GIMI | Privacy Policy

Welcome to our Privacy Policy (referred to in our General Terms of Use as the "Privacy and Cookies Policy"). We have tried to keep this Policy as simple and self-explanatory as possible, to help you understand what information we collect, how we use it, what your rights are, and how the law protects you.

We recommend you read this Policy in full. Here is a summary of the main points:

We do not sell information about you to third parties.
We collect information you give us (for example your name, email address and payout details), information about the content and post links you submit, public performance data about those posts, and information about your device and IP address.
We use automated tools to pre-filter submissions and to detect artificial engagement. Decisions to approve or decline content are not taken by those tools, and a human moderator reviews flagged content.
You choose whether to receive our marketing communications and which optional cookies we set, and you can change your account information at any time.

Throughout this Policy, "GIMI", the "Company", "we", "us" or "our" means TQOE Lda. "You" or "your" means the person visiting our website or using our platform, whether as a Contributor (a content creator), as a representative of a Brand or as a visitor. We are committed to protecting your personal data and respecting your privacy.

Introduction

GIMI is a platform where organizations (Brands) launch campaigns and build a network of creator partners, and where content creators (Contributors) submit content or links to their posts, earn rewards and get paid for approved content. Brands use GIMI to brief Contributors, review and approve content, track how posts perform, distribute content and pay Contributors around the world. To deliver and improve these services we collect and process certain personal information.

This Privacy Policy applies whenever you use GIMI's services (the "Services"), including our website at gimi.co and our platform at app.gimi.co. It explains how we collect, store, use, disclose and protect your personal information. Please read it carefully before using the Services.

If you have any questions or concerns about this Privacy Policy or our data practices, contact us using the details in the "Contact Us" section below.

Definitions

Anonymisation: the processing of Personal Data in such a way that the Data Subject is no longer identified or identifiable. To determine whether a Data Subject is identifiable, account is taken of all the means reasonably likely to be used by the Controller or by any other person to identify that person.

Pseudonymisation: the processing of Personal Data in such a manner that it can no longer be attributed to a specific Data Subject without the use of additional information, provided that the additional information is kept separately and is subject to technical and organisational measures.

Controller: the legal entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

Processor: the legal entity which processes Personal Data on behalf of and under the instructions of the Controller.

European Data Protection Law: the EU General Data Protection Regulation 2016/679 ("GDPR"), its national implementing legislation and the data protection and privacy laws applicable in the countries of the European Economic Area ("EEA").

Personal Data: any information relating to an identified or identifiable natural person ("Data Subject" or "you"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.

Retention Period: the period of time for which Personal Data has to be or can be stored, considering legal requirements as well as the Company's economic and business needs.

Sensitive Personal Data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic data, biometric data processed to identify a person, health data, or data concerning a person's sex life or sexual orientation. We do not ask you for Sensitive Personal Data.

Brand: an organization or individual that launches campaigns on GIMI, as defined in our General Terms of Use.

Contributor: a content creator who takes part in campaigns on GIMI and submits content or links to posts, as defined in our General Terms of Use.

Legal Framework

Your personal data is processed in compliance with the applicable legislation, including the GDPR and the other privacy laws referred to in this Policy.

Who is responsible for this website?

TQOE Lda. ("GIMI"), Edifício Diogo Cão, Doca de Alcântara Norte, 1350-352 Lisboa, Portugal, is responsible for the website gimi.co and the platform at app.gimi.co (together, the "Website"). This Privacy Policy applies to your use of the Website, its sub-domains and related content (collectively, our "Services").

Who is responsible for the processing of your personal data?

TQOE Lda. ("GIMI") is the Controller of the Personal Data we collect and process about you on the Website.

When a Brand runs a campaign on GIMI, the Brand sees information about the Contributors who take part in it, such as their username, the content and links they submit, performance data and earnings in that campaign. Each Brand is responsible for its own use of that information. Where GIMI processes Personal Data strictly on a Brand's instructions, for example a list of creators the Brand imports, GIMI acts as that Brand's Processor.

