Privacy Policy
Last updated: 11 June 2026
This policy explains what GASS collects, why, and your rights. We collect as little as possible and never sell your data.
Who we are (data controller)
The controller is DoArt, a sole proprietorship (eenmanszaak) registered in the Netherlands under KVK 58598464, Helmond, Netherlands. GASS (www.gimmegass.com) is a trade name of DoArt. For any privacy question or request, email hi@gimmegass.com.
What we collect and why
Email — your account identifier (captured by Stripe at checkout, or when you request a magic link). Credit balance, purchases & credit ledger — to run your account and meet accounting obligations. Your hype history — the situations you enter and the text Gass generates, so you can revisit past hypes; we keep your most recent 30. An anonymous, signed device ID — to count free hypes and limit abuse. Session data(a session ID and your browser's user-agent) — to keep you logged in and let you log out everywhere. Your IP address — used transiently for rate-limiting and bot protection, not stored in your account. Thumbs reactions — optional feedback to improve Gass. We do not store passwords (login is via one-time magic links) and do not collect your phone number or address (any billing address is handled by Stripe).
Legal bases (GDPR)
We process data to perform our contract with you (account, payments, history); for our legitimate interests in preventing abuse, securing the service, and improving it in aggregate; to meet a legal obligation (e.g. keeping tax and accounting records for 7 years under Dutch law); and on your consent where we ask for it (e.g. any non-essential analytics).
Voice & audio
If you use the optional microphone, your short audio clip is sent to our speech-processing provider purely to transcribe it to text; the clip is not stored. The voice audio Gass generates for you is cached for about 30 days so it can replay quickly.
AI processing
Your situation text is sent to a third-party AI / large-language-model providerto generate Gass's reply and to run a safety check. Under that provider's commercial / API terms, your inputs and outputs are not used to train its models. The generated text is then sent to our speech-processing provider to produce the voice.
Who we share data with (processors)
We use vetted service providers that process data on our behalf under data processing agreements. By category:
- AI / large-language-model provider (United States) — generates Gass's text from your input and runs safety screening.
- Speech-processing provider (United States) — text-to-speech voice and microphone transcription.
- Payment processor — Stripe (PCI-DSS) — payment processing, billing details, your email.
- Email-delivery provider — magic-link and transactional emails.
- Database & hosting provider — stores your account, history, and generated audio.
- Caching & rate-limiting provider — abuse limits and short-lived caches.
- Error-monitoring and bot-protection providers (optional) — service reliability and abuse prevention.
A current list of the specific providers we use is available on request at hi@gimmegass.com. We do not sell or rent your personal data, and there is no third-party ad tracking.
International transfers
Some processors are based in the United States. Where data leaves the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and appropriate safeguards. A copy is available on request.
How long we keep your data
- Hype history — most recent 30 per account; anonymous device history is purged after ~90 days.
- Sessions — about 90 days, or until you log out.
- Magic links — 15 minutes.
- Generated audio — cached ~30 days.
- Purchases & credit ledger / tax records — 7 years (legal obligation).
- Other caches — expire automatically (seconds to days).
Your rights (GDPR)
You can request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time. While logged in you can download all your data and permanently delete your account or history from the History panel (or via /api/account/export and DELETE /api/account). Deletion removes your account, history, and ledger, except minimal payment/tax records we must retain by law. To exercise any right, email hi@gimmegass.com. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
California privacy rights (CCPA/CPRA)
In the past 12 months we have collected these categories of personal information: identifiers (email, device ID), commercial information (purchases, credits), internet activity (app usage, reactions), audio (transient microphone input), and geolocation inference (coarse, from IP, for rate-limiting only), used for the purposes described above. We do not sell or share personal information (as those terms are defined under the CCPA/CPRA), and have not in the past 12 months. We do not use or disclose sensitive personal information beyond what is necessary to provide the service. California residents may request to know, delete, and correct their information and will not be discriminated against for exercising these rights. Use the same contact and in-app tools above.
Cookies
We use a small number of first-party cookies only — no third-party ad tracking:
sal_session— keeps you logged in (HttpOnly; about 90 days).sal_device— anonymous device ID for free-tier counting and abuse limits (HttpOnly; about 12 months).sal_co— a short-lived checkout security token (HttpOnly).sal_age_ok— remembers your 18+ confirmation.sal_skip_delete_confirm(local storage) — remembers your “don't ask again” choice for deletions.
Security
We protect data with TLS encryption in transit, HMAC-signed tokens, access controls, and PCI-DSS-compliant payment handling via Stripe. If a data breach poses a risk to you, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and affected users where required.
Children
GASS is for adults (18+). We do not knowingly collect data from children. If you believe a minor has used the service, contact us and we will delete the data.
Changes
We may update this policy; we will post the new version with a revised date. Material changes take effect when posted.
Contact
DoArt (trading as GASS), KVK 58598464, Helmond, Netherlands. Privacy questions: hi@gimmegass.com. Supervisory authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).