Privacy Policy

1. Who We Are

Gigi (usegigi.ai) is operated by MVPHub LLC (“Controller”), with registered address at 1111B S Governors Ave STE 29827, Dover, DE 19904, United States. We act as the data controller for personal data processed through our Service. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable data protection law.

Where we deliver managed services under a signed Data Processing Agreement, the customer is the controller of its campaign and prospect data and we process that data as its processor, on its instructions and under that agreement. This Privacy Policy still describes how the Service handles the data.

2. Data We Collect

2.1 Data You Provide

• Account information: Name, email address, company name, billing information
• Campaign configuration: Your offer description, ideal customer profile, targeting criteria, tone preferences
• LinkedIn connection: OAuth tokens or session credentials via Unipile (we never store your LinkedIn password)
• AI assistant connections: If you connect Gigi to Claude or another AI assistant (Section 7), a record of each connection: the assistant's name, when it was authorised and last used, and when it expires or was revoked. We do not receive your conversations with the assistant

2.2 Prospect Data (Collected Automatically)

When you initiate a campaign, the Service collects publicly available LinkedIn profile data of your specified prospects, including:

• Name, job title, company, headline, summary/about section
• Work history, education, skills, endorsements
• Recent posts and activity (if publicly visible)
• Profile photo URL (not stored)
• The LinkedIn messages exchanged between you and your prospects, including their replies, so that the inbox, reply handling and campaign reporting work

2.3 AI-Generated Data

Based on prospect data, our AI generates:

• Personality and communication style analyses
• Prospect-offer fit scores (0–10)
• Draft message sequences with reasoning explanations

These analyses are probabilistic assessments and do not constitute definitive personality profiling. They are used solely to improve the relevance of outreach messages.

2.4 Usage and Technical Data

• Log data (IP address, browser type, pages visited, timestamps)
• Campaign analytics (messages sent, acceptance rates, reply rates)
• Cookies (see Section 10)

3. Legal Basis for Processing (GDPR Article 6)

We process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing your account data and campaign data to deliver the Service
• Legitimate interest (Art. 6(1)(f)): Processing publicly available LinkedIn data of prospects for B2B outreach personalization. Our legitimate interest is enabling our users to conduct relevant, personalized business communication. We have conducted a balancing test and determined that this processing does not override the rights of data subjects, as: (a) the data is already publicly shared by the prospect on LinkedIn, (b) the purpose is limited to professional B2B outreach, (c) data subjects can opt out at any time, and (d) no sensitive data categories are processed
• Consent (Art. 6(1)(a)): For cookies, marketing communications, and any optional data processing
• Legal obligation (Art. 6(1)(c)): Where required by law (e.g., tax records, regulatory requests)

4. AI-Based Profiling and Automated Decision-Making

The Service uses AI to analyze prospect profiles and generate communication insights. Per GDPR Article 22, we clarify that: (a) AI analyses are used solely to draft message suggestions for the user; (b) no automated decisions with legal or significant effects are made about prospects; (c) all messages require human approval before sending; (d) AI analyses are advisory in nature and do not result in automated actions; and (e) the user (not the AI) makes all decisions about whether to contact a prospect and what to send. Prospects may exercise their rights under Section 8 to object to this processing.

5. How We Use Your Data

• To provide, maintain, and improve the Service
• To generate AI-powered prospect analyses and message drafts
• To process payments, manage subscriptions, one-time credit purchases, and managed-service billing
• To send transactional communications (account confirmations, billing, subscription renewals, service updates)
• To monitor and enforce acceptable use
• To aggregate anonymized analytics for product improvement

6. Data Sharing and Sub-Processors

We share personal data only with the following sub-processors, all bound by data processing agreements. The current list is always published at usegigi.ai/subprocessors.

• Unipile (France): LinkedIn connectivity: sign-in, search and messaging. Processes LinkedIn session data
• Anthropic (USA): AI analysis and message drafting
• OpenAI (USA): AI analysis and message drafting
• Stripe: Billing: subscriptions, credit packs and managed-service invoices
• Postmark: Transactional email
• Trigger.dev: Background jobs such as prospecting, sending and inbox sync
• BoldSign: E-signature of managed-service agreements
• Railway: Application hosting and database

An AI assistant you choose to connect (Section 7) is not our sub-processor. You direct us to send data to it, and its provider handles that data under your own agreement with them.

We do not sell personal data to third parties. We do not use prospect data for advertising purposes.

