Privacy Policy

1. Who we are (Controller)

UAB Gildium (UAB), company code 307192563, registered at Polocko g. 17-113, LT-01205 Vilnius, Lithuania, entered in the Register of Legal Entities of the Republic of Lithuania (Registrų centras). VAT: LT100018764416.

Privacy contact: support@8legs.app. Data Protection Officer: not appointed.

This policy covers data for which we are the controller. If you use 8legs in the course of business to process other people's personal data, you are the controller and we act as your processor — see our Data Processing Agreement.

2. What data we collect

• Account data. When you sign in with Google we receive your email address, display name, profile photo URL, and Google account identifier.
• Audit content. The questions you submit, the responses returned by the AI models, any follow-up messages, and metadata such as titles, timestamps and pins. This content is stored under your account so you can revisit your history.
• Usage & quota data. Counters recording how many audits you have run (to enforce free/trial/paid limits), and your plan tier.
• Payment data. When you buy a paid plan, our payment processor (Stripe) collects your payment details. We do not receive or store your full card number — we receive confirmation of payment, plan, and limited billing metadata.
• Analytics & device data. Via Google Analytics 4 and Google Tag Manager we may collect events (pages viewed, features used), approximate location, device/browser type, and identifiers. Where you have not consented, we use privacy-preserving, cookieless measurement only (see our Cookie Policy).
• Advertising & conversion data. When you arrive via one of our advertisements, we use the Meta (Facebook) Pixel and the Meta Conversions API to measure how our advertising performs. This can involve sharing with Meta a hashed (pseudonymised) version of your email address, your IP address and browser type, the Meta ad-click identifier, and events such as sign-up, checkout initiation and purchase (including the purchase amount). Pixel cookies are set in your browser only with your consent; conversion events may also be sent directly from our servers on the basis of our legitimate interest in measuring the advertising you responded to. For this advertising, Meta acts as an independent or joint controller under its own terms.

Please do not enter sensitive personal data (health, financial, biometric, political or similarly special-category data, or other people's personal data) into audit questions. Questions are transmitted to third-party AI providers outside your control.

3. Why we process it and on what legal basis

• To provide the service — running audits, storing your history, managing your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To process payments and prevent abuse — billing, quota enforcement, fraud prevention. Legal basis: contract and our legitimate interests (Art. 6(1)(b) and (f)).
• Analytics and product improvement — understanding usage to improve 8legs. Legal basis: your consent (Art. 6(1)(a)) for cookie-based analytics; our legitimate interest for aggregated, cookieless measurement. You can withdraw consent at any time.
• Marketing communications — sending you product updates, tips and offers about 8legs (see "Marketing communications" below). Legal basis: the agreement you give at sign-up and our legitimate interest in marketing our own services to our registered users (Art. 6(1)(a) and (f)). You can opt out at any time.
• Legal compliance — tax, accounting and responding to lawful requests. Legal basis: legal obligation (Art. 6(1)(c)).

4. AI model providers and their origin

The core function of 8legs is to send your question to multiple independent, third-party AI models and display their answers. When you run an audit, your question is transmitted to the providers below. Some models are called directly; others are accessed through Replicate, which hosts and runs them in the United States. Each provider processes your query under its own terms and privacy policy.

Model origin. Several of the models we offer are developed by companies based in China (DeepSeek, Moonshot/Kimi, and Alibaba/Qwen). We currently reach these models via Replicate in the United States rather than by sending your data directly to servers in China; however, the models' developers may be subject to the laws of their home country. If you would rather not have your question processed by a particular model, you can deselect it before running an audit.

We do not control, and are not responsible for, how each provider handles data once it is received. We do not sell your data.

5. Sub-processors and recipients

We share personal data with the following service providers acting on our behalf:

6. International transfers

8legs operates globally, and your data may be transferred to and processed in countries other than your own — including the United States, the European Union, and (in the case of certain model developers) China. These countries may have different data-protection standards than your own. Where we transfer personal data out of the EEA/UK — including to Google, Stripe, the AI providers and Meta — we rely on the European Commission's Standard Contractual Clauses and/or a provider's certification under the EU–US Data Privacy Framework (under which Google, Stripe and Meta are certified), together with additional technical and organisational measures. You may request a copy of the relevant safeguards from us.

7. How long we keep it

• Account and audit history: for as long as your account is open. You can delete individual sessions in the app, and we delete your account data within 30 days of an account-deletion request.
• Payment and accounting records: retained for the period required by applicable tax and accounting law (generally up to 10 years).
• Analytics data: retained according to the retention period configured in Google Analytics (by default up to 14 months).

8. Marketing communications

When you create an account, you agree — as stated on the sign-up page — to receive product updates and marketing emails about 8legs. We record the date and the wording version of that agreement. To send these emails we share your email address and name with MailerLite (UAB "MailerLite", based in Lithuania, EU), which acts as our processor.

Opting out is one click. Every marketing email contains an unsubscribe link that takes effect immediately, and you can also email support@8legs.app to opt out. Once you unsubscribe we will not re-subscribe you. Opting out does not affect transactional emails we must send to operate your account (for example receipts or security notices), and it does not affect your use of 8legs in any way.

9. Your rights

Everyone. You can email support@8legs.app to access, correct, or delete your data, or to ask a question about this policy. We respond within 30 days.

EEA / UK (GDPR). You have the right to access, rectification, erasure, restriction, objection, data portability, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, 10312 Vilnius, Lithuania — https://vdai.lrv.lt.

California (CCPA/CPRA). You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its “sale” or “sharing.” We do not sell your personal information and do not share it for cross-context behavioural advertising, except that consent-based advertising/analytics tags may qualify as a “sale”/“share” under California law — you can opt out at any time via our cookie settings. We do not discriminate against you for exercising your rights.

Other regions. If your local law grants additional rights, contact us and we will honour applicable requirements.

10. Security

Data is transmitted over HTTPS/TLS and stored on Google Cloud/Firebase infrastructure with access controls. No method of transmission or storage is completely secure, but we apply appropriate technical and organisational measures proportionate to the risk.

11. Children

8legs is not directed at children under 16 (or the minimum age in your country). We do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this policy. Material changes will be notified in-app or by email. The "effective date" above shows the current version.

13. Contact

Privacy and general questions: support@8legs.app.