What personal data do we collect?

We process your personal data lawfully, fairly and transparently. We only process your Personal Data where at least one of the following legal bases applies:

it is necessary to perform our General Terms of Use or to provide you with the Services, for example to run campaigns, track posts and pay rewards;
you have consented to the processing, for example to optional cookies or marketing messages (you may withdraw consent at any time);
it is necessary for us to comply with a legal obligation, such as tax, accounting and anti-fraud rules, or to establish, exercise or defend legal claims; or
it is necessary for our legitimate interests or those of a third party, such as keeping the platform secure, preventing artificial engagement and improving the Services, where those interests are not overridden by your rights.

When we use Personal Data to send you promotional messages, we will first obtain your consent where the law requires it.

The data we collect about you includes:

Identity and profile data: first name, last name, username or similar identifier, date of birth, gender, location (country), and the content types and interests you select.
Contact details: email address and, where you provide them, billing address and phone number.
Social data: your social media handles and profile links, and for Brands that connect a social account to schedule posts, the access tokens needed to publish on that account.
Content and submission data: the files you upload, the links to posts you submit, campaign applications, and the result of moderation and Brand review.
Performance data: public information about the posts you submit, such as views, likes, comments and shares, which we obtain from the social platforms through third-party data providers.
Integrity data: the scores and flags our systems produce to calculate Clean Engagement and detect artificial engagement, based on the quality and velocity of engagement and on your history on GIMI.
Financial data: your earnings and payout history, payout details such as bank account, PayPal account or, where you choose a USDC payout, your payout address, billing details for Brands, and any tax or identity information our payment partners require. Card details are collected and stored by our payment processor, not by GIMI.
Connection and device data: IP address, browser type and version, general location, operating system and device.
Interaction and usage data: messages you send us, feedback, survey responses, and information about how you use the Website and Services.

Opting out of promotional communications from GIMI

You can unsubscribe from promotional emails by clicking the "unsubscribe" link in the email or by adjusting your account settings. Your request will be processed promptly, and in any event within ten business days. During that period you may still receive promotional emails already scheduled.

You can turn off mobile push notifications in your device's settings. If we send you SMS messages, you can opt out by replying "STOP" to any such message.

If you opt out of promotional communications, we may still contact you for non-marketing reasons, for example about a campaign you joined, a payout, or important updates to this Privacy Policy or our General Terms of Use.

How do we collect your personal data?

We collect Personal Data directly from you when you:

visit or register on the Website;
apply to, join or run a campaign;
submit content or links to posts;
add payout details, pay for a campaign or request a payout;
respond to our surveys or promotions; or
communicate with us, for example by email or through support.

We also collect Personal Data from other sources:

Social platforms and data providers: public performance data for the posts you submit. You do not need to connect your social account for this. We read public information about the specific post you link.
Brands: a Brand may add you to its creator network, for example by importing a list of its creators or by sending you an invite.
Sign-in providers: if you sign in with a third-party account such as Google, we receive basic profile information from that provider.
Payment partners: confirmation of payments, payouts and any verification they carry out.

Note: if you submit another person's personal information on the Website, for example a person who appears in your content or a creator list you import, you are responsible for making sure you are entitled to share it and that it can be processed in accordance with this Policy.

For which purposes do we process your data?

We process your Personal Data for the following purposes:

To provide the Services: to run campaigns, receive applications and submissions, and make content available to the Brand that runs the campaign.
To track the performance of submitted posts and calculate rewards.
To moderate content, including with automated tools, so that submissions meet the campaign brief and our community standards.
To detect and prevent bots, fake engagement, fraud and abuse, and to keep the platform secure.
To process payments from Brands and payouts to Contributors, and to meet tax, accounting and other legal obligations.
To schedule and publish content to social accounts that a Brand has connected.
To investigate and resolve complaints, disputes and support requests.
To improve and develop the Services, including by analysing which content is approved or rejected so that moderation becomes more accurate.
To send you service messages, and promotional messages where you have agreed to receive them.

