Privacy Policy

1.Who Operates GearDex

The controller for GearDex account data is:

When you store your own clients in GearDex, you are the controller for that client information and GearDex is your processor. That split is described under Your Clients' Data.

2.Information We Collect

We collect the following types of information:

• Account information: name, email address, and authentication data provided via Supabase.
• Inventory data: cameras, lenses, accessories, filters, drones, maintenance records, loans, categories, photos, and files you upload. This includes serial numbers, purchase dates, purchase prices, recorded values, condition, storage location, notes, and receipts, warranties, or other documents you attach.
• Billing information: billing-related data (such as subscription status, Stripe customer IDs, and non-card metadata) processed via Stripe. We do not store full card numbers or CVV; those are handled directly by Stripe.
• Your clients' information: if you use GearDex's business features, the details of your own clients that you enter or that they send you (see Your Clients' Data).
• Usage data: log and analytics data about how you use the Service—pages viewed, actions taken, and device/browser information.

3.How We Use Your Information

We use your information to:

• Provide, operate, and improve the Service.
• Manage subscriptions, billing, and payments via Stripe.
• Authenticate you and secure your account via Supabase.
• Send service-related emails, such as login links, security alerts, and subscription or billing notices.
• Respond to support requests and communicate about updates to the Service.

4.Service Providers & Data Processors

We rely on these providers. Each one is established in the United States:

• Supabase for the database, authentication, and file storage (photos, receipts, and other documents).
• Stripe for subscription billing. Stripe handles card numbers. GearDex stores the customer ID and subscription status, and does not store the full card number or CVV.
• Resend for transactional email, emails you send to your clients, and receiving your clients' replies so they appear in your conversations.
• Vercel for application hosting.
• PostHog for product analytics, including the anonymous page view counts and the iPhone and Android app analytics described in Cookies & Analytics below. GearDex uses PostHog's US cloud.
• Google Analytics for traffic analytics, only after you accept analytics cookies.
• NVIDIA for the models behind Iris, Smart Add, AI descriptions, receipt reading, and paid-plan suggestions. What is sent, and when, is in AI Features, Receipts, Serial Numbers, and Values.
• Tavily for web search in Iris, Find Image, and price lookups. The search query is sent, such as a gear model name or the question you asked.
• Google for Google Calendar, only if you connect it. See Google Calendar.
• Google reCAPTCHA to keep spam out of the contact form. It loads only on the Contact page and receives your IP address and information about your browser and how you use the page, under Google's Privacy Policy and Terms of Service.

These providers process data to deliver their service to GearDex. Where your own clients are involved, GearDex remains your processor and these companies are sub-processors.

5.Where Data Is Stored and International Transfers

GearDex is operated from the United States. Account data, inventory, photos, receipts, and other files are stored in the United States by Supabase. That is true for every account, including people in the European Union, the EEA, the United Kingdom, and Switzerland. Using GearDex transfers that personal data to the United States.

The same United States transfer applies when a provider above is involved:

• Supabase stores the account, the inventory, and uploaded files. Connections use TLS. Supabase encrypts database data and stored files at rest with AES-256.
• Vercel hosts the application. A page may be served from a location closer to the visitor. The account record stays in Supabase.
• Stripe processes paid-plan billing.
• Resend sends and receives email.
• PostHog receives analytics, as described under Cookies & Analytics. On the website, fuller analytics run only if you accept them. The phone apps send usage analytics unless you turn them off.
• Google Analytics runs only if you accept analytics cookies.
• NVIDIA receives an AI request only in the cases in the next section.
• Tavily receives a search query when you use web search inside Iris, Find Image, or a price lookup.
• Google receives calendar data only if you connect Google Calendar.
• Google reCAPTCHA receives browser and usage information when you open the Contact page.

The European Commission does not treat every recipient in the United States as providing an adequate level of protection. Transfers from the EU, EEA, UK, and Switzerland rely on the safeguards in each provider's data processing terms, including the European Commission's Standard Contractual Clauses. Some of these providers also participate in the EU-US Data Privacy Framework.

