Privacy Policy

GalaDesk Inc. ("GalaDesk," "we," "us," or "our") operates the GalaDesk platform at galadesk.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password. If you sign up through a third-party provider (e.g., Google), we receive basic profile information from that provider.

1.2 Organization & Event Data

We collect information you provide about your organization, including business name, team member details (names, emails, roles), job/event data, client information, venue addresses, and any notes or files you upload to the platform.

1.3 Payment Information

Payment processing is handled by Stripe. We do not store your credit card number or full payment details on our servers. We receive and store a transaction identifier, subscription status, and billing email from Stripe.

1.4 Usage & Analytics Data

We use Google Analytics 4 (GA4) to collect anonymized usage data, including pages visited, features used, session duration, device type, browser, and approximate geographic location. This data helps us improve the product.

1.5 Cookies & Local Storage

We use cookies and local storage to maintain your authentication session, remember your preferences, and support analytics. Essential cookies are required for the service to function. You can disable non-essential cookies through your browser settings, though some features may not work as expected.

1.6 Third-Party Services

When you use location-based features, we may send venue addresses to the Google Maps API to display maps and calculate distances. Google's privacy policy governs their handling of this data.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the GalaDesk platform
• Process subscriptions and payments
• Send transactional emails (e.g., account verification, password resets, job notifications)
• Provide customer support
• Analyze usage patterns to improve features and performance
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data to train AI or machine learning models.

3. Data Sharing & Third-Party Processors

We share data only with the following service providers who process it on our behalf:

• Supabase — database hosting and authentication
• Stripe — payment processing and subscription management
• Resend — transactional email delivery
• Google — Maps API (venue geocoding) and Analytics (GA4)
• Vercel — application hosting and edge delivery

Each processor is contractually obligated to handle your data securely and only for the purposes we specify. We may also disclose information if required by law, court order, or to protect the rights and safety of GalaDesk and its users.

4. Data Storage & Security

Your data is stored in Supabase-managed infrastructure with encryption at rest and in transit (TLS 1.2+). We implement role-based access controls, row-level security policies, and regular security audits. While no system is perfectly secure, we take commercially reasonable measures to protect your information.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal, accounting, or fraud-prevention purposes (up to 7 years for financial records).

Organization data (jobs, events, team records) is retained for the organization owner. If an organization is deleted, all associated data is permanently removed within 30 days.

6. Your Rights (GDPR & Global Privacy)

Regardless of where you are located, you have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate or incomplete data
• Erasure — Request deletion of your personal data ("right to be forgotten")
• Portability — Request your data in a structured, machine-readable format
• Restriction — Request that we limit processing of your data
• Objection — Object to processing based on legitimate interests
• Withdraw Consent — Where processing is based on consent, withdraw at any time

To exercise any of these rights, contact us at daniel@galadesk.com. We will respond within 30 days.

7. International Data Transfers

Your data may be processed in countries outside your own, including the United States. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place for any international transfers.

8. Children's Privacy

GalaDesk is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform at least 14 days before the changes take effect. Your continued use of GalaDesk after the effective date constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

GalaDesk Inc.
Email: daniel@galadesk.com
Website: galadesk.com