7. Connecting Gigi to Claude and Other AI Assistants

You can connect your Gigi account to an AI assistant such as Claude through our connector (the Model Context Protocol server at usegigi.ai/api/mcp). The connection is optional and only you can create it, by signing in to Gigi and approving it on our consent screen.

• What is shared: Only the data a request from your assistant asks for, such as your campaigns, prospects' profile data, message drafts, replies, reports and credit balance. This can include personal data of your prospects.
• Who handles it: The provider of the assistant, for example Anthropic for Claude, under your agreement with them and their privacy policy. That provider decides how long your conversations are kept. We have no access to your conversations with the assistant.
• Connector platforms: If you connect through a connector platform or gateway, such as Smithery, instead of connecting your assistant to Gigi directly, that platform stores your Gigi access grant and relays the data your assistant requests, under its own terms and privacy policy. Our consent screen names the destination before you approve. Like your assistant, the platform is chosen by you and is not a sub-processor of Gigi. Customers with a Data Processing Agreement should connect directly.
• Actions: The assistant can act only through the connector's tools. Every tool that changes data or sends a message asks for your confirmation in the assistant, and messages still need your approval before they are sent, exactly as in the app.
• Your control: You can revoke a connection at any time on your Account page under Connected apps. Access also expires on its own: each access grant lasts up to 30 days and can be renewed for up to 180 days while you keep using it.

Because you control which data you ask the assistant to fetch, please consider your prospects' interests before sharing their data with an assistant, just as you would in the app.

8. Your Rights (GDPR Articles 15–22)

Both users and prospects whose data is processed have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Restriction: Restrict processing under certain conditions
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at irina@usegigi.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

9. Data Retention

• Account data: Kept while your account is active and deleted when the account is deleted
• Prospect data, conversations and AI analyses: Kept while your account is active so that your campaigns, inbox and history stay available to you. Deleted when the account is deleted, either by you from the Account page or on request to us. There is no separate time-based purge
• Export: At any time you can download a copy of your account data (profile, campaigns, prospects, messages and inbox CRM data) as JSON from the Account page
• Billing records: Kept with our payment processor for at least 5 years (or longer where required by applicable tax law), including after account deletion
• Usage logs: Retained for 12 months for security and analytics, then anonymized
• AI assistant connection records: Kept while your account is active, including after a connection is revoked, so you can see your connection history; deleted with the account
• Managed services: Where a signed Data Processing Agreement sets a different retention period, that agreement applies to the data it covers

10. Cookies

We use the following cookies:

• Strictly necessary: authentication and session management. Clearing them signs you out.
• Signup attribution (gigi_attr): set when you visit our marketing pages. It records where your first visit came from (the referring website, any campaign or referral code in the link, and the page you landed on) so that, if you sign up, we know which channel brought you. It lasts 30 days, is readable only by our servers, and is not shared with anyone.
• Analytics (Google Analytics, only with your consent): with your consent we use Google Analytics (Google Ireland Ltd / Google LLC) analytics cookies to measure visits and how the site is used. Nothing is set until you click Accept in the banner, and you can change your choice by clearing the site’s stored preference (ga_consent) in your browser.

We also count visits to our marketing pages: one count per browser tab, added to a daily total per page and per source (the referring website or the campaign code in the link). No cookie is set for this, and no IP address or identifier is stored with the count.

We do not use advertising or cross-site tracking cookies. You can clear or block cookies through your browser settings.

11. Data Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS) and at rest, access controls and role-based permissions, regular security assessments, and secure API communications with all sub-processors. While we strive to protect your data, no method of electronic storage or transmission is 100% secure.

12. International Data Transfers

MVPHub LLC is established in the United States, and several of our sub-processors (including Anthropic, OpenAI, Stripe, Postmark, Trigger.dev and Railway) process data in the United States or other countries outside the EU/EEA. We ensure appropriate safeguards for these transfers through Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, supplementary measures. Details of our transfer mechanisms are available upon request.

13. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect data from minors. If we discover that we have inadvertently collected data from a minor, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. The “Effective Date” at the top indicates the latest revision.

15. Contact Us

For privacy inquiries, data subject requests, or complaints:

Data Controller: MVPHub LLC, 1111B S Governors Ave STE 29827, Dover, DE 19904, United States

Email: irina@usegigi.ai

Supervisory Authority: Your local supervisory authority (in the EU/EEA, the authority in your member state)