Privacy Policy

This policy explains what personal data Geminel Studio processes when you visit geminel.studio, apply for the beta, create an account or use the Platform, why we process it, who we share it with and what rights you have.

1. Who we are

The data controller is Societatea cu Răspundere Limitată „Geminel Studio", IDNO 1026023053376, with its registered office at str. V. Stroescu nr. 84, bl. 1, ap. 30, MD-3000, or. Soroca, Republic of Moldova (“we”). For any question or request about personal data, you can write to us at contact@geminel.studio or call +373 68 803 108. We have not appointed a data protection officer, because our activity does not require one; these questions are handled directly by the company's administrator.

We process data in accordance with Law No. 195/2024 on the protection of personal data (in force since 23.08.2026) and, for persons in the European Union, with Regulation (EU) 2016/679 (GDPR).

2. What data we process

Website visitors

• technical data: IP address, browser and device type, pages accessed, date and time (server logs);
• your cookie choice;
• only with your consent: identifiers and browsing statistics collected by Google Analytics and Meta Pixel (see the Cookie Policy);
• the data you send us by e-mail or telephone: name, company, e-mail address, information about your business.

Help centre

If you search the help centre or answer “Was this helpful?” on a guide, we process the text you type (the search query, the optional comment) and your answer. We process them on the basis of our legitimate interest in improving the help. They are not linked to any account and we do not store your IP address with them. Before storing, we redact e-mail addresses and telephone numbers from the text, but please do not include personal details in it. Search queries are kept for 90 days and feedback for 180 days.

Beta applications

When you apply for the beta at geminel.studio/beta, we process your name, e-mail address, the capacity in which you apply (creator, business, agency or another capacity), the name of your brand or business, the social networks you use and the links to your profiles, the content you want and what you tell us about it and about your business, the form's language, the moment of consent and the accepted version of the Beta Program Agreement, and, in the security log, the IP address the application was sent from (to limit abuse). We use this data only to review the application and to contact you about it.

Beta program participants

During the beta program we also process your feedback (opinions, suggestions, bug reports, survey answers), your communications with the team and the notes from feedback sessions, and the recording of a session only if you agree to it at its start. The details are in chapter 11 of the Beta Program Agreement.

Clients and users of the Platform

• account data: name, e-mail address, role in the Workspace, password (stored only as a hash);
• billing data: the Payer's name or company name, country, address, tax code (if any), the plan, invoices, top-ups, refunds, the credit balance and movements, and the Consumption history;
• payment data received from the bank: the amount, currency, date, transaction status and its identifiers (for example, payId and RRN) — we do not receive or store the card number or any other card details;
• acceptance of the Terms & Conditions and the Refunds policy, recorded with every top-up;
• usage and security data: access logs, IP addresses, actions recorded in the audit log (approvals, publications, settings changes, payments and refunds);
• the content you upload or connect: footage, images, documents, texts, voice recordings and, if you use the function, the consent to voice cloning;
• data from connected accounts: from social networks (Facebook, Instagram, YouTube, TikTok, etc.), the account identifiers, access tokens (encrypted), and the posts, comments, messages and statistics the network makes available to us; from Google Photos, only the photos and clips you choose in Google's picker;
• correspondence with us (support, complaints, refund requests).

Account and billing data are necessary to conclude and perform the contract; without them we cannot provide the services. You provide the other data if you choose to use the functions concerned.

3. Why we process it and on what legal basis

Our legitimate interest is protecting the Platform, our clients and our revenue. We do not take decisions based solely on automated processing that produce legal effects concerning you. We do not sell personal data and we do not use your content to train AI models.

4. Data processed on behalf of clients

Our clients' audience data (for example, the comments and messages received on the connected social accounts, the audience's names and profiles) is processed on behalf of the client, who is its controller. In this case we act as a processor, in accordance with the GDPR & data rights page. If you are a member of a client's audience, we recommend that you contact that client first; we will help resolve the request.

5. Data from Google

We use the data received through Google APIs (Google Photos, YouTube) only for the functions you ask for: importing the items you choose into the Workspace library and, for a YouTube channel you connect, uploading the videos you approve, reading the channel's videos and their comments so your team can answer them from the Inbox (replies are written or approved by a person), and reading the channel's and videos' statistics (views, likes and comment counts) for the Analytics page. Comment text may be sent to the AI provider set for the Workspace only to draft a reply you asked for. Our use and transfer of this data adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not use it for advertising, do not sell it, do not use it to train AI models and humans read it only with your consent, for security or to comply with the law.

Geminel uses the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service (www.youtube.com/t/terms); the Google Privacy Policy also applies (policies.google.com/privacy). You can revoke Geminel's access at any time from your Google account (myaccount.google.com/permissions) or by disconnecting the channel in Accounts; we then delete the stored access tokens, and the channel's data is deleted with the Workspace or on request.

6. Who we share data with

We share data only to the extent necessary, with:

• the acquiring bank BC „Moldova-Agroindbank" S.A. (maib) and the Visa and Mastercard payment systems, for card payments and refunds;
• infrastructure providers, acting as processors: hosting in the European Union (Contabo), file storage and DNS (Cloudflare, with storage located in Western Europe), Google Cloud (temporary storage for analysing large materials), Amazon Web Services (video rendering, Frankfurt region, when the function is active), e-mail;
• AI model providers used to analyse, generate and edit content (Google Gemini through Vertex AI, Anthropic, ElevenLabs for speech synthesis and other providers chosen in the Platform), which receive only the data needed for each task, through their commercial interfaces (APIs);
• the social networks on which you choose to publish, on the basis of your authorisation;
• Google (Google Analytics) and Meta (Meta Pixel), only with your consent;
• our accountant, auditors, legal advisers and public authorities, where the law requires it.

The current list of processors is provided on request.

7. Transfers outside the Republic of Moldova and the EU

Some providers (for example, Google, Meta, Anthropic, ElevenLabs, Amazon Web Services) may process data in the United States or in other countries. In these cases the transfer takes place only with the safeguards required by Law No. 195/2024 and the GDPR: adequacy decisions (including the EU–US Data Privacy Framework, for certified providers) or standard contractual clauses, with supplementary protection measures where needed. You may request information about the applicable safeguards.

8. How long we keep data

9. How we protect data

We apply appropriate technical and organisational measures: encryption in transit (TLS), encryption of secrets (tokens and access keys) at rest, isolation of Workspaces at database level, role-based access control, an audit log, backups, including off the server, and restricted staff access. Card details never reach us: they are entered only on the maib payment page, with 3-D Secure authentication.

If a personal data breach occurs, we notify the National Center for Personal Data Protection within 72 hours of becoming aware of it, where the law requires it, and if the breach poses a high risk to you, we inform you without undue delay.

10. Your rights

You have the right of access, rectification, erasure, restriction, objection, portability, the right not to be subject to a decision based solely on automated processing and the right to withdraw your consent at any time, without affecting earlier processing. The details and how to exercise them are on the GDPR & data rights page.

You also have the right to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md) or, if you are in the European Union, with the supervisory authority of your state of residence.

11. Minors

The Platform is not aimed at persons under 18 and we do not knowingly collect their data.

12. Changes

We may update this policy. The version in force is published on geminel.studio, with the date shown in the header; significant changes are communicated to account holders by e-mail.