Privacy Policy

01 Who we are

GainGauge is operated by Gain Gauge, registered at 1319 N University Dr, #186, Coral Springs, FL 33071, United States (referred to here as "we", "us" and "GainGauge"). This policy covers the GainGauge web application, the gaingauge.com website, and the data syncing that runs behind them.

For questions about this policy or about data we hold, contact privacy@gaingauge.com.

02 Our role, and yours

Two different relationships run through this product, and the distinction decides who is responsible for what.

• For your own account data, the sign-in details of the people at your company who use GainGauge, we are the controller. We decide what is collected and why.
• For the advertising and CRM data we ingest on your behalf, including information about your customers and prospects, you are the controller and we are your processor. We act on your instructions, we process it only to provide the service, and we do not decide independently what to do with it.

If one of your contacts asks to see or delete their data, that request goes to you as the controller. We will help you answer it, as described in section 12.

03 What we collect

Account and access data

• Name, work email address and organisation membership for each user.
• A password verifier. We store a scrypt hash with a per-user salt, never the password itself.
• Session records, stored as a hash of the session token rather than the token, along with creation and expiry times.
• The role assigned to each user, which determines what that person is allowed to see.

Connected account credentials

• OAuth access and refresh tokens for the platforms you connect, plus the account identifiers, display name, currency and timezone captured when you connect.
• Tokens are encrypted at rest with envelope encryption: each secret gets its own AES-256-GCM data key, which is itself wrapped by a master key. There is no plaintext path in the code, and credentials are stripped from error messages before anything is logged.

Advertising data

• Daily spend, impressions, clicks and platform-reported conversions, by campaign and ad group, from the ad accounts you connect.
• Campaign metadata such as names, types and status. This is business data and does not normally identify anyone.

CRM data, which may identify individuals

• Deal and opportunity records: amount, stage, close date and the contacts associated with them.
• Contact identifiers used to connect a closed deal back to the marketing that produced it: email address, company domain, and advertising click identifiers such as gclid, fbclid and li_fat_id.
• Touchpoint timestamps and the source attributed to each one.

We collect these identifiers because attribution is impossible without them. We do not collect special category data, and you should not put it in fields we sync.

Website data

The gaingauge.com marketing site sets no advertising or analytics cookies and embeds no third-party trackers. If we add analytics we will name the provider here, and what it collects, before it is enabled. The application itself sets one strictly necessary cookie, described in section 13.

04 Why we process it, and on what basis

Where we act as your processor, your own lawful basis for collecting the underlying data governs, and our processing rests on our contract with you.

05 Automated analysis and AI

GainGauge fits statistical models to your data and produces a written summary of the result. Two points matter for your privacy assessment.

• The language model never sees raw data. It receives only a set of aggregated, computed facts: channel-level totals, marginal returns, confidence tiers and similar figures. It is not given contact records, email addresses, deal rows or any individual-level data, and it is not permitted to perform arithmetic. Every number in the generated text is checked against those figures before it is displayed, and text that fails the check is discarded in favour of a deterministic version.
• The AI step is optional. With no model provider configured, GainGauge produces the same summary from a deterministic template, and no data leaves our infrastructure for that purpose. Where the AI path is enabled, the provider is listed in section 7.

No decision with a legal or similarly significant effect on any individual is made by automated means. The output is a budget recommendation your team reviews and chooses whether to act on.

06 What we will not do

• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We do not combine your data with another customer's. Every database query is scoped to a single organisation, and access to a model that has not been explicitly classified is denied by default rather than allowed.
• We do not use your data to build audiences, to retarget your contacts, or to train general purpose models.
• We do not have write access to your advertising accounts. GainGauge cannot change a budget, pause a campaign or spend your money. Recommendations are applied by your team.
• We do not store credentials in plaintext, and we do not log them.

07 Who else processes your data

We use a small number of sub-processors. We remain responsible for their handling of your data and bind each one by contract.

The platforms you connect, such as Google Ads, Meta, LinkedIn, Google Analytics and HubSpot, are not our sub-processors. They are your own providers, and their handling of your data is governed by your agreements with them. We read from them under the authorisation you grant, and you can revoke it at any time.

We will give you 30 days' notice before adding or replacing a sub-processor, in time for you to object.

08 Where your data is held

Data is stored and processed in the United States, where we and each of our sub-processors operate. If you are established in the European Economic Area, the United Kingdom or Switzerland, using GainGauge means personal data is transferred to the United States.

