This Privacy Policy explains how Gadura collects, uses, discloses, protects and deletes personal information when you use the Gadura platform, tools and related services (the “Services”). It applies to creators who run their business on Gadura, to the customers, students and community members who buy from or join those creators, and to visitors of pages we host.
- Who we are and what this policy covers
- The roles we play
- Information we collect
- How we use information
- Legal bases
- Calendar connections: Google Calendar and Microsoft 365
- Email sending
- Cookies
- Sharing and our service providers
- AI features
- International transfers
- How we protect your data
- Retention and deletion
- Your privacy rights
- Children
- Changes to this policy
- Contact
1. Who we are and what this policy covers
The Services are operated by Gadura Limited Liability Company, registered in Wyoming, USA (“Gadura”, “we”, “us”). Our mailing address is 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom. You can reach us at legal@gadura.com for privacy matters and support@gadura.com for support. Gadura is operated from the United Kingdom, which is our primary market.
This policy covers app.gadura.com, members.gadura.com, www.gadura.com, creator sites on gadura.site subdomains and on creators’ own domains, and the emails we send. Creators may add their own terms to their sites; where they do, those terms sit alongside this policy for their customers.
Related documents: our Terms of Service, Cookie Policy, Data Processing Addendum, Anti-Spam Policy and Acceptable Use Policy.
2. The roles we play
- Controller. For creator accounts, billing, support, product improvement, platform security and legal compliance, Gadura decides how personal information is used.
- Processor. When a creator imports, collects or manages the details of their own customers, students and members through Gadura, the creator is the controller and Gadura processes that data on the creator’s instructions, under our Data Processing Addendum. We never use creator-imported data for Gadura’s own marketing.
3. Information we collect
Information you give us
- Account details: name, email address, password (stored only as a hash), business name and branding.
- Content you create or upload: courses, lessons, videos, images, files, posts, emails and pages.
- Contacts you import or collect: names, email addresses, tags and notes about your own customers and subscribers.
- Booking details: services you offer, your working hours, and the names, email addresses and answers customers give when they book.
- Payment details: handled by Stripe. Gadura never sees or stores full card numbers.
- Messages you send to support.
Information collected automatically
- Usage and security logs, including IP address, browser and device type, pages visited and actions taken.
- Email delivery events: sends, deliveries, opens, clicks, bounces, complaints and unsubscribes for emails sent through Gadura.
- Cookies and similar technologies, described in section 8.
Information from connected services
- Calendar data, only if a creator chooses to connect Google Calendar or Microsoft 365 to Bookings. Section 6 describes exactly what we access and how it is handled.
- Payment and payout events from Stripe.
4. How we use information
- To operate and deliver the Services: accounts, courses, communities, bookings, email sending, websites and checkout.
- To authenticate users and keep accounts secure.
- To process payments, subscriptions, payouts and refunds.
- To provide support and to send service notices, receipts, booking confirmations and reminders.
- To prevent abuse, spam and fraud, and to protect the platform.
- To understand how the product is used and to improve it.
- To comply with legal obligations.
We do not sell personal information and we do not use it for third-party advertising.
5. Legal bases
Where the UK or EU GDPR applies, we rely on: performance of a contract (providing the Services you signed up for); legitimate interests (security, fraud prevention, product improvement, service communications); consent (where we ask for it, for example when you connect a calendar or accept optional cookies); and legal obligation.
6. Calendar connections: Google Calendar and Microsoft 365
Creators who use Bookings can connect a calendar so that times already busy elsewhere are not offered to customers. Connecting a calendar is optional, is started by the creator, and can be undone at any time.
Google Calendar
What we ask for. Read-only access to your Google calendars (the calendar.readonly scope) and your basic profile (your email address, so Gadura can show which Google account is connected). We do not request permission to create, change or delete events in Google Calendar, and Gadura never writes to your Google Calendar.
What we access. The list of your calendars, and for the calendars you tick, events from one day in the past to 90 days ahead. From each event we keep: the event identifier, its title, start and end times, whether it is all day, whether it marks you busy, free or tentative, whether you declined it, and when it was last changed. We do not access attendees, descriptions, attachments or locations.
