Privacy Policy

Account, identity verification, readership and payout privacy practices

Operated by: GATHWAY INC.
Effective: Oct 22, 2026
Version: 1.2

1. Controller and contact

GATHWAY INC. (“GATHWAY”, “we”, “us”), a Canadian corporation, operates The Insight Docket (“Platform”) at theinsightdocket.com. Contact: legal@gathway.app; privacy@gathway.app for privacy requests. Registered office: 230-7737 Lundy’s Lane, Niagara Falls, Ontario, Canada.

For activities controlled by GATHWAY, GATHWAY is responsible for determining the purposes and means of processing personal information. Specific vendors may act as processors or independent controllers under their own terms.

2. Information collected

Account data: email, authentication identifiers, display name, country, profile bio, preferences, age-eligibility confirmation and security metadata. At registration we ask only whether the account holder is 16 or 17, or 18 or older; we do not collect a full date of birth unless it is needed for a defined compliance purpose.
Contributor data: professional background and claims, submitted manuscripts, verification status, credentials and reasonably necessary identity documents; and, when a contributor chooses to use the optional AI Writing Assistant, the text and instructions they submit to it, the suggestions it returns, and records of its use (the task requested, the amount of text processed, the estimated cost and whether a suggestion was used).
Engagement data: publication views, deduplicated qualified readership events, follows, account notifications and messages, using privacy-preserving measurement where feasible.
Financial data: membership billing status, payout eligibility, transaction and tax records; sensitive bank information should be entered through an authorized secure payout provider rather than ordinary Platform messages.
Payment data: when you pay for a contributor membership, an advertisement or a sponsorship, your card or other payment details are entered directly with our payment processor, Stripe. We receive and keep the payment status, amounts, taxes, currency, dates, billing country and region, Stripe reference numbers and reasons for failed payments. We never receive or store full card numbers or security codes.
Advertiser and sponsor data: organization name, contact name, email address, website, country, the proposal submitted, review decisions, quotations, invoices and agreement status.
Technical data: device identifiers, network metadata, log files, fraud-prevention signals, cookie preferences and, where the required consent has been given, a first-party readership-measurement identifier (see the Cookie Notice).

3. Purposes and legal grounds

We use information to provide accounts, verify contributors, review submissions, publish works, operate paid memberships (including payment confirmation, renewal reminders, failed-payment notices, cancellations and refunds), review and invoice advertising and sponsorship arrangements, detect fraud, calculate eligible readership, process payouts, maintain security, keep financial and tax records, and meet legal obligations. Consent is obtained when legally required; other bases may apply under applicable law, including performance of contract and legitimate interests in jurisdictions recognizing them.

When a contributor asks for it, we process the text they submit to provide AI writing, editing, research and storytelling suggestions. We keep records of that use to apply usage limits, control costs, prevent misuse, maintain security and tell editorial reviewers when AI assistance was used on a submission. A suggestion changes a contributor's work only after the contributor confirms it, and suggestions are never published or submitted automatically. Using the assistant does not change the ownership of any work: contributors retain copyright in their original content, and the Contributor Publishing Agreement continues to govern publication. The assistant does not review, approve or publish submissions: editorial review and publication decisions continue to be made by people under our Editorial Standards and Publication Policy. We do not use submitted text or suggestions to train artificial intelligence models.

4. Verification and controlled access

Documents are submitted privately through contributor profiles and reviewed initially by the Super Admin. Specific verification responsibilities may later be delegated by an audited permission grant. Contributors can view and export their own submitted documents after verification, subject to necessary security controls. Replacements to verified documents require renewed review. Public profiles must never disclose identity document files or internal authentication IDs.

5. Readership measurement and notifications

Each eligible publication is measured independently for qualified unique readers. Fraud controls exclude bots and manipulated visits. Contributors may receive in-account progress messages at 100,000, 200,000, 300,000 and 400,000 readers, and eligibility messages at 500,000 after validation. In-account messages and achievement records may persist until removed under the retention schedule; optional emails require applicable notification and anti-spam controls.

Registered readers are counted through their accounts. Visitors who are not signed in are counted only where lawful measurement is possible, using a first-party readership-measurement identifier that is set only after the visitor opts in where consent is required. When a measured visitor later signs in on the same browser, that browser’s earlier measurement is attributed to their account so that the same person is not counted twice. We do not use browser fingerprinting or any other technique that circumvents cookie choices. If a visitor declines optional measurement, their visits while signed out are not counted towards qualified readership. The engagement criteria are published in the Monetization and Earnings Policy.

6. Recipients and international transfers

We may use authorized hosting, authentication, infrastructure, email, analytics, payment and anti-fraud providers. Data may be processed outside the user’s country, including where a vendor or subcontractor operates. We do not sell personal information to advertisers. Any sharing with advertising partners requires clear disclosures and applicable consent or other legal authority.

Payment processing. Payments for The Insight Docket are made to GATHWAY INC. and processed by Stripe (Stripe, Inc. and its affiliates), which acts as our payment processor and, for certain purposes such as fraud prevention and regulatory compliance, as an independent controller under its own privacy policy (stripe.com/privacy). To process a payment we share with Stripe your name, email address, billing country and region, the plan or invoice being paid and our internal reference; Stripe collects your payment details directly. Stripe may process this information outside your country, including in the United States. Refunds and payment disputes are handled through Stripe; we share with Stripe the information needed to resolve them.

One company, separate records. GATHWAY INC. owns and operates The Insight Docket and other services, including the GATHWAY App, and uses one corporate Stripe account for them. The Insight Docket's payment records are identified and kept separately from those of GATHWAY's other services, are used only for The Insight Docket's purposes described in this Policy, and are accessible only to staff with an authorized finance role. Information is not combined across GATHWAY's services except where needed for the accounting, tax, fraud-prevention or other legal obligations of GATHWAY INC.

