Privacy notice | ChannelGate AI OS

1. Who is responsible

The controller is MAKEITFUTURE S.R.L., a limited liability company registered in Romania (trade register no. J2021006204124, fiscal code RO45387234) with its registered office at Piața Mihai Viteazu 3-4, 400036 Cluj-Napoca, Cluj County, Romania ("Makeitfuture", "we", "us"). For anything in this notice, write to privacy@makeitfuture.com. We have not appointed a data protection officer; the same address reaches the people responsible for data protection.

2. What this notice covers, and what it does not

It covers the website and portal at channelgate.dev, the licensing and usage-reporting API a ChannelGate deployment calls, the enquiry forms, and the commercial and marketing communication that follows from them.

It does not cover what happens inside a self-hosted ChannelGate deployment. ChannelGate runs on infrastructure the operating organization controls. Prompts, messages, files, channel names, user identities and the AI providers a deployment talks to (Anthropic, OpenAI or others, under the operator's own accounts) never reach us. For that data the operating organization is the controller, and its own privacy notice applies. The only thing a deployment sends us is described in section 3 under "licensing telemetry"; the technical detail is in the public privacy and data-flow document.

3. What we collect, why, and on which legal basis

Context	Personal data	Purpose	Legal basis (GDPR Art. 6)
Account and portal	Sign-in email address, organization name, your role in the organization, invitations you send or receive, sign-in events and the audit trail of account, plan and key changes.	Create and secure your account, issue and manage license keys, show usage, let managers you invite administer the account.	Performance of a contract (6(1)(b)); our legitimate interest in keeping the service secure (6(1)(f)).
Licensing telemetry	A UUID the deployment generated for itself, a hash of its license key, its software version, a calendar month, and one hashed conversation identifier with a run count per conversation. No content, names or user identities.	Verify a key, apply the limits of its tier, show aggregate usage in the portal and detect abuse of the free tier.	Performance of a contract (6(1)(b)); legitimate interest in enforcing the license (6(1)(f)).
Enquiries and leads	Name, work email, organization, country, area of interest, your message, the page you submitted from, campaign parameters in the link you followed, and the time you gave consent.	Answer your request, prepare an offer, and — where you have agreed — keep you informed about ChannelGate and related services.	Consent (6(1)(a)) for follow-up and marketing; steps prior to a contract (6(1)(b)) for answering the request.
Security and operations	IP address, request metadata, rate-limit counters, server logs and error reports.	Keep the platform available, prevent automated abuse, and diagnose faults.	Legitimate interest in security and reliability (6(1)(f)).
Website analytics	Cookie identifiers, pages visited, referral source, visit and session information, approximate location, and browser and device information. Page and referral URLs exclude query strings and fragments; we do not send form inputs or account details to analytics.	Understand use of the public website and improve its content.	Consent (6(1)(a)); Accept/Reject and Cookie settings are described in section 9.
Marketing and advertising	Your email address and, where you consent, a hashed form of it and your interactions with our messages and pages.	Reach people and organizations similar to our customers, measure which campaigns work, and avoid showing advertising to people who already use the product.	Consent (6(1)(a)); you can withdraw it at any time (section 8).

We do not use special categories of personal data, we do not make decisions with legal or similarly significant effects by automated means, and the service is not directed at people under 16. Automated abuse protection can refuse a request for exceeding a rate limit.

4. Who processes data on our behalf, and with whom we share it

We work with the providers below. Each acts on our documented instructions under a data-processing agreement, or is an independent controller where the table says so.

Provider	What for	Where
Supabase	Authentication, database and API functions for the portal and licensing.	European Union (Frankfurt)
Vercel	Hosting and content delivery for channelgate.dev.	Global edge network; United States (Data Privacy Framework, standard contractual clauses)
Cloudflare	DNS for channelgate.dev.	Global; United States (Data Privacy Framework, standard contractual clauses)
Google Analytics (Google)	Website audience and usage measurement, only after you accept analytics. This consent does not enable advertising features. See Google's privacy notice.	International processing, including the United States; see section 5.
Google Workspace	Sending sign-in links and invitations, and our business mailboxes.	European Union and United States (Data Privacy Framework, standard contractual clauses)
HubSpot	Customer relationship management: enquiries, leads, customer accounts, offers, and the email you have agreed to receive.	European Union and United States (Data Privacy Framework, standard contractual clauses)
Make.com (Celonis)	Routing form submissions from the website to HubSpot and to our internal Slack workspace.	European Union
Slack	Internal notification of new enquiries to the people who answer them.	United States (Data Privacy Framework, standard contractual clauses)
AI assistants: Anthropic (Claude, Claude Code), OpenAI (ChatGPT, Codex), and open-source models we run ourselves	Internal processing of enquiries, support requests and customer correspondence — for example to draft a reply, summarize a request, or prepare an offer. We use these services under business terms that exclude the use of our data to train their models; self-hosted open-source models never leave our infrastructure.	European Union and United States (standard contractual clauses; self-hosted models in the European Union)
Advertising and social media partners: Meta (Facebook and Instagram ads), Google Ads, TikTok Ads	Only with your consent: hashed contact identifiers for custom and look-alike audiences, and conversion measurement. These partners act as independent controllers for their own advertising systems, under their own privacy notices.	United States (Data Privacy Framework and standard contractual clauses)

