1. Who we are
GZQ is operated by ARTOSX LTD, registered in England and Wales under company number 16951018. Our registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the controller of the personal information described in this notice. It covers gzq.ai, our account and company web services, and the GZQ mobile app.
For privacy questions, requests or concerns, contact hello@gzq.ai, or write to our registered office marked “GZQ privacy”.
2. Information we collect
- Browsing and technical information: IP address, request time, device/app version, platform and technical error or security information when your device connects to GZQ. Language, appearance and other local preferences are stored on your device.
- Account and sign-in: your email, display name, chosen username, verification state, authentication identifiers and sessions. Passwords are stored as cryptographic hashes. With Google or Apple sign-in, we receive the account identifier and the email/name the provider makes available with your permission; Apple may supply a private relay email. We do not receive your Google or Apple password.
- Your activity: saved items, followed brands/projects, notification and account preferences, and any comments, reports or other material you submit through an available feature. Your chosen name or username can appear alongside public contributions; your email is not a public profile field.
- Notifications: device registration tokens, your signed-in session, language, follows, selected topics and delivery status. These allow us to send the updates you choose. A notification may appear on your lock screen according to your device settings.
- Purchases and business services: product, transaction and payment references, membership status, billing/contact details and order, booking, cancellation or refund records. Apple handles iOS payment credentials; Stripe handles web company membership and advertising payments. GZQ does not store full payment card numbers or security codes.
- Company applications and support: your contact details, role, business email, company name, registration country/number, official website, verification information and correspondence. Company access and advertisements are reviewed by GZQ. Do not send account passwords, sign-in codes or card details in a support message.
- Editorial and public sources: we may obtain professional information about founders, investors and other people from official company sites, public announcements, published research and other identified sources. This is used in relevant catalogues and reporting. Contact us to raise a correction or privacy concern.
3. Purposes and legal bases
Where UK or European data protection law applies, we use the following bases:
- Providing the service you request: account creation, sign-in, synchronising Saved and follows, delivering chosen alerts, managing a subscription or company order, and responding to service requests. The basis is performing our contract with you, or taking steps you request before a contract. Without the necessary account, verification or transaction information, we cannot provide that particular feature; public browsing remains available.
- Legitimate interests: operating and securing GZQ, detecting misuse and payment fraud, diagnosing problems, administering company access, supporting users, measuring content and sponsor performance, and publishing relevant professional/editorial information. We consider these interests against the impact on individuals. Our own post-view and sponsor-event records contain an event identifier, content/campaign identifier, platform and time, rather than a user profile.
- Consent: optional advertising/device tracking where required, and optional communications or permissions that require consent. You can withdraw consent for future processing through the controls described below; withdrawal does not affect processing that was lawful before it.
- Legal obligations: necessary accounting, tax and transaction records, and responding to legally binding requests. Business contact information may also be needed to establish or defend legal claims.
We do not make decisions producing legal or similarly significant effects on you solely by automated processing. Company and advertisement approvals involve human review.
4. Who receives information
Access is limited to people and services needed for the purposes above. Current service categories include:
- Hosting: Hetzner hosts the GZQ API, database and web services in its European infrastructure. Authorised GZQ operators can access information for support, maintenance and security.
- Email: Hostinguz provides the mail service used for verification, account/security messages, company notifications and support correspondence.
- Google and Apple sign-in: the provider you select processes the sign-in request under its own privacy terms.
- Push delivery: Google Firebase Cloud Messaging and Apple Push Notification service process device identifiers/tokens and notification payloads to deliver alerts. See Firebase’s privacy information and Apple’s Privacy Policy.
- Payments: Apple processes iOS purchases, and Stripe processes web business payments and related fraud checks. They may act as independent controllers for their own payment and legal purposes. See Stripe’s Privacy Policy.
- Advertising and media: Google AdMob and its disclosed advertising partners process advertising data as described below. Opening an external link or playing a YouTube video connects you to that service and its privacy terms.
Company workspace information is accessible to its authorised members according to their roles. Public submissions, approved company content and sponsored material are visible to readers as intended. Advertisers receive campaign reporting, not your GZQ password, email or personal follow list.
We may disclose necessary information to professional advisers or authorities for legal obligations and claims, or during a properly protected business transfer. We do not give advertisers a list of GZQ account holders.
5. Advertising, cookies and choices
Free users and guests may see Google ads. Google’s mobile advertising services can process IP addresses, device and advertising identifiers, approximate location inferred from IP, app/ad interactions and diagnostic information. Depending on your choices and the applicable region, ads may be personalised, non-personalised or limited. Non-personalised advertising can still involve data processing for delivery, security and measurement. See Google’s Privacy Policy and how Google uses information from partner services.