Why. To block those times in your Gadura availability so customers cannot double-book you, and to show those busy times alongside your bookings in your own schedule. Busy times and their titles are visible only inside your Gadura account, to you and to the team members you have allowed to manage bookings for your organisation. Customers never see them.
How it is stored. The OAuth tokens Google issues are encrypted with AES-256-GCM using a key that exists only on our servers, and are never sent to a browser. Busy times are stored in our database, which is encrypted at rest. Nothing from your calendar is written to logs or error reports.
What we never do with Google user data. We do not share it with anyone except the infrastructure providers named in section 9, and only so far as needed to run the Services. We do not sell it, use it for advertising, use it to build profiles, or use it to develop, improve or train generalised artificial intelligence or machine learning models. Our staff do not read it, except with your permission to resolve a support request you raised, to investigate security or abuse, or where the law requires.
Deleting it. When you disconnect a calendar in Gadura (Bookings, Settings, Calendars), we delete the stored busy times and calendar list immediately, delete the tokens, and ask Google to revoke Gadura’s access. Busy times that have passed are removed within 30 days of ending in any case. If you instead revoke Gadura’s access from your Google Account (myaccount.google.com/permissions), syncing stops at once; the busy times we already hold keep protecting your availability until you disconnect or reconnect the calendar in Gadura, and are removed within 30 days of passing.
Gadura’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data obtained through Google Workspace APIs to develop, improve or train generalised AI or machine learning models.
Microsoft 365 and Outlook
With your permission, Gadura reads busy times from the Microsoft calendars you select, on the same terms as above, and, if you choose, adds your confirmed Gadura bookings to one Microsoft calendar so they appear beside the rest of your day. Those added events contain the booking time, the service name and the customer’s name. Disconnecting removes the stored busy times, calendar list and tokens in the same way; events already added to your Microsoft calendar stay in your calendar, under your control. You can also revoke Gadura’s access from your Microsoft account settings.
7. Email sending
When creators send email through Gadura, we process recipient addresses and delivery events (sends, bounces, complaints, opens, clicks and unsubscribes) to deliver the mail, to honour unsubscribes, to protect deliverability and to enforce our Anti-Spam Policy. Unsubscribe and complaint records are kept for as long as needed to make sure a person who opted out is not emailed again.
8. Cookies
Gadura sets cookies that are necessary to sign you in, keep your session, remember your theme and protect against abuse, and, only if you accept the short notice shown when you arrive through a partner's or an affiliate's link, one first-party attribution cookie, described in our Cookie Policy. Gadura does not set advertising or analytics cookies on any of its hosts, and www.gadura.com shows no cookie banner because it sets no cookie that needs consent. Creators may add their own analytics or advertising tags (for example Google Analytics or the Meta pixel) to the sites they build with Gadura; where they do, the creator is responsible for those tags and for any consent they require. You can control cookies in your browser settings. Full details are in our Cookie Policy.
9. Sharing and our service providers
We share personal information only for these reasons: to provide and improve the Services, to secure them, to comply with the law, and, with notice, in a change of ownership of Gadura. We do not sell personal information, we do not share it for advertising, and we do not share it with data brokers.
The providers below process data on our behalf, under contracts that limit their use of it to the service they provide to us:
| Provider | What it does for Gadura |
|---|---|
| Vercel | Hosting, content delivery and serverless computing for the platform and creator sites. |
| Supabase (on Amazon Web Services) | Database, authentication and file storage. This is where account, content, booking and calendar data live. |
| Stripe | Payments, subscriptions, refunds and creator payouts. |
| PayPal | Payouts to affiliates and referral partners who choose to be paid that way. |
| Postmark | Delivery of transactional email and creator email. |
| Mux | Video hosting and streaming for course and community video. |
| Anthropic | The AI models behind Gadura’s drafting and help features (see section 10). |
| Sentry | Error monitoring. A small sample of sessions (one in a hundred, and any session in which an error occurs) is recorded as a replay with all typed text masked and media blocked, so we can see what went wrong without seeing what you typed. |
| Cloudflare | Serves creator sites on their own custom domains; visitor traffic to those sites passes through it. |
| Hugging Face | Hosts the image model a creator's browser downloads when they use the picture cutout tool. No personal data is sent; the browser connects to it to fetch the model. |
| Google and Microsoft | Calendar providers, only for creators who connect a calendar (section 6). Google also serves the web fonts used on some pages. |
We may also disclose information to regulators, courts or law enforcement where the law requires it, and to a successor business if Gadura is acquired or merges, in which case this policy continues to apply to the transferred data. Google user data would be transferred in such a transaction only after we have told you and obtained your explicit consent.
