Draft under review. This page is being updated and is not final; items in [[double brackets]] are still to be completed.

Effective: [[DATE]] · Last updated: [[DATE]]

This policy explains how [[LEGAL ENTITY NAME]] (“gend.me”, “we”, “us”) collects, uses, shares and protects personal information when you use gend.me, the websites and apps we host for our members, the GenD Web Builder desktop app, Leo AI, and every other service we offer (together, the “Services”). We are based in Toronto, Ontario, Canada.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), the Alberta and British Columbia Personal Information Protection Acts, and Canada’s Anti-Spam Legislation (CASL). Where you live elsewhere, we also respect the privacy rights your local law gives you.

1. Summary

• We collect what we need to run your account, your sites, your payments and the features you turn on — and nothing is sold.
• Your data is stored with Google Cloud in the United States. Service providers we use are listed in section 8.
• Connected social accounts (Facebook, Instagram, YouTube, X, LinkedIn, TikTok and others) are only used to do what you ask — publish, schedule, read results and, where the network allows, update your profile. You can disconnect them at any time.
• Leo AI only receives your content when you use an AI feature. Some AI requests are processed on computers run by your group’s administrators (the gend.me compute network) — see section 6.
• DGEN earnings are recorded on an open ledger that shows who was paid and how much, and blockchain transactions (DGEN, GEND, USDC) cannot be erased.
• You can access, correct, export or delete your information and withdraw consent by writing to our Privacy Officer at [[privacy@gend.me]].

2. Who is responsible — our Privacy Officer

[[NAME]], [[TITLE]], is the person in charge of the protection of personal information at gend.me.

Email: [[privacy@gend.me]] · Mail: [[LEGAL ENTITY NAME]], Attn: Privacy Officer, [[STREET ADDRESS]], Toronto, Ontario [[POSTAL CODE]], Canada.

3. Our role

• For your gend.me account and everything you do on gend.me, we decide how your information is used and are responsible for it.
• For the websites, stores, communities and apps our members build and host with us (“Member Sites”), the member who runs the site is responsible for the personal information of its visitors and customers. We process that information only on the member’s behalf to provide hosting, email, payments and other features, under our Terms of Service. If you are a visitor to a Member Site, please read that site’s own privacy policy and contact its owner first.

4. Information we collect

4.1 Information you give us

• Account and profile: name, username, email, password (stored only as a secure hash), phone, profile photo, cover image, bio, location you choose to show, social links, and your membership and group roles.
• Business information: organization details, branding, business plans, style guides and other “Foundations” you or the desktop app save to your membership.
• Purchases and billing: billing and shipping address, items purchased, subscription plan, invoices, tax details and order history. Card payments are handled by PayPal (and, for some payouts, Stripe); we do not store full card numbers.
• Wallets and payouts: DGEN, GEND, store-credit and reward balances; the smart-contract records that earned them; blockchain wallet addresses; withdrawal requests and the payout details you provide (for example a PayPal email or wallet address); and, where the law or our payment partners require it, identity-verification information [[confirm whether identity verification is collected]].
• Content you create: pages, posts, products, media, emails, forms, messages, comments, community activity, project briefs, contracts, files and anything else you upload or publish.
• Communications: messages to support, survey answers and feedback.
• Affiliate, sales-team and referral programs: payout details, referral links and commission records.

4.2 Information collected automatically

• Device and usage: IP address, browser and device type, operating system, pages viewed, referring pages, actions taken, and timestamps (server logs and analytics).
• Approximate location: derived from your IP address (using services such as MaxMind, ipinfo.io and ip-api.com) to show prices in your currency, apply sales tax and prevent fraud.
• Cookies and similar technologies: see section 10.
• Desktop app and devices: if you install the GenD Web Builder app or connect a device to the compute network, we receive the device’s identifier, app version, operating system, hardware capability (for example available memory and AI models), online status and job results.
• AI usage: which AI features you use, the tokens consumed and charges, for billing and abuse prevention.