We only collect and use information that is necessary for these purposes, or that you choose to give us.

Automated moderation and Clean Engagement

GIMI uses automated systems, including artificial intelligence, in two places.

Content moderation. Submissions are checked automatically against the campaign's rules and our community standards, and to pre-filter spam, low-effort and duplicate content. These systems do not generate or alter your content and do not take the decision to approve or decline it. That decision is made by human review. A Brand has 5 days to review each submission, after which a submission it has not reviewed is approved automatically.

Clean Engagement. Performance rewards are calculated on Clean Engagement. Our systems assess the quality of the engagement on a post, its velocity (how the post grows over time, including unnatural spikes) and trust (your history and behaviour on GIMI). Where a post shows abnormal patterns, the performance used to calculate rewards may be normalised, and the post or account may be flagged as suspicious. A flag is not a final verdict. Earnings on flagged content may be paused until a human moderator decides whether it should continue to earn.

If you believe a flag or a decision about your content or earnings is wrong, contact us at support@gimi.co with your profile link and a description of the issue, and a person will review it.

How do we handle children's data?

The Services are not intended for children. You must be at least 16 years old to use the Website, and older where the law of your country requires it to enter into an agreement or receive payments.

If you have reason to believe that a child has provided personal information to us, please contact us at support@gimi.co. We will take reasonable steps to delete that information.

Cookies

We use cookies and similar technologies on our Website. A cookie is a small piece of data that a website asks your browser to store on your device in order to remember information about you, such as your login or your preferences. Cookies set by us are first-party cookies. Cookies set by another domain are third-party cookies.

When you first visit the Website, a cookie banner lets you accept or reject optional cookies, or choose by category. You can change your choice at any time through "Cookie Preferences" on the Website. We load analytics and marketing tools through Google Tag Manager, and only after you have agreed to the relevant category. Blocking some or all cookies may affect how the Website works.

We use the following categories:

Essentials. These cookies are necessary for the Website to function and cannot be switched off. They are usually set in response to actions you take, such as logging in, filling in forms or setting your privacy preferences.

Analytics. These cookies allow us to count visits and traffic sources so that we can measure and improve the performance of the Website. They help us understand which pages are popular and how visitors move around the site.

Personalization. These cookies allow the Website to remember choices you make and provide enhanced features. They may be set by us or by third-party providers whose services we have added to our pages.

Marketing. These cookies may be set through our site by our advertising partners. They may be used to measure which campaigns bring visitors to GIMI, to build a profile of your interests and to show you relevant adverts on other sites.

Whom do we share your data with?

Other users. Your username, your profile, any creator partner tag or badge a Brand gives you, and the content you submit may be visible to other users of the platform. The Brand that runs a campaign you join can see your submissions, the links you provide, the performance of your posts and your earnings in that campaign.

Service providers. We use trusted companies to help us run the Services. They include:

payment and payout providers, including our card payment processor and Tipalti (payouts by bank transfer, PayPal and local methods), and the provider used for USDC payouts;
hosting and infrastructure providers;
third-party data providers that supply public performance data for social media posts;
providers of AI models used for content moderation;
customer support and live chat tools;
analytics, tag management and consent tools, including Google Tag Manager; and
sign-in providers, such as Google and Meta, where you choose to use them.

Where these providers act on our behalf, they process Personal Data only on our instructions and under contracts that require them to protect it. Some providers, such as payment providers and social platforms, are also independent controllers of the data they handle and process it under their own privacy policies.

Legal and safety. We may disclose Personal Data where required by law, to respond to a lawful request from an authority, or where necessary to prevent fraud, enforce our General Terms of Use or protect the rights and safety of GIMI, our users or others.

International transfers

GIMI is based in Portugal. Our users and some of our service providers are located around the world, so your Personal Data may be processed outside your country of residence, including outside the EEA.

