This policy explains what personal data Gatekept collects, why, who it is shared with, how long it is kept, and the choices and rights you have.
1.Who we are
Gatekept operates Gatekeptand is responsible for the personal data described in this policy (the “controller” under data protection law). Contact us about privacy at on@gateke.pt. This policy applies to the Gatekept websites (including gatekept.to, .art, .work and .agency) and apps.
2.What we collect
You give us
- Account details: email address, username, display name, password (stored only as a hash), profile photo, banner, bio, links and settings.
- Content: products, files, posts, stories, comments, reviews, messages, commission answers and anything else you upload or send.
- Seller details: payout and tax information you give us or our payment provider, and your country.
- Identity verification: if you use a feature that requires it (such as adult content), you give documents and a selfie to our verification provider. We receive the result and the date, not copies of your documents.
- Communications: what you send us in support requests, reports, reviews of decisions and appeals.
We collect automatically
- Usage data: pages and products viewed, clicks, searches and how long you stay, used for analytics and recommendations.
- Referral context: the referring site, campaign tags (UTM) and ad-click identifiers in the link that brought you, and the page you landed on, so we and creators can see where visits and sales come from.
- Device and session data: IP address, browser, operating system and approximate location derived from your IP, used for security, the sessions list in Settings, fraud prevention and tax rules.
- Security and audit logs: sign-ins, purchases, tips and other sensitive actions are logged with IP address and browser details.
- Media access records: when protected media is viewed or downloaded, we record which account accessed it and embed a watermark identifying that account, so leaks can be traced.
We receive from others
- Payment providers: payment status, the last digits and brand of your card, and payout and verification status. We never receive your full card number.
- Other users: reports about you, reviews of your products, and messages sent to you.
3.How we use it, and our legal bases
If you are in the European Economic Area or the United Kingdom, we must have a legal basis for each use of your data. These are ours:
| Purpose | Legal basis |
|---|---|
| Creating and running your account; showing your profile and products | Performing our contract with you |
| Processing purchases, commissions, auctions, tips and payouts | Performing our contract with you |
| Sending receipts, order updates, security alerts and notices of changes | Performing our contract; legal obligation |
| Detecting fraud, scams, malware and abuse; enforcing our rules; scanning messages and uploads | Our legitimate interest in keeping users safe; legal obligation where it applies |
| Identity and age verification for adult content and selling | Legal obligation; our legitimate interest in preventing harm to minors; your consent where required |
| Analytics, recommendations and improving the Platform | Our legitimate interest in running and improving the Platform |
| Showing ads on Discover, in the feed and under posts and products | Your consent where required by law; otherwise our legitimate interest |
| Tax, accounting and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights. You can object (see section 8). Where we rely on consent, you can withdraw it at any time.
Moderation decisions are made by people. Automated systems help us find content to review and block some clearly harmful messages and files, but they do not on their own disable accounts or hold payouts.
5.Messages and safety
Direct messages are private from other users but not from Gatekept. They are encrypted in transit and at rest but are not end-to-end encrypted, so our systems can access them.
- Automated scanning: every message is checked when sent for scams, phishing, threats, off-platform payment requests and content that endangers minors.
- Human review: moderators see message content only after an automated flag, a report by someone in the conversation, or a valid legal request. Access is restricted and logged.
- Legal obligations: we report child sexual abuse material to NCMEC as required by law and respond to valid legal process.
If you need conversations no service operator can read, use an end-to-end encrypted messenger.
7.How long we keep it
| Data | How long |
|---|---|
| Account and profile | While your account exists. When you delete it, your profile is anonymized and your content removed. |
| Purchases, payouts and tax records | As long as tax and financial law requires, typically up to 7 years. |
| Moderation decisions, reports and appeals | While the account exists and for as long afterwards as needed to prevent repeat abuse and handle legal claims. |
| Feed impression data | 7 days |
| Onboarding analytics | 180 days |
| Security, audit and media access logs | As long as needed for security and to investigate leaks or fraud, then deleted on a schedule. |
| Backups | Overwritten on a rolling basis. |
We keep data longer if the law requires it or it is needed for an ongoing dispute or investigation.
8.Your rights and choices
You can always:
- Edit your profile, email and username in Settings.
- Download a copy of your data, or ask us for one.
- Delete your account in Settings. Buyers keep products they bought; transaction records are kept as described above.
- Control email notifications in Settings.
- See moderation decisions about your account on your Account Status page.
EEA and UK residents
You have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent. You may also complain to your local data protection authority.
California and other US state residents
You may have the right to know what personal information we collect and how we use it, to access, correct and delete it, and to not be discriminated against for exercising these rights. We do not sell personal information for money. The cookies Google AdSense uses where ads appear may be considered “sharing” for cross-context behavioural advertising under California law; you can opt out using the options in section 6 or by contacting us. We do not knowingly sell or share the personal information of anyone under 16.
To exercise any right, email on@gateke.pt from the address on your account. We may need to verify your identity and will respond within the time the law requires. You may use an authorized agent where the law allows.
9.International transfers
We are based in the United States and our providers may process data in the United States and other countries. When we transfer personal data from the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or our providers' certifications under the EU-US Data Privacy Framework.
10.Security
Data is encrypted in transit and at rest, passwords are hashed, payment card data stays with Stripe, and staff access to personal data is restricted and logged. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
11.Children
You must be at least 16 to use Gatekept and at least 18 to sell or access adult content. We do not knowingly collect data from anyone under 16. If we learn that we have, we will delete the account and its data. Parents or guardians who believe their child is using Gatekept can contact on@gateke.pt.
12.Changes to this policy
We will post any change here with a new date. For material changes we will notify you by email or in the app before they take effect. See also the Terms of Service.
13.Contact
Gatekept. Privacy questions and requests: on@gateke.pt.