GerbiqPrivacy Policy
This policy explains how personal data is handled by Gerbiq: the website gerbiq.com, the virtual creators' accounts we run on Instagram, TikTok and YouTube, the internal Gerbiq app that connects to those platforms, and email you exchange with us. It is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is Stefano Raimondi, a private individual resident in Italy, who runs Gerbiq as a personal project. Contact for anything related to personal data: privacy@gerbiq.com. No data protection officer has been appointed, as none is required.
2. What data we process, why, and on what basis
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You visit gerbiq.com | IP address, browser type, requested page, date and time (technical logs) | Deliver the website, keep it secure, prevent abuse | Legitimate interest, Art. 6(1)(f) |
| You email us | Email address, name if given, content of the message | Answer you and follow up | Legitimate interest, Art. 6(1)(f); steps before a contract, Art. 6(1)(b), where you ask about a collaboration |
| You comment on, mention or message one of our virtual creators | Public username and display name, platform user ID, text of the comment or message, date and time, public reactions to it | Moderate our accounts, reply to you, understand which topics interest our audience, measure how our content performs | Legitimate interest, Art. 6(1)(f) |
| You make a privacy request | Identity and contact details, content of the request | Handle the request and keep a record that we did | Legal obligation, Art. 6(1)(c) |
Our legitimate interest is to run our website and our creators' accounts safely and to interact with the people who engage with them. We do not use your data for advertising, we do not build profiles of individual users, we do not sell or rent personal data, and we do not take decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). You can object to processing based on legitimate interest at any time (see section 8).
3. Data from Instagram, TikTok and YouTube
The Gerbiq app connects only to accounts that Gerbiq owns and operates, through each platform's official API. It is not offered to other users and never accesses anyone else's account. Through those connections we access:
- Instagram (Instagram API with Instagram Login, by Meta): profile information, posts, comments and insights of our own professional accounts; publishing of our own content.
- TikTok (Login Kit and Content Posting API): basic information of our own account (account ID, display name, avatar) and upload of our videos as drafts, which we then review and post in the TikTok app.
- YouTube (YouTube API Services): information, videos, comments and statistics of our own channels; upload of our own videos. Google's use of data is governed by the Google Privacy Policy. By watching or interacting with our content on YouTube you are also subject to the YouTube Terms of Service. Access granted to the Gerbiq app can be revoked at any time from the Google security settings page.
The access tokens for these connections are stored encrypted on our servers and are used only for the purposes above. When you interact with our creators on a platform, that platform also processes your data as an independent controller under its own privacy policy: Instagram, TikTok, Google/YouTube.
4. Use of AI
Our virtual creators are AI-generated and are declared as such. When you comment on or message one of them:
- the text may be analysed by an AI model to filter spam and abuse, to group recurring topics and to draft a reply;
- any reply you receive from a virtual creator is written by AI, and our creators never claim to be human;
- the AI provider (Anthropic, see section 5) processes the text on our behalf, under terms that do not allow it to use that data to train its models.
We do not send your personal data to the services we use to generate images, video or voices. Those services receive only our scripts and our characters' descriptions.
5. Who receives the data
We use the following providers, which process personal data only on our instructions (processors, Art. 28 GDPR):
- Cloudflare, Inc. — website hosting, content delivery, DNS, security, and forwarding of emails sent to @gerbiq.com addresses;
- Hetzner Online GmbH (Germany) — servers that run the Gerbiq app and its database;
- Anthropic, PBC — AI models used as described in section 4;
- Google LLC — mailbox that receives the emails forwarded from our domain;
- Resend (EU region) — delivery of emails we send from our domain.
Meta, TikTok and Google/YouTube receive and process data as independent controllers when you use their platforms. We may disclose data to public authorities when the law requires it. We do not share personal data with anyone else.
6. Transfers outside the EU
Some providers are based in the United States or may process data there (Cloudflare, Anthropic, Google). These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). You can ask us for more information about the safeguards in place.
7. How long we keep data
- Technical logs of the website and servers: up to 30 days, unless needed to investigate a security incident.
- Comments and messages received by our creators, and the related user data: up to 12 months from receipt. After that we keep only anonymous, aggregated statistics.
- Email correspondence: up to 24 months from the last exchange, longer only if needed to establish, exercise or defend legal claims.
- Records of privacy requests: 5 years, to be able to prove how they were handled.
- Access tokens for our own platform accounts: until the connection is removed.
8. Your rights
Under the GDPR you can ask us for access to your personal data, rectification, erasure, restriction of processing and data portability, and you can object at any time to processing based on our legitimate interest. To exercise these rights, write to privacy@gerbiq.com, stating the platform and the username involved if your request concerns a social media interaction. We will reply within one month; we may ask for information to confirm your identity. Instructions for deletion requests are also on the Data deletion page.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the alleged breach occurred. In Italy this is the Garante per la protezione dei dati personali.
9. Cookies
The public pages of gerbiq.com do not set cookies and do not use analytics, advertising or tracking tools. Our hosting provider may use strictly necessary technical measures to protect the site from attacks.
10. Children
Gerbiq and its creators are not aimed at children, and we do not knowingly process data of anyone under 16. If you believe a child has sent us personal data, write to us and we will delete it.
11. Services not yet active
Gerbiq does not currently run newsletters, sell products or process payments. Before we start any of these, we will update this policy to describe the data involved, and purchases will be handled by a payment provider acting under its own terms.
12. Changes to this policy
We may update this policy when our activities change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will give notice on this website before it takes effect.