1. Acceptance of Terms

By creating a Gatekyp account you agree to these Terms and Conditions in full. If you disagree with any part, you must not use the service. We reserve the right to update these terms at any time; continued use of the service after changes constitutes acceptance.

2. Account Eligibility

You must be at least 13 years of age to use Gatekyp. By registering, you confirm that all information you provide is accurate, current, and complete. You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account.

3. Acceptable Use

You agree not to: (a) use the service for any unlawful purpose; (b) attempt to gain unauthorised access to any part of the platform; (c) upload or transmit malicious code, viruses, or harmful content; (d) scrape, crawl, or systematically extract data without written permission; (e) impersonate another person or entity; (f) abuse, harass, or threaten other users.

4. Subscription & Billing

Paid plans (Premium and Platinum) are billed monthly via Stripe. All plans include a 7-day free trial. You will not be charged until the trial ends. You may cancel at any time before the trial ends to avoid any charge. Cancellation takes effect at the end of the current billing period — you retain access until then. We do not offer refunds for partial months.

5. Free Trial

New paid subscribers receive a 7-day free trial. Only one trial per person; we use email address and payment method to enforce this. Fraudulent or repeated trial use is a breach of these terms and may result in immediate account suspension.

6. Price Changes

We reserve the right to change subscription prices at any time. You will be given at least 30 days' written notice by email before any price change takes effect. Continued subscription after the effective date constitutes acceptance of the new price.

7. Intellectual Property

All content, design, code, and branding of Gatekyp (including the GateMark logo) are owned by Gatekyp and protected by UK and international copyright law. You may not reproduce, distribute, or create derivative works without explicit written consent. Content you upload (photos, notes, reviews) remains yours; you grant us a limited licence to display it within the platform.

8. User-Generated Content

You are solely responsible for content you submit. By submitting content you confirm you own the rights to it and that it does not violate any third-party rights. We reserve the right to remove any content that violates these terms or is otherwise objectionable, without notice.

9. Availability & Modifications

We aim for high availability but do not guarantee uninterrupted service. We reserve the right to modify, suspend, or discontinue any part of the service at any time. Where reasonably practicable we will provide advance notice of significant changes.

10. Limitation of Liability

To the maximum extent permitted by UK law, Gatekyp shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the service. Our total liability for direct damages shall not exceed the amount you paid us in the 12 months preceding the claim.

11. Termination

We reserve the right to suspend or terminate your account immediately, without prior notice, for breach of these terms. Upon termination, your right to use the service ceases. We may retain anonymised data as permitted by our Privacy Policy.

12. Governing Law

These terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

What we collect

We collect: your email address and name (required for account creation); fragrance data you add (bottle names, notes, wear logs, photos); device and session identifiers for security; payment information (processed by Stripe — we never see your full card number); usage analytics to improve the product.

How we use your data

Your data powers your personal Gatekyp experience — recommendations, analytics, AI features, and community features. We do not sell, rent, share, or monetise your personal data with third parties. We do not use your data for advertising.

AI features

When you use Ask AI or AI recommendations, your collection data is sent to Anthropic's API to generate a response. This data is not stored by Anthropic beyond the request window. See anthropic.com/privacy for Anthropic's data practices.

Data storage & security

Your data is stored on Supabase (hosted on AWS in the EU). All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Row-level security policies ensure only you can access your data — even our internal team cannot read your collection without your account credentials.

Passkeys & biometrics

If you register or sign in with a passkey, your biometric data (Face ID, Touch ID, fingerprint) never leaves your device. We store only a cryptographic public key. Your biometric data is never transmitted to or stored by Gatekyp.

Cookies

We use essential session cookies to keep you signed in and remember your preferences. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser but this will affect functionality.

Data retention

We retain your data for as long as your account is active. You may request account deletion at any time by contacting privacy@gatekyp.com — all personal data will be deleted within 30 days, except where retention is required by law.

Your rights (UK GDPR)

You have the right to: access a copy of your personal data; correct inaccurate data; request deletion; restrict or object to processing; data portability. To exercise any of these rights, contact privacy@gatekyp.com. You also have the right to lodge a complaint with the ICO (ico.org.uk).

Third-party services

We use: Supabase (database & auth), Stripe (payments), Anthropic (AI features), OneSignal (push notifications), Vercel (hosting). Each has their own privacy policy governing their handling of data.

Passkey authentication

Gatekyp supports passkeys — the most secure authentication method available. Passkeys use public-key cryptography: your private key never leaves your device, making phishing attacks impossible. We strongly recommend passkeys over passwords.

Encryption in transit

All communication between your device and Gatekyp uses TLS 1.3 — the current gold standard for transport encryption. HTTP Strict Transport Security (HSTS) is enforced with preloading, preventing downgrade attacks.

Encryption at rest

All data stored in our database is encrypted at rest using AES-256. Backups are also encrypted. Database credentials are never exposed to the frontend.

Row-level security

Every database query is scoped to your user ID by Supabase Row-Level Security (RLS). This means even if there were a bug in our application code, your data cannot be read by another user — it is enforced at the database level.

Biometric screen privacy

When you background the Gatekyp app, the screen is automatically obscured to prevent your collection data from appearing in your OS app switcher or being captured in device screenshots.

Security headers

We enforce a strict Content Security Policy (CSP), X-Frame-Options: DENY (clickjacking protection), X-Content-Type-Options: nosniff, and Referrer-Policy to minimise data leakage. These headers are verified and enforced on every response.

Payment security

We never handle, store, or log your payment card details. All payment processing is performed by Stripe, a PCI DSS Level 1 certified payment provider. Stripe webhook events are verified using HMAC signature validation before any action is taken.

Responsible disclosure

If you discover a security vulnerability, please report it to security@gatekyp.com. We commit to acknowledging reports within 48 hours and resolving confirmed vulnerabilities within 30 days.