The legal bases we rely on are:

• Contract: creating and running your account, storing the inventory you enter, and carrying out an AI or search request you start.
• Legal obligation: keeping limited billing records.
• Legitimate interests: securing the service, preventing abuse, counting anonymous page views, and measuring how the phone apps are used. Those interests are running a reliable product. They are not advertising.
• Consent: analytics cookies, and optional connections such as Google Calendar. The iPhone and Android apps also ask before Iris first sends anything to NVIDIA.

If you use GearDex to store your own clients, we will provide a data processing agreement on request. Email geardex.help@gmail.com for that agreement, or for a copy of the transfer safeguards that apply to your account.

6.AI Features, Receipts, Serial Numbers, and Values

Serial numbers, purchase prices, recorded values, and receipt files are inventory data. They are stored in your account in the United States. You can see them, and so can people you invite into a Studio when their role includes that inventory. They are included when you export the account, and they are removed immediately and permanently when you delete the account. Our payment provider, Stripe, keeps its own records of your payments for tax and accounting. GearDex staff do not read them unless you ask for help, access is needed to secure the service, or the law requires it. We do not sell this information, and we do not use it for advertising.

GearDex does not train its own models on your inventory. AI features send a request to NVIDIA in the United States only in these cases:

• Iris chat. Your message goes to NVIDIA with the inventory context used to answer it. That context can include brand, model, serial number, purchase price, purchase date, condition, storage location, and notes for the items included in the request, plus the total of recorded purchase prices. A large library is capped in that first context. Iris reads further records only when the question needs them.
• Smart Add and AI descriptions. The text or photo you submit is sent, along with the gear fields needed to draft the result. You review the draft before anything is saved.
• Receipt reading. When you upload a receipt, invoice, or warranty for Iris to read, that file is sent to NVIDIA as text or as an image of the page, so it can extract the merchant, date, price, and any serial number printed on the document. Matching the result to an item you already own happens on GearDex servers. The serial numbers already in your inventory are not sent to NVIDIA for that match.
• Iris suggestions on Pro and Studio. A scheduled job prepares suggestions from brand, model, specifications, condition, and purchase price. Serial numbers and photos are left out of that job. Starter does not run it.

You can keep a full inventory and never open Iris. On Starter, that inventory is not sent to NVIDIA unless you start an AI feature. On Pro and Studio, the suggestion job above still sends brand, model, condition, and purchase price on its schedule.

NVIDIA's API terms say NVIDIA does not keep the content of a request after that request ends, except for logs it uses to watch for security problems, fraud, and abuse. Those terms also say NVIDIA may use the content, without tying it to a named person, to improve NVIDIA products and services, including its AI models. GearDex does not control that use.

Web lookups inside Iris, Find Image, and price checks go to Tavily. Tavily receives the search query, such as a model name. It does not receive your receipt file or your serial-number list.

7.Cookies & Analytics

Anonymous page views (always on). To see where visitors come from, we count page views without cookies: the page you visit, the site that referred you, and campaign tags in the link (such as utm_source). Nothing is stored on your device and no identifier follows you between visits. PostHog counts unique visitors with a hash of your IP address and browser that changes every day, and does not keep the IP address.

Full analytics (only if you accept). If you choose Accept All, PostHog uses cookies and local storage to measure how the Service is used across visits, including feature usage, errors, and session replays with text and form inputs masked, and Google Analytics measures traffic. If you sign in, this analytics is linked to your account.

If you choose Reject All, or until you choose, analytics stays anonymous: we only count page views as described above, and no analytics cookies or storage are set. Your choice is saved on this device for 12 months. To change it sooner, clear this site's data in your browser and the cookie banner will ask again.

Necessary storage. We store your sign-in session and your cookie choice on your device so the Service works and remembers your preference. We also keep a few working values there: your date and number format (a cookie, kept for a year, so dates read the same on every page), and short-lived notes that let a sign-up or a plan checkout pick up where it left off.

Mobile apps. The GearDex apps for iPhone and Android send product analytics to PostHog's US cloud through our own relay at relay.geardex.app: your account ID, a random ID for the install, the app version and type of device, and which screens and steps you use. PostHog's location lookup (GeoIP) is turned off. Nothing is used for advertising, nothing is shared with ad networks, and nothing tracks you across other companies' apps or websites. To turn analytics off, open Settings → Data & privacy → Share usage analytics in the app.

The apps also store your sign-in session and a copy of your GearDex data on your device so the app opens quickly and works with a weak connection. Before Iris first sends anything to NVIDIA, the app asks for your permission.