4.3 Information from others

• Connected accounts you link (section 7): your profile and the data listed for each network.
• Payment partners (PayPal, Stripe, blockchain networks): payment status, payer details and transaction identifiers.
• Other members: for example a group administrator who invites you, a client who adds you to a project, or a member who refers you.
• Google services you connect (Analytics, Search Console, Tag Manager, Business Profile, YouTube, Google Ads): the reports and settings you ask us to show or manage.

5. How we use information

• Provide the Services: create and secure your account; build, host, back up and restore your sites; send and store email; run your store, community, projects and contracts; publish and schedule social posts; show analytics.
• Payments and balances: process purchases and renewals, keep wallet, credit and reward ledgers, pay commissions, rewards and compute-network earnings, process withdrawals, and meet tax and anti-money-laundering obligations.
• AI features: generate the content, designs, captions, analyses and suggestions you request (section 6).
• Safety and integrity: detect fraud, spam, abuse and security threats; enforce our Terms.
• Support and communication: answer requests and send service messages (receipts, security alerts, renewal and policy notices).
• Improvement: understand how features are used and fix problems, mostly with aggregated or de-identified data.
• Marketing: only with your consent where CASL requires it; you can unsubscribe from every marketing email.
• Legal: comply with laws, court orders and lawful requests, and protect our rights.

We ask for your consent when you sign up and when you turn on a feature, and we ask again before using information for a new purpose. Some consent is implied by what you ask us to do (for example, using your address to deliver an order). You may withdraw consent at any time (section 13); some Services may then no longer be available.

6. Leo AI, the compute network and the Brain

• When AI receives your data. Only when you use an AI feature — for example generating a site, writing copy, analyzing a social profile or tailoring captions. We send what that feature needs: your prompt, the relevant content (such as your profile fields, post results or products) and your business context.
• Who processes it. AI requests are processed either by Google (Vertex AI / Gemini) or Anthropic (Claude) on our behalf, or on the gend.me compute network: desktop computers registered by the administrators of your group (and gend.me’s own team for gend.me’s own group) that run AI models locally. Device operators earn a share of the fee and agree to process requests only to answer them, not to read, keep or share them. You can choose to have your requests processed only on gend.me’s servers under Settings › Privacy & data.
• Training. We do not allow our AI providers to train their models on your content, and we do not sell it.
• The Brain. To make every new site better, we keep a limited, de-identified library of site blueprints (layouts, section types, business category) from sites built with Leo, and a summary of common patterns that is given to the AI. It does not contain your name, contact details or customer data — only a one-way code that lets us remove your entries. You can opt out under Settings › Privacy & data; your existing entries are then removed.
• Automated decisions. We do not make decisions about you based exclusively on automated processing. If that changes (for example for fraud screening or scores that affect payouts), we will tell you at the time, what information was used and how you can ask a person to review it.
• Check AI output. AI can be wrong. You are responsible for reviewing what you publish.

7. Connected social and Google accounts

Content Campaigns and other features let you connect accounts on other networks. We use each connection only to do what you ask and only with the permissions you grant on that network’s screen. Access tokens are encrypted with a key kept separately from our database, are never shown in the interface and are used only to act for you; we never see your passwords for those networks.

Google user data. gend.me’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you see in the Services, do not use it for advertising, do not sell it, and do not let people read it unless you ask us to (for support), it is needed for security or the law requires it.

YouTube. Our YouTube features use YouTube API Services. By using them you agree to the YouTube Terms of Service, and Google’s use of your information is described in the Google Privacy Policy.

Disconnecting. Disconnect any account from its channel page in Content Campaigns, or revoke access on the network itself (for Google: myaccount.google.com/permissions; for Meta: Settings › Business Integrations; and similar pages on other networks). When you disconnect, we delete the access token at once and delete the network data we stored for that connection (profile copies, saved profile edits and statistics) within 30 days, except post records you keep in your own calendar and analytics history.