We may also disclose personal data where the law requires it, to professional advisers bound by confidentiality, and — with notice to you — to a successor in a merger or sale of the business. We never sell personal data.

5. International transfers

The portal and licensing database is hosted in the European Union. Consented website analytics may be processed by Google outside the European Economic Area, including in the United States. Where a provider in section 4 processes data in the United States or elsewhere outside the European Economic Area, we rely on the provider's certification under the EU-US Data Privacy Framework where available and otherwise on the European Commission's standard contractual clauses, with supplementary measures where needed. You can ask us at privacy@makeitfuture.com for a copy of the relevant safeguard.

6. How long we keep data

Account, organization, license and audit records: while your account is active, then for up to five years to meet contractual, accounting and legal obligations, after which they are deleted or anonymized.
Licensing telemetry: monthly aggregates are kept with the account; the underlying hashed rows are kept for the current and the previous twelve months.
Enquiries and leads: until your request is resolved and, where you agreed to be kept informed, until you withdraw consent or after 24 months without any interaction from you.
Rate-limit counters: expire automatically within hours. Server logs and error reports: up to 90 days.
Analytics cookies and preferences: analytics cookies are set with a maximum lifetime of 180 days, without extending that lifetime on each visit. We remember your Accept or Reject choice in this browser for 180 days; you can change it sooner in Cookie settings. Browser controls may remove cookies or preferences earlier.
Advertising audiences: refreshed from the current consented list and removed from the partner when you withdraw consent, within the partner's technical deletion window.

7. Your rights

Under the GDPR you may ask us at any time to access the personal data we hold about you, correct it, erase it, restrict its processing, receive it in a portable format, and to object to processing based on our legitimate interests — including direct marketing, to which you can object without giving a reason.

Write to privacy@makeitfuture.com from the address on your account, or tell us how to verify that the request is yours. We answer within one month; in complex cases we may extend that by two further months and will tell you why. Exercising these rights is free of charge unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority — in Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro — or with the authority of the EU member state where you live or work.

Where we rely on your consent, you can withdraw it at any time with effect for the future. To withdraw website analytics consent, open Cookie settings and choose Reject. For marketing or advertising consent, use the unsubscribe link in any marketing email or write to privacy@makeitfuture.com. Withdrawal stops the future processing covered by that consent. It does not affect processing that already took place or the processing we need to provide your account and licenses.

9. Cookies and similar technologies

The portal keeps your session in your browser's local storage so that you stay signed in. We also store your analytics preference locally for 180 days so that we can respect it. These storage uses support the service and your privacy choice and are separate from optional analytics cookies.

Google Analytics loads only after you choose Accept in our consent banner. Before that choice, and when you choose Reject, we do not load Google's analytics tag, send analytics requests, or set analytics cookies. Accepting allows Google Analytics to use first-party _ga and _ga_* cookies to distinguish browsers and sessions and collect the website usage information described in section 3. Advertising storage, advertising user data, ad personalization and Google signals remain disabled.

You can use the site with either choice. Open Cookie settings on any public page or in the portal to change your choice. Choosing Reject after Accept stops future analytics collection and removes the site's Google Analytics cookies; it does not delete data already received by Google. We ask again when the saved preference expires or is cleared. Analytics stays disabled on sign-in callbacks, in the signed-in portal and on the admin page.

10. How we protect data

Portal and licensing records are encrypted in transit and at rest, stored in our European Union database and protected by row-level security so that an organization can only see its own records. Access is limited to the people who need it; other providers' processing locations are described in sections 4 and 5. License keys are stored only as hashes and shown once, at issuance. Conversation identifiers reach us only as hashes and are never shown back to anyone. If a breach is likely to affect your rights we will inform you and the supervisory authority as the GDPR requires.

11. Changes to this notice

We will update this notice when our processing changes. The version and date at the top of the page identify the current text; account holders receive an email before any material change takes effect.

Your work stays in your deployment.