Where required, the Google consent form is presented before requesting ads. Open Profile → Data & privacy → Advertising privacy choices to revisit the available consent controls, including without signing in. On iOS, the system tracking permission controls access to tracking where Apple requires it; you can change that permission in iOS Settings. Refusing tracking does not prevent you from browsing GZQ.
GZQ Plus removes Google advertisements while the verified entitlement is active. Clearly labelled GZQ sponsor placements remain. Our mobile app does not deliver affiliate campaigns. Sponsor views and clicks are counted for campaign measurement; following a sponsor link lets the destination process the visit.
The landing page stores whether you dismissed the app-download notice in your browser’s local storage and does not load a third-party analytics tracker. Account web services use necessary session cookies and local settings. You can clear browser storage or block cookies, but blocking required session storage can prevent sign-in. The mobile app stores preferences and secure session credentials on your device.
6. International processing
GZQ is operated by a UK company and its main application infrastructure is hosted in Europe. Email delivery, authorised operations, Google, Apple, Stripe and external media services may involve processing outside the UK or European Economic Area, including the United States and Türkiye. Privacy laws in these countries can differ from those where you live.
Applicable transfer protections depend on the recipient and service: they can include a recognised adequacy decision or contractual safeguards such as the EU Standard Contractual Clauses and the UK transfer addendum. Google describes its applicable adequacy frameworks and contractual safeguards in its data transfer information; Stripe explains its safeguards in the international-transfer section of its Privacy Policy. Contact hello@gzq.ai for information about a particular transfer or to request details of the relevant safeguards.
7. Retention and security
Retention depends on why a record is needed, whether your account or order is active, any unresolved support/security matter, and applicable record-keeping duties. An expiry for a code or download permission is not a promise that every related audit record is erased at that moment.
- Account and personal features: profile information, Saved, follows and preferences are retained while you use your account, unless you remove the item or complete account deletion. Sign-in sessions have expiry controls and may renew during active use; you can sign out to revoke a session.
- Export and deletion requests: authenticated export access lasts 24 hours. The export is produced when downloaded. Account-deletion confirmation codes last 15 minutes. Limited request and completion records may remain to document how a request was handled.
- Billing and company records: transaction, invoice and related accounting evidence is retained for legal obligations, generally at least six years from the end of the relevant company financial year, and longer where a legal requirement or unresolved claim requires it. Account deletion does not erase required financial or company records.
- Support, security and operations: we assess retention against the time needed to resolve the request or incident, prevent repeat abuse, maintain service integrity and deal with applicable claims. We minimise or de-identify personal data when identifiable records are no longer needed.
- Media and editorial records: unused uploads expire under the upload policy (currently 24 hours). Media attached to public content or a company record remains for that content’s purpose; account deletion is not a request to remove all public reporting about a company. Backup copies, where held, remain subject to access restrictions and replacement cycles rather than being used to restore a deleted personal profile for routine use.
We use HTTPS, restricted administrative access, hashed passwords and protected credentials/device tokens. No service can guarantee absolute security. Notify us promptly if you suspect misuse of your account.
8. Your rights and account deletion
You can edit your profile, remove Saved items, stop following a brand/project, change language and notification preferences, and disable notifications in device settings. Signing out disconnects that session from future eligible account push delivery.
In Profile → Data & privacy, signed-in users can request a data export or confirm account deletion with a code sent to their account email. Deletion removes sign-in credentials, sessions, personal preferences, Saved, follows and comment text, and revokes linked Sign in with Apple access. Required business, financial and editorial records can retain a non-login reference without the deleted personal profile. A company owner needs to transfer company ownership before deleting their personal account.
Deleting the app or your GZQ account does not cancel an Apple subscription. Cancel it separately in your App Store subscription settings.
Subject to the law and its exceptions, you may request access, correction, deletion, restriction, a portable copy, or withdrawal of consent. You can object to processing based on legitimate interests and to direct marketing. Email hello@gzq.ai if you cannot access the in-app tools or want to exercise another right. We may need proportionate identity verification and will respond within the applicable legal time limit.
You can complain to the UK Information Commissioner’s Office or your local data-protection authority. We would also welcome the opportunity to address your concern directly.
9. Children and updates
GZQ is not designed specifically for children. Where parental authorisation is required for a child to use a service or provide information, that authorisation is necessary. If you believe a child has provided information without the required authorisation, contact us so we can investigate and take appropriate action.
We will update this notice when our practices change. The effective date identifies this version; material changes will be communicated through an appropriate website, app or account notice. See our Terms of service for service and subscription conditions.