8. When we share information

We do not sell personal information. We share it only:

• With service providers who process it for us under contracts that require confidentiality and security:
  

  Provider	Purpose	Location
  Google Cloud (hosting, databases, file storage, backups, Vertex AI, Maps, reCAPTCHA)	Hosting and core infrastructure, AI, maps, spam protection	United States
  Google Analytics and Tag Manager	Website analytics on gend.me	United States
  Anthropic	AI processing	United States
  Mailgun (Sinch)	Sending and receiving email	United States [[confirm US or EU region]]
  PayPal	Card and PayPal payments, payouts	Canada / United States
  Stripe	Payouts	Canada / United States
  Cloudflare	DNS for member domains and email	Global
  MaxMind, ipinfo.io, ip-api.com	Approximate location from IP address	United States
  CoinGecko, Base and Polygon network providers	Crypto prices and blockchain transactions	Global
  Zoom, Google Meet	Meetings you schedule	United States

• With the networks you connect, when you publish or update something there.
• With other members, as you choose: your public profile, community posts and group activity are visible according to your privacy settings; group administrators see their members’ activity in the group; clients and service providers in a project see the project information; vendors in the marketplace receive the order details they need to deliver what you bought; the member who referred you sees that you joined.
• On the DGEN ledger: DGEN is earned only through gend.me smart contracts, and their payouts are recorded on an open ledger that other members can see, showing the member who was paid, the contract and the amount. [[Confirm exactly what the ledger shows: display name or username?]]
• On public blockchains: wallet addresses and transaction amounts are public and permanent.
• Compute-network devices process AI requests as described in section 6.
• For legal reasons: to comply with the law, a court order or a lawful request from authorities, to report suspicious transactions where required (for example to FINTRAC), and to protect people, our Services or our rights.
• In a business transaction (merger, financing or sale), under confidentiality, and only as the law allows.

9. Information stored outside Canada

Our servers and most of our providers are in the United States, so your information is stored and processed there and may be accessed by courts and authorities under US law. Before transferring information outside Quebec and Canada we assess the protection it will receive, and our contracts require providers to protect it to a standard comparable to Canadian law. Ask our Privacy Officer for more information.

10. Cookies and similar technologies

Technologies that can identify, locate or profile you are turned off until you agree to them. Your choice is saved for 12 months, and you can change it at any time with the “Cookie settings” button or link on every page.

11. How long we keep information

When information is no longer needed we delete it or anonymize it so it can no longer identify you.

12. Security

We use encryption in transit (HTTPS), encrypted storage at Google Cloud, hashed passwords, access controls limited to staff who need access, isolated containers for Member Sites, and regular backups. No system is perfectly secure. If a confidentiality incident creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d’accès à l’information), and keep a record of every incident as the law requires.

13. Your rights

You can ask us to:

• Access the personal information we hold about you and how it has been used and shared;
• Correct information that is inaccurate or incomplete;
• Withdraw consent to a use of your information, subject to legal or contractual limits;
• Delete your account and information, unless we must keep it by law;
• Receive your information in a structured, commonly used technological format, or have it sent to another organization (data portability);
• Stop dissemination or de-index information where Quebec law gives you that right;
• Know about automated decisions (section 6).

You can request a copy of your data or the deletion of your account yourself under Settings › Privacy & data; otherwise write to our Privacy Officer. We will verify your identity and answer within 30 days, free of charge except for reasonable copying costs we tell you about first. If we refuse, we will explain why.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta or the Office of the Information and Privacy Commissioner for British Columbia, depending on where you live. Residents of other countries may contact their local data protection authority.

14. Email and messages (CASL)

We send service messages (receipts, security, account and legal notices) as needed. We send marketing messages only with your consent or where CASL permits it, always identify ourselves and include a working unsubscribe link, and act on unsubscribes within 10 business days. Members who send email through our Services are responsible for their own CASL compliance.

15. Children

The Services are for adults. You must be at least 18, or the age of majority where you live, to create an account. We do not knowingly collect information from minors; if you believe a minor has given us information, contact us and we will delete it.

16. Changes to this policy

We will post any change here with a new “Last updated” date. If a change is significant — for example a new purpose or a new kind of sharing — we will tell you by email or in your dashboard at least 30 days in advance and ask for your consent where required.

17. Contact

Privacy Officer, [[LEGAL ENTITY NAME]] · [[privacy@gend.me]] · [[STREET ADDRESS]], Toronto, Ontario [[POSTAL CODE]], Canada.

Version française : Politique de confidentialité. Both versions are equally authoritative.