is-responsible","1. Who is responsible",[10,30,31,32,35,36,39,40,43],{},"GateRoam is a spin-off project built with Current Code. It has no legal structure of its own yet and is offered for testing purposes only. Until it has its own company, the controller of your personal data is ",[14,33,34],{},"Tine Dolenc, s.p.",", Slovenia (\"",[14,37,38],{},"we","\", \"",[14,41,42],{},"us","\").",[10,45,46,47,23],{},"Contact for anything about your data: ",[19,48,50],{"href":49},"mailto:tine@current-code.com","tine@current-code.com",[25,52,54],{"id":53},"_2-our-two-roles","2. Our two roles",[56,57,58,65],"ul",{},[59,60,61,64],"li",{},[14,62,63],{},"Controller",": for data about you as a visitor, a registered user or someone who contacts us. This policy covers that.",[59,66,67,70,71,75],{},[14,68,69],{},"Processor",": for personal data your agency puts into the Service about other people, mainly your clients (for example a client's name on an offer, or what you write in it). Your agency is the controller of that data and we process it only on its behalf. Our ",[19,72,74],{"href":73},"\u002Flegal\u002Fdpa","Data Processing Agreement"," covers this.",[25,77,79],{"id":78},"_3-what-we-collect","3. What we collect",[10,81,82],{},[14,83,84],{},"Account and agency",[56,86,87,90,93],{},[59,88,89],{},"your name, email address and password (stored only as a secure hash by our authentication provider), or your Google account name and email if you sign in with Google;",[59,91,92],{},"your agency's name, country, logo and offer design;",[59,94,95],{},"membership details: your role, invites you sent or received, when you joined.",[10,97,98],{},[14,99,100],{},"AI connections and supplier keys",[56,102,103,106],{},[59,104,105],{},"the AI apps you connected and their client IDs; personal access tokens and refresh tokens are stored only as hashes;",[59,107,108,109,112],{},"your agency's supplier keys (for example Amadeus), ",[14,110,111],{},"encrypted"," with a key kept apart from the database.",[10,114,115],{},[14,116,117],{},"Use of the Service",[56,119,120,123,126],{},[59,121,122],{},"a log of every call an AI app makes to GateRoam: who, when, which tool, the arguments the AI sent (for example route, dates and number of passengers, or a client name for an offer), whether it worked and how long it took;",[59,124,125],{},"searches and their results, and a log of every supplier call made with your keys;",[59,127,128],{},"client offers you create: title, client name, options, prices, text, pictures and design; and when each offer's link was opened: first time, last time and how often. No IP address and no cookie is kept for this.",[10,130,131],{},[14,132,133],{},"Contact and demo requests",[56,135,136],{},[59,137,138],{},"name, email, company and message when you use the contact or demo form.",[10,140,141],{},[14,142,143],{},"Technical data",[56,145,146,149],{},[59,147,148],{},"IP address, browser and device details, and request logs on our servers and at Cloudflare;",[59,150,151],{},"a spam check (Cloudflare Turnstile) on the login, register, password reset and demo forms.",[10,153,154],{},[14,155,156],{},"Marketing source",[56,158,159],{},[59,160,161],{},"where your first visit came from: campaign tags (UTM), the referring website, the first page you opened and the time. See section 9.",[10,163,164],{},"We do not ask for special categories of data (such as health data). Please do not put them in the Service.",[25,166,168],{"id":167},"_4-why-we-use-it-and-on-what-legal-basis","4. Why we use it and on what legal basis",[170,171,172,185],"table",{},[173,174,175],"thead",{},[176,177,178,182],"tr",{},[179,180,181],"th",{},"Purpose",[179,183,184],{},"Legal basis (GDPR)",[186,187,188,197,205,212,220,227],"tbody",{},[176,189,190,194],{},[191,192,193],"td",{},"Create and run your account and agency, connect AI apps, call your suppliers, build offers",[191,195,196],{},"Contract, Art. 6(1)(b)",[176,198,199,202],{},[191,200,201],{},"Keep the Service secure, prevent