AI Writing Assistant (OpenAI). The AI Writing Assistant is optional and is used only when a contributor asks for it. Before first using it, a contributor must acknowledge this version of the Privacy Policy. When a contributor uses it, our servers send to OpenAI, which acts as our service provider, the text and instructions the contributor submits and the title, type, category and genre of the work. For the novel tasks that need the story so far (plot development, characters, chapter outline and continuity check), we also send the contributor's own earlier chapters of the same novel, up to a limit set by the Platform; the assistant tells the contributor before a task uses them. OpenAI uses this information only to generate the requested suggestion and return it to us. We do not send account details, contact information, identity or verification documents, payment information or other people's works. Under OpenAI's terms for its API, this information is not used to train OpenAI's models unless we choose to allow it, which we have not; OpenAI may keep it in abuse-monitoring logs for up to 30 days, or longer where the law requires or where reasonably necessary to protect its services or others from harm. Our requests ask OpenAI not to store them for later use. OpenAI processes this information outside Canada, including in the United States, and may process it in other countries where it or its service providers operate. Contributors who do not use the assistant, and readers, are not affected.

Processing outside Canada. Some of our service providers, including our hosting, payment and AI providers, process personal information outside Canada, including in the United States. Information processed in another country is subject to that country's laws and may be accessible to its courts, law-enforcement and national-security authorities. We use contractual and other measures with our service providers to protect the information they process for us and to limit its use to the services they provide to us.

7. Retention and deletion

Personal information is kept only as long as reasonably necessary for identified purposes and applicable legal obligations. Verification documents should be deleted or de-identified according to an approved retention matrix after the need for verification and dispute handling ends. Account closure triggers deletion or de-identification of unnecessary personal data; published works may remain under the continuing licence, while financial, audit and legal-hold records may be retained as required.

Retention periods are as follows:

Rejected or withdrawn identity-verification documents: deleted within 90 days of final rejection or withdrawal unless lawful retention is necessary.
Approved identity-verification documents: deleted within 90 days after verification is completed unless continued retention is justified and documented.
Account profile information: retained during the account’s existence; following a valid deletion request, deleted or anonymized within 30 days unless an exception applies.
Financial and transaction records, including payment, invoice, refund and tax records for memberships, advertising and sponsorship: generally retained for six years from the end of the last tax year to which they relate, or for any different period required by applicable law.
Advertising and sponsorship inquiries that do not lead to an agreement: retained for 12 months after the last substantive interaction, then deleted, unless applicable law requires a different period.
Legal acceptance records: retained throughout the account’s existence and generally for six years after account closure, subject to applicable law and documented exceptions.
Published intellectual works and permitted attribution: retained under the approved continuing publication licence, subject to applicable law.
Governance and authorization audit records (such as role and permission changes, legal holds, account closures and records disposal): generally retained for six years.
Ordinary security and application logs: generally retained for 90 days unless a documented legal, security or regulatory reason requires longer retention.
AI Writing Assistant suggestion history and records of AI use (request metadata and usage records): deleted 90 days after they are created, or sooner when a contributor clears their suggestion history, unless a legal hold, an investigation or another documented legal, financial or security requirement applies. Platform-wide monthly totals of AI usage and cost, which do not identify anyone, are kept as financial records. A count of the AI suggestions accepted on a work is kept with that work so that editorial reviewers are informed.

Longer or shorter periods may apply where required by law. These periods may be extended where information is subject to a legal hold, is needed for an investigation, including into a security incident, or must be kept to satisfy documented regulatory or other legal requirements; any extended retention is limited to what is necessary and is documented. When a retention period ends, information is securely deleted or anonymized using methods appropriate to its sensitivity, and copies in backups are removed as those backups expire in the ordinary course.

When an account is closed, we keep a minimal closure record so that we can establish when the account was closed and which legal terms it accepted: the account identifier, the closure date, a keyed cryptographic hash of the account email address, the applicable retention deadline and whether a legal hold applies. The hash is created with a secret key held separately; it does not reveal the email address, but it allows us to confirm whether a disputed account matches a given address. The closure record and the related acceptance records are deleted or anonymized when the retention period ends, unless a legal hold applies.

8. Export and privacy rights

Account holders can request access, correction and export; contributors should be offered a secure export of verification documents, submissions, eligible published works and available statements before account deletion. Other rights—including erasure, objection, restriction, portability and consent withdrawal—apply according to relevant jurisdiction. Requests may require identity verification and may be limited by legal exceptions.

9. Security and incidents

We use role-based access, audit logging, restricted document storage, encrypted connections, limited staff access and secure payment onboarding. Card details are handled by Stripe and never stored on our systems. No technology offers absolute security. We will assess and notify reportable incidents to authorities and affected people when the law requires.

10. Cookies, minors and updates

Our Cookie Notice explains the cookies and similar technologies used on the Platform. Optional analytics, advertising and readership-measurement technologies are used only after affirmative opt-in consent where consent is required, and choices can be changed or withdrawn at any time.

Registered reader accounts are available to persons aged 16 or older, or any higher minimum age required by applicable law. For account holders aged 16 or 17, profiles are private by default, personal information is not publicly disclosed unnecessarily, unsolicited messages from adult accounts are restricted, and their information is not used for personalized advertising or advertising profiling. We do not knowingly register children under 16; if we learn that such an account has been created, we will close it and delete the associated personal information except where retention is legally required. The Platform is not designed to solicit identity documents from children.