When we transfer Personal Data to a country that is not recognised as providing an adequate level of data protection, we rely on safeguards approved under the GDPR, such as standard contractual clauses, to ensure your Personal Data remains protected.

California residents: California Privacy Rights Act

If you are a California resident, you may have specific rights under California law, including the right to know what Personal Data we collect and disclose, and the right to request access, correction and deletion. To make a request, contact us using the details in the "Contact Us" section with the subject line "California Privacy Rights". We do not sell Personal Data. If you exercise your rights, we will not treat you differently as a result.

Once we receive a verifiable request, we may ask for information to confirm your identity. If you use an authorised agent to submit a request, we may ask for proof that the agent has your written permission to act on your behalf.

What happens if the Company is sold to another organization?

If the Company is sold to or merged with another organisation, that organisation will become responsible for determining the purposes and means of processing personal data. In other words, it will become the new Controller of your Personal Data.

If such a change occurs, we will notify you by providing an updated version of this Privacy Policy or by other appropriate means.

For how long will we retain your Personal Data?

We aim to build long-lasting relationships with our users. Your account and the associated Personal Data remain active for up to 6 months following your last interaction with our Website. If your account is inactive for that period, we will notify you to ask whether you wish to keep it active before taking any steps to close it. Earnings on an inactive account are handled as set out in our General Terms of Use: earnings at or above the minimum payout amount remain available for payout, and earnings below it are cancelled.

If you ask us to delete your account, we will delete or anonymise your Personal Data within a reasonable period. Copies may remain in our backup systems for up to 3 months before they are overwritten. Please request a payout of any earnings at or above the minimum payout amount before asking us to delete your account.

We keep some information for longer where we are required or permitted to do so, for example:

records of payments, payouts and invoices, for the period required by tax and accounting law;
information needed to resolve disputes or enforce our General Terms of Use; and
records of accounts closed for fraud or artificial engagement, to prevent repeat abuse.

We may keep data that has been anonymised, so that it no longer identifies you, for research and statistical purposes.

What are your rights?

As a data subject, you have the following rights regarding the Personal Data we hold about you:

Right to be informed: you have the right to clear information about how we use your personal data, which is why we provide this Privacy Policy.
Right of access: you can request a copy of the personal data we hold about you.
Right of rectification: you can have your personal data corrected if it is inaccurate or incomplete.
Right to erasure: you can ask us to delete your personal data. This right is not absolute. We may have legal grounds to keep certain data.
Right to object and to withdraw consent: you can object to certain processing, such as direct marketing or processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.
Right to data portability: you can receive personal data you have given us in a structured, commonly used, machine-readable format, and have it transmitted to another organisation where applicable.
Right to restrict processing: you can ask us to suspend processing of your personal data in certain circumstances, for example while we check its accuracy.
Rights related to automated decisions: you can ask for a person to review a decision made about you by automated means, express your point of view and contest the decision.
Right to lodge a complaint: if you believe your data protection rights have been violated, you can complain to the data protection authority in your country. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).

To exercise your rights, contact us at support@gimi.co. We will respond within one month. We may ask you to confirm your identity first.

How do we ensure the security of your data?

We implement appropriate technical and organisational measures to ensure the confidentiality, integrity and security of your Personal Data. These measures are designed to protect your data against unauthorised access or disclosure, and against accidental or unlawful destruction, loss or alteration.

Service providers that process Personal Data on our behalf are required to apply equivalent security standards and to process data only on our instructions.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. We encourage you to review this Policy periodically. If we make significant changes, we will notify you directly, for example by email or through a notice on our Website.

Contact Us

If you have any questions about this Privacy Policy, or if you wish to exercise any of your rights regarding your personal data, please contact us:

TQOE Lda. ("GIMI")
Edifício Diogo Cão, Doca de Alcântara Norte
1350-352 Lisboa, Portugal
Email: support@gimi.co