spam and abuse, find and fix errors, enforce usage limits",[191,203,204],{},"Legitimate interests, Art. 6(1)(f)",[176,206,207,210],{},[191,208,209],{},"Understand how the website is used (cookieless statistics) and which channels bring new agencies",[191,211,204],{},[176,213,214,217],{},[191,215,216],{},"Answer contact and demo requests",[191,218,219],{},"Steps before a contract \u002F legitimate interests, Art. 6(1)(b) and (f)",[176,221,222,225],{},[191,223,224],{},"Send service emails (confirmations, invites, password resets, important changes, notice of any future fees)",[191,226,196],{},[176,228,229,232],{},[191,230,231],{},"Meet legal obligations",[191,233,234],{},"Legal obligation, Art. 6(1)(c)",[10,236,237],{},"We do not sell your data, we do not show ads and we do not use your data to train AI models.",[25,239,241],{"id":240},"_5-who-helps-us-sub-processors","5. Who helps us (sub-processors)",[170,243,244,257],{},[173,245,246],{},[176,247,248,251,254],{},[179,249,250],{},"Provider",[179,252,253],{},"What for",[179,255,256],{},"Where",[186,258,259,270,281,292,303,314],{},[176,260,261,264,267],{},[191,262,263],{},"Supabase",[191,265,266],{},"Database, authentication, file storage (logos)",[191,268,269],{},"EU (Ireland)",[176,271,272,275,278],{},[191,273,274],{},"Hetzner Online",[191,276,277],{},"Application server",[191,279,280],{},"EU (Helsinki, Finland)",[176,282,283,286,289],{},[191,284,285],{},"Cloudflare",[191,287,288],{},"DNS, network protection, content delivery, Turnstile spam check",[191,290,291],{},"Global network",[176,293,294,297,300],{},[191,295,296],{},"Resend",[191,298,299],{},"Sending emails",[191,301,302],{},"See Resend's privacy policy",[176,304,305,308,311],{},[191,306,307],{},"Umami (Umami Cloud)",[191,309,310],{},"Cookieless website statistics",[191,312,313],{},"EU",[176,315,316,319,322],{},[191,317,318],{},"Google",[191,320,321],{},"Sign-in with Google, only if you choose it",[191,323,324],{},"Global",[10,326,327],{},"Each provider only gets what it needs for its task. Where data leaves the EU\u002FEEA, the transfer relies on an EU adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.",[10,329,330,333],{},[14,331,332],{},"Not our sub-processors",": your travel suppliers (such as Amadeus) and your AI app (such as Claude or ChatGPT). Your agency sends data to them under its own contracts and their own privacy policies. When your AI app calls GateRoam, the results go back to that AI app.",[10,335,336],{},"We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a company that takes over GateRoam (we will tell you first).",[25,338,340],{"id":339},"_6-how-long-we-keep-it","6. How long we keep it",[56,342,343,349,355,360,366],{},[59,344,345,348],{},[14,346,347],{},"Account, agency and its content"," (offers, searches, logs, keys): while the account and agency exist. When an agency or account is closed, we delete its data within 90 days, apart from what we must keep by law.",[59,350,351,354],{},[14,352,353],{},"Supplier keys and AI connections",": until you remove them, or the agency is closed.",[59,356,357,359],{},[14,358,133],{},": up to 3 years after the last contact.",[59,361,362,365],{},[14,363,364],{},"Server and security logs",": only as long as needed for security and fixing errors.",[59,367,368],{},"You can ask us to delete your data sooner (see section 8).",[10,370,371],{},"GateRoam is in early access, so we may also delete test data, old searches or logs at any time.",[25,373,375],{"id":374},"_7-security","7. Security",[10,377,378],{},"Connections use TLS. Supplier keys are encrypted with a separate key. Access to agency data is limited by role and by database row-level security, so one agency cannot see another agency's data. Tokens are stored only as hashes. No system is completely secure: use a strong password and keep your tokens secret.",[25,380,382],{"id":381},"_8-your-rights","8. Your rights",[10,384,385],{},"Under the GDPR you can ask us to:",[56,387,388,391,394,397],{},[59,389,390],{},"give