8.Google Calendar

If you connect Google Calendar, we ask Google for three permissions and use them only to run your bookings:

• See your list of calendars, so you can choose which ones count as busy and which one receives bookings.
• See when you're busy or free on the calendars you choose, so clients can't book over your existing commitments. We never read event titles, descriptions, locations, or attendees.
• Create, change, and delete events on calendars you own, which we use only to add your bookings, move them when they're rescheduled, and remove them when they're canceled. We don't change events we didn't create.

We store your Google account email, the permissions you granted, the calendars you chose, busy time ranges, and the IDs of the events we create. Your Google tokens are encrypted at rest. We don't sell Google user data, share it with anyone other than the service providers above, use it for advertising, or use it to train AI models. People at GearDex don't read it unless you ask us to while helping you, it's needed for security, or the law requires it.

You can disconnect Google Calendar at any time from Scheduling. Disconnecting revokes our access and deletes your stored tokens and busy times. You can also remove GearDex's access from your Google Account settings.

GearDex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9.Your Clients' Data

When you use GearDex's business features (Clients, Pipeline, Scheduling, Money and your Site), GearDex processes information about your clients on your behalf:

• Contact details: names, email addresses, phone numbers, companies and notes you add.
• Inquiries and messages: what clients send through your Site, the emails you send them from GearDex, and their replies. Replies to those emails are received by our email provider at a reply address unique to the conversation and added to that conversation.
• Bookings: sessions they book, times, locations and answers to your booking questions.
• Documents and signatures: quotes, contracts and invoices you send them, and when a client signs a contract electronically, an audit record of their typed name, email, IP address, device, the time of signing, the consent they gave, and a fingerprint of the exact text they signed.

For this information you are the controller and GearDex is your processor: we use it only to provide these features to you, never to market to your clients or for advertising, and we don't sell it. If one of your clients contacts us to see, correct or delete their information, we'll refer them to you; you can export or delete it from your Clients records, and we'll help when you ask. Client data is kept while your account holds it and is deleted immediately along with your account.

10.Data Retention

We retain your account and inventory data for as long as your account is active and as needed to provide the Service.

When you delete your account, your account, inventory, files, Site, and client data are deleted from GearDex immediately and permanently. They cannot be recovered. Our payment provider, Stripe, keeps its own records of your payments for tax and accounting.

11.Your Rights & Choices

Within the app, you can:

• View and update your profile information.
• Export your data from the Settings → Data & Privacy section.
• Delete your account and associated data. How to delete your account covers the web and the phone apps.

If you are in the European Union, the EEA, the United Kingdom, or Switzerland, you can also ask us to access the personal data we hold about you, correct it, delete it, restrict it, or object to processing based on legitimate interests. You can ask for a portable copy, which is the same export. You can withdraw consent for analytics cookies, turn off usage analytics in the phone apps, or disconnect an optional connection such as Google Calendar. Withdrawal does not affect processing that already happened. You can lodge a complaint with your local data protection authority. Write to us first if you want us to fix something.

For anything you cannot do in the app, email geardex.help@gmail.com.

12.California Privacy Notice

If you are a resident of California, you have certain rights under California law (including the California Online Privacy Protection Act and, where applicable, the California Consumer Privacy Act). While GearDex is a small business and may not meet all statutory thresholds, we aim to honor reasonable requests to:

• Access the personal information we hold about you.
• Request correction or deletion of your personal information.
• Opt out of any sale of personal information (we do not sell your personal data).

You can exercise these rights by contacting us, and we will respond in a reasonable timeframe.

Do Not Track: Your browser may send "Do Not Track" signals. We currently do not respond to these signals but limit tracking to what is necessary to operate and secure the Service.

13.Security

We use reasonable technical and organizational measures to protect your information, including TLS encryption in transit, AES-256 encryption at rest for the database and stored files, and access controls on our database and infrastructure. Each account's inventory is separated so one customer cannot read another customer's rows.

However, no online service can be 100% secure, and you are responsible for keeping your login credentials safe.

14.Children's Privacy

GearDex is intended for use by adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can remove it.

15.Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we may also notify you via email or in-app notifications.

16.Contact Us

Questions about this policy, a transfer, or your data go to:

The same address is published on the Legal Notice.