Where the running of the business requires it, we may share personal information in confidence with our professional advisers, such as lawyers, accountants and auditors, and with payment providers to complete a transaction you asked for. We do not share Google user data with professional advisers, analytics vendors or advertising networks.
10. AI features
Some Gadura features use AI models from Anthropic to draft or organise content for creators, such as course outlines, and to answer help questions inside the product. Those features send only the text the creator asks them to work with and the product context needed to answer. They never receive calendar data, payment details or the personal details of a creator’s customers. We do not use anyone’s personal information to train AI models.
11. International transfers
Gadura operates from the United Kingdom and uses providers in the United States and the European Union. Where personal information leaves the UK or EU, we rely on recognised safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or an adequacy decision. For creators, these safeguards are set out in our Data Processing Addendum.
12. How we protect your data
These are the specific measures in place today:
- Encryption in transit. Every connection to Gadura, to creator sites and to our providers uses TLS (HTTPS). Plain HTTP is redirected.
- Encryption at rest. Our database, file storage and backups are encrypted at rest by the providers that hold them.
- Extra encryption for the most sensitive tokens. Calendar access tokens for Google and Microsoft are encrypted a second time inside the application with AES-256-GCM, using a key held only in our server environment. They are never sent to a browser and never written to logs.
- Password protection. Passwords are stored only as salted bcrypt hashes. Sign-in and password reset are rate-limited, reset links expire and work once, and a security notice is emailed when a password changes.
- Access control. Access to production data is limited to a small number of authorised people, on a need-to-know basis. Within the product, team members see only what their role allows.
- Secrets management. Service credentials live only in the server environment, are never committed to source code, and are rotated.
- Audit logging. Sign-in attempts and the deletion of accounts and contacts are logged for security review.
- Monitoring and backups. Application errors are monitored continuously without personal information, and the database is backed up regularly by our provider.
- Data minimisation. Connected calendars are read-only wherever the feature allows, only the fields listed in section 6 are kept, and card numbers never touch our systems.
- Incident response. If a breach affecting personal information occurs, we will notify affected people and the relevant authorities without undue delay and, where the law requires, within 72 hours of becoming aware.
No system is perfectly secure. Please use a strong, unique password and keep your own copies of important content.
13. Retention and deletion
- Accounts. We keep account data while your account is open. When you ask to close your account, it is locked at once and kept for 30 days so you can export your data or restore the account. After 30 days it is permanently deleted, except where the law requires longer retention (for example, tax records).
- Calendar data. Deleted immediately when a calendar is disconnected. Busy times that have passed are removed within 30 days in any case.
- Email records. Unsubscribe and complaint records are kept so that opt-outs continue to be honoured.
- Logs. Security and usage logs are kept for a limited period and then deleted or anonymised.
- Uploaded files. Files you upload are backed up daily to a private store in the same project. When a file is changed or deleted, its previous copy stays in the backup for 90 days and is then removed.
You can ask us to delete your data at any time using the contact details below. Creators can also delete their customers’ records from within Gadura.
14. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your personal information, to receive it in a portable form, and to withdraw consent where we rely on it. Email legal@gadura.com and we will respond within the time the law allows. If you are a customer or member of a creator, we may refer your request to that creator, who controls your data, and help them fulfil it. You can also complain to your data protection authority; in the UK that is the Information Commissioner’s Office.
15. Children
Member accounts are for people aged 16 and over, and creator accounts for people aged 18 and over, or older where local law requires. We do not knowingly collect information from anyone younger, and we delete it if we learn that we have. Creators may not run communities on Gadura for people under 16 and are responsible for complying with the laws that apply to their own audiences.
16. Changes to this policy
We may update this policy as the Services change. The date at the top shows the latest version. If a change is material, we will tell you by email or inside the product before it takes effect.
17. Contact
Gadura Limited Liability Company
3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom
Privacy and legal: legal@gadura.com
Support: support@gadura.com