Privacy Policy

Account, identity verification, readership and payout privacy practices

Operated by: GATHWAY INC.
Effective: Oct 13, 2026
Version: 1.1

This is a previous version (Version 1.1, effective Oct 13, 2026), kept for reference. It was replaced by Version 1.2, effective Oct 22, 2026.

1. Controller and contact

GATHWAY INC. (“GATHWAY”, “we”, “us”), a Canadian corporation, operates The Insight Docket (“Platform”) at theinsightdocket.com. Contact: legal@gathway.app; privacy@gathway.app for privacy requests. Registered office: 230-7737 Lundy’s Lane, Niagara Falls, Ontario, Canada.

For activities controlled by GATHWAY, GATHWAY is responsible for determining the purposes and means of processing personal information. Specific vendors may act as processors or independent controllers under their own terms.

2. Information collected

Account data: email, authentication identifiers, display name, country, profile bio, preferences, age-eligibility confirmation and security metadata. At registration we ask only whether the account holder is 16 or 17, or 18 or older; we do not collect a full date of birth unless it is needed for a defined compliance purpose.
Contributor data: professional background and claims, submitted manuscripts, verification status, credentials and reasonably necessary identity documents.
Engagement data: publication views, deduplicated qualified readership events, follows, account notifications and messages, using privacy-preserving measurement where feasible.
Financial data: membership billing status, payout eligibility, transaction and tax records; sensitive bank information should be entered through an authorized secure payout provider rather than ordinary Platform messages.
Technical data: device identifiers, network metadata, log files, fraud-prevention signals, cookie preferences and, where the required consent has been given, a first-party readership-measurement identifier (see the Cookie Notice).

3. Purposes and legal grounds

We use information to provide accounts, verify contributors, review submissions, publish works, operate paid memberships, detect fraud, calculate eligible readership, process payouts, maintain security and meet legal obligations. Consent is obtained when legally required; other bases may apply under applicable law, including performance of contract and legitimate interests in jurisdictions recognizing them.

4. Verification and controlled access

Documents are submitted privately through contributor profiles and reviewed initially by the Super Admin. Specific verification responsibilities may later be delegated by an audited permission grant. Contributors can view and export their own submitted documents after verification, subject to necessary security controls. Replacements to verified documents require renewed review. Public profiles must never disclose identity document files or internal authentication IDs.

5. Readership measurement and notifications

Each eligible publication is measured independently for qualified unique readers. Fraud controls exclude bots and manipulated visits. Contributors may receive in-account progress messages at 100,000, 200,000, 300,000 and 400,000 readers, and eligibility messages at 500,000 after validation. In-account messages and achievement records may persist until removed under the retention schedule; optional emails require applicable notification and anti-spam controls.

Registered readers are counted through their accounts. Visitors who are not signed in are counted only where lawful measurement is possible, using a first-party readership-measurement identifier that is set only after the visitor opts in where consent is required. When a measured visitor later signs in on the same browser, that browser’s earlier measurement is attributed to their account so that the same person is not counted twice. We do not use browser fingerprinting or any other technique that circumvents cookie choices. If a visitor declines optional measurement, their visits while signed out are not counted towards qualified readership. The engagement criteria are published in the Monetization and Earnings Policy.

6. Recipients and international transfers

We may use authorized hosting, authentication, infrastructure, email, analytics, payment and anti-fraud providers. Data may be processed outside the user’s country, including where a vendor or subcontractor operates. Vendor arrangements, safeguards and applicable international transfer disclosures must be confirmed before launch. We do not sell personal information to advertisers. Any sharing with advertising partners requires clear disclosures and applicable consent or other legal authority.

7. Retention and deletion

Personal information is kept only as long as reasonably necessary for identified purposes and applicable legal obligations. Verification documents should be deleted or de-identified according to an approved retention matrix after the need for verification and dispute handling ends. Account closure triggers deletion or de-identification of unnecessary personal data; published works may remain under the continuing licence, while financial, audit and legal-hold records may be retained as required.

Retention periods are as follows:

Rejected or withdrawn identity-verification documents: deleted within 90 days of final rejection or withdrawal unless lawful retention is necessary.
Approved identity-verification documents: deleted within 90 days after verification is completed unless continued retention is justified and documented.
Account profile information: retained during the account’s existence; following a valid deletion request, deleted or anonymized within 30 days unless an exception applies.
Financial and transaction records: generally retained for six years, or for any different period required by applicable law.
Legal acceptance records: retained throughout the account’s existence and generally for six years after account closure, subject to applicable law and documented exceptions.
Published intellectual works and permitted attribution: retained under the approved continuing publication licence, subject to applicable law.
Governance and authorization audit records (such as role and permission changes, legal holds, account closures and records disposal): generally retained for six years.
Ordinary security and application logs: generally retained for 90 days unless a documented legal, security or regulatory reason requires longer retention.

Longer or shorter periods may apply where required by law. These periods may be extended where information is subject to a legal hold, is needed for an investigation, including into a security incident, or must be kept to satisfy documented regulatory or other legal requirements; any extended retention is limited to what is necessary and is documented. When a retention period ends, information is securely deleted or anonymized using methods appropriate to its sensitivity, and copies in backups are removed as those backups expire in the ordinary course.

When an account is closed, we keep a minimal closure record so that we can establish when the account was closed and which legal terms it accepted: the account identifier, the closure date, a keyed cryptographic hash of the account email address, the applicable retention deadline and whether a legal hold applies. The hash is created with a secret key held separately; it does not reveal the email address, but it allows us to confirm whether a disputed account matches a given address. The closure record and the related acceptance records are deleted or anonymized when the retention period ends, unless a legal hold applies.

8. Export and privacy rights

Account holders can request access, correction and export; contributors should be offered a secure export of verification documents, submissions, eligible published works and available statements before account deletion. Other rights—including erasure, objection, restriction, portability and consent withdrawal—apply according to relevant jurisdiction. Requests may require identity verification and may be limited by legal exceptions.

9. Security and incidents

We use role-based access, audit logging, restricted document storage, encrypted connections, limited staff access and secure payment onboarding. No technology offers absolute security. We will assess and notify reportable incidents to authorities and affected people when the law requires.

10. Cookies, minors and updates

Our Cookie Notice explains the cookies and similar technologies used on the Platform. Optional analytics, advertising and readership-measurement technologies are used only after affirmative opt-in consent where consent is required, and choices can be changed or withdrawn at any time.

Registered reader accounts are available to persons aged 16 or older, or any higher minimum age required by applicable law. For account holders aged 16 or 17, profiles are private by default, personal information is not publicly disclosed unnecessarily, unsolicited messages from adult accounts are restricted, and their information is not used for personalized advertising or advertising profiling. We do not knowingly register children under 16; if we learn that such an account has been created, we will close it and delete the associated personal information except where retention is legally required. The Platform is not designed to solicit identity documents from children.