For those transfers we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved, and we carry out a transfer risk assessment to confirm the safeguards hold in practice. We can supply the relevant documentation on request. Nothing in this section changes the commitments in section 6: the data is used to run your analysis and for nothing else.

09 How long we keep it

On request we will delete your data sooner, subject to any records we are legally required to keep.

10 Security

• Traffic is encrypted in transit, and connector credentials are encrypted at rest as described in section 3.
• Access is scoped per organisation and per role, enforced in the data layer rather than in the interface, and membership is re-checked on every request.
• Passwords are stored as scrypt hashes with per-user salts. Sessions are stored as token hashes, so a database copy does not yield usable session tokens.
• Credentials are scrubbed from error messages and logs, including on failure paths.
• Administrative access to production systems is limited to the people who need it to run the service, protected by multi-factor authentication, and reviewed quarterly. Access is revoked the day someone no longer needs it.
• Database backups are encrypted at rest and held in the same region as the data itself; restores are tested rather than assumed.
• We keep a written incident response procedure with a named owner, covering how an incident is triaged, contained and communicated, including the notification commitment below.
• Dependencies and platform components are patched on a regular cadence, and security advisories affecting them are triaged on receipt.

If a breach affects your data, we will notify you without undue delay and, where required, within 72 hours of becoming aware of it.

11 Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing relies on consent.

To exercise any of these, write to privacy@gaingauge.com. We will respond within 30 days. If a request is complex enough to need longer, we will tell you so, and why, inside those first 30 days. We do not charge for this, and we will not treat you differently for asking.

You also have the right to complain to your data protection authority. In the European Economic Area that is the authority for the country you live or work in; in the United Kingdom it is the Information Commissioner's Office. We would rather you came to us first, but that is your choice, not a precondition.

If you are a California resident

In the last 12 months we have collected these categories of personal information, in each case for the purposes set out in section 4 and from the sources named in section 3, which are you and the advertising and CRM platforms you choose to connect:

• Identifiers: name, work email address, and, from connected CRM systems, contact email addresses, company domains and advertising click identifiers.
• Commercial information: deal and opportunity records, including amount, stage and close date.
• Internet or network activity: advertising touchpoints and their timestamps, and application session records.
• Professional information: the organisation a user belongs to and the role assigned to them.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the preceding 12 months, including for anyone under 16. There is accordingly no opt-out for you to exercise, and we say so plainly rather than hiding it behind a link that does nothing. We do not collect sensitive personal information, so the right to limit its use does not arise.

You have the right to know what we have collected and to receive it in a portable form, to correct it, and to delete it, and the right not to be discriminated against for exercising any of them. Use the same address, privacy@gaingauge.com. An authorised agent may act for you if they provide written permission signed by you, and we may still ask you to verify your own identity.

Where the personal information is your data held in a customer's CRM rather than your own GainGauge account, we act as that customer's service provider: we process it only on their documented instructions and we do not retain, use or disclose it for any other purpose. Requests about that data are handled as described in section 12.

12 Requests from your contacts

If someone in your CRM asks us directly to access or delete their data, we will not act on it unilaterally, because that data is yours and you are its controller. We will refer them to you and tell you about the request promptly. Where you need our help to fulfil it, we will provide it, including locating and deleting the relevant records in GainGauge.

13 Cookies

The application sets one strictly necessary cookie, which holds your session identifier and keeps you signed in. It is not used for tracking, it carries no advertising identifier, and the service cannot function without it, so no consent banner is required for it.

The marketing site sets no cookies at all. If we add analytics or embedded media that would change this, we will update this section and, where consent is required, ask for it before anything is set.

14 Children

GainGauge is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has reached us through a connected system, contact us and we will delete it.

15 Changes to this policy

If we change this policy we will update the effective date above, and for changes that materially affect how we handle personal data we will tell account owners by email before the change takes effect. Previous versions are available on request.

16 Contact

Privacy questions and data requests: privacy@gaingauge.com

Everything else: hello@gaingauge.com

Postal mail: Gain Gauge, 1319 N University Dr, #186, Coral Springs, FL 33071, United States.

We are not required to appoint a data protection officer and have not appointed one; privacy questions go to the address above and reach someone who can answer them. We have not appointed an EU or UK representative under Article 27. If we begin offering GainGauge to customers established in the European Economic Area or the United Kingdom, we will appoint one and name them here.