you a copy of your personal data (access) and give it to you in a machine-readable format (portability);",[59,392,393],{},"correct it (rectification) or delete it (erasure);",[59,395,396],{},"restrict how we use it, or object to use based on legitimate interests;",[59,398,399],{},"withdraw consent where we asked for it.",[10,401,402,403,405],{},"Email ",[19,404,50],{"href":49},". We answer within one month and may ask you to confirm your identity. For data your agency put into the Service about its clients, contact the agency: it decides, and we help it.",[10,407,408,409,412,413,419],{},"You can also complain to the Slovenian data protection authority: ",[14,410,411],{},"Informacijski pooblaščenec",", Dunajska cesta 22, 1000 Ljubljana, ",[19,414,418],{"href":415,"rel":416},"https:\u002F\u002Fwww.ip-rs.si",[417],"nofollow","www.ip-rs.si",", or to the authority where you live or work.",[25,421,423],{"id":422},"_9-cookies-and-similar-technologies","9. Cookies and similar technologies",[170,425,426,442],{},[173,427,428],{},[176,429,430,433,436,439],{},[179,431,432],{},"Name",[179,434,435],{},"What it does",[179,437,438],{},"How long",[179,440,441],{},"Type",[186,443,444,463,479,493],{},[176,445,446,454,457,460],{},[191,447,448,449,453],{},"Supabase session cookies (",[450,451,452],"code",{},"sb-…",")",[191,455,456],{},"Keep you logged in",[191,458,459],{},"Until you log out or the session ends",[191,461,462],{},"Necessary",[176,464,465,470,473,476],{},[191,466,467],{},[450,468,469],{},"gr_attribution",[191,471,472],{},"Remembers the source of your first visit (campaign tags, referring site, first page, time). It is read once, when you create an agency or send a demo request, stored with it, and then deleted. Used only by us, never shared.",[191,474,475],{},"Up to 90 days",[191,477,478],{},"Our own statistics",[176,480,481,484,487,490],{},[191,482,483],{},"Cloudflare Turnstile",[191,485,486],{},"Checks that a form is sent by a person, not a bot",[191,488,489],{},"During the check",[191,491,492],{},"Security",[176,494,495,501,504,507],{},[191,496,497,498,453],{},"Browser storage (",[450,499,500],{},"gr-early-access-notice",[191,502,503],{},"Remembers that you closed the early-access notice in the app",[191,505,506],{},"Until you clear it",[191,508,509],{},"Functional",[10,511,512,513,516],{},"Our website statistics (Umami) are ",[14,514,515],{},"cookieless",": they set no cookie and build no profile of you. Umami receives your IP address through our server to work out your country and does not store it.",[10,518,519],{},"You can delete or block cookies in your browser. Blocking the session cookies means you cannot log in.",[25,521,523],{"id":522},"_10-children","10. Children",[10,525,526],{},"The Service is for businesses and not for anyone under 18. We do not knowingly collect data about children.",[25,528,530],{"id":529},"_11-changes","11. Changes",[10,532,533],{},"We may update this policy. The date at the top shows the latest version. We will tell registered users about important changes by email or in the app.",[25,535,537],{"id":536},"_12-contact","12. Contact",[10,539,540,541,23],{},"Tine Dolenc, s.p., operator of GateRoam: ",[19,542,50],{"href":49},{"title":544,"searchDepth":545,"depth":545,"links":546},"",2,[547,548,549,550,551,552,553,554,555,556,557,558],{"id":27,"depth":545,"text":28},{"id":53,"depth":545,"text":54},{"id":78,"depth":545,"text":79},{"id":167,"depth":545,"text":168},{"id":240,"depth":545,"text":241},{"id":339,"depth":545,"text":340},{"id":374,"depth":545,"text":375},{"id":381,"depth":545,"text":382},{"id":422,"depth":545,"text":423},{"id":522,"depth":545,"text":523},{"id":529,"depth":545,"text":530},{"id":536,"depth":545,"text":537},"What personal data GateRoam collects, why, who helps us process it, how long we keep it and your rights.","md",{},true,"\u002Flegal\u002Fprivacy",{"title":5,"description":559},"legal\u002Fprivacy","2026-10-04","XwYrm09BhIB1sxc0hYNGhFvbXcR-RfhKyzWn37pKAQA",1791149030404]