Privacy Policy

This is a previous version (Version 1.0, effective Oct 12, 2026), kept for reference. It was replaced by Version 1.2, effective Oct 22, 2026.

1. Controller and contact

GATHWAY INC. (“GATHWAY”, “we”, “us”), a Canadian corporation, operates The Insight Docket (“Platform”) at theinsightdocket.com. Contact: legal@gathway.app; privacy@gathway.app for privacy requests. Registered office: 230-7737 Lundy’s Lane, Niagara Falls, Ontario, Canada.

For activities controlled by GATHWAY, GATHWAY is responsible for determining the purposes and means of processing personal information. Specific vendors may act as processors or independent controllers under their own terms.

2. Information collected

• Account data: email, authentication identifiers, display name, country, profile bio, preferences and security metadata.
• Contributor data: professional background and claims, submitted manuscripts, verification status, credentials and reasonably necessary identity documents.
• Engagement data: publication views, deduplicated qualified readership events, follows, account notifications and messages, using privacy-preserving measurement where feasible.
• Financial data: membership billing status, payout eligibility, transaction and tax records; sensitive bank information should be entered through an authorized secure payout provider rather than ordinary Platform messages.
• Technical data: device identifiers, network metadata, log files, fraud-prevention signals and cookie preferences where deployed.

3. Purposes and legal grounds

We use information to provide accounts, verify contributors, review submissions, publish works, operate paid memberships, detect fraud, calculate eligible readership, process payouts, maintain security and meet legal obligations. Consent is obtained when legally required; other bases may apply under applicable law, including performance of contract and legitimate interests in jurisdictions recognizing them.

4. Verification and controlled access

Documents are submitted privately through contributor profiles and reviewed initially by the Super Admin. Specific verification responsibilities may later be delegated by an audited permission grant. Contributors can view and export their own submitted documents after verification, subject to necessary security controls. Replacements to verified documents require renewed review. Public profiles must never disclose identity document files or internal authentication IDs.

5. Readership measurement and notifications

Each eligible publication is measured independently for qualified unique readers. Fraud controls exclude bots and manipulated visits. Contributors may receive in-account progress messages at 100,000, 200,000, 300,000 and 400,000 readers, and eligibility messages at 500,000 after validation. In-account messages and achievement records may persist until removed under the retention schedule; optional emails require applicable notification and anti-spam controls.

6. Recipients and international transfers

We may use authorized hosting, authentication, infrastructure, email, analytics, payment and anti-fraud providers. Data may be processed outside the user’s country, including where a vendor or subcontractor operates. Vendor arrangements, safeguards and applicable international transfer disclosures must be confirmed before launch. We do not sell personal information to advertisers. Any sharing with advertising partners requires clear disclosures and applicable consent or other legal authority.

7. Retention and deletion

Personal information is kept only as long as reasonably necessary for identified purposes and applicable legal obligations. Verification documents should be deleted or de-identified according to an approved retention matrix after the need for verification and dispute handling ends. Account closure triggers deletion or de-identification of unnecessary personal data; published works may remain under the continuing licence, while financial, audit and legal-hold records may be retained as required.

Retention periods are as follows:

• Rejected or withdrawn identity-verification documents: deleted within 90 days of final rejection or withdrawal unless lawful retention is necessary.
• Approved identity-verification documents: deleted within 90 days after verification is completed unless continued retention is justified and documented.
• Account profile information: retained during the account’s existence; following a valid deletion request, deleted or anonymized within 30 days unless an exception applies.
• Financial and transaction records: generally retained for six years, or for any different period required by applicable law.
• Legal agreement and acceptance records: retained for documented legal, compliance and dispute-resolution purposes, subject to an established retention period and lawful exceptions.
• Published intellectual works and permitted attribution: retained under the approved continuing publication licence, subject to applicable law.
• Security and application logs: generally retained for 90 days unless longer retention is justified.

These periods may be extended where information is subject to a legal hold, is needed to investigate or respond to a security incident, or must be kept to satisfy regulatory or other legal requirements; any extended retention is limited to what is necessary and is documented. When a retention period ends, information is securely deleted or anonymized using methods appropriate to its sensitivity, and copies in backups are removed as those backups expire in the ordinary course.

8. Export and privacy rights

Account holders can request access, correction and export; contributors should be offered a secure export of verification documents, submissions, eligible published works and available statements before account deletion. Other rights—including erasure, objection, restriction, portability and consent withdrawal—apply according to relevant jurisdiction. Requests may require identity verification and may be limited by legal exceptions.

9. Security and incidents

We use role-based access, audit logging, restricted document storage, encrypted connections, limited staff access and secure payment onboarding. No technology offers absolute security. We will assess and notify reportable incidents to authorities and affected people when the law requires.

10. Cookies, minors and updates

A separate cookie notice and choice mechanism will be supplied for optional analytics or advertising technologies where required. The Platform is not designed to solicit identity documents from children. Privacy Policy changes will be dated and communicated as required. Contact privacy@gathway.app.