Privacy Policy

Who this is about

GapReveal is operated by Futuristica d.o.o., Ulica Frana Žižka 20, 2000 Maribor, Slovenia. This policy covers this website and the research runs you start on it.

There is no account, no sign-up and no payment on this site. We never ask for your name, and nothing here requires you to identify yourself.

What you give us

The topic you type, up to 500 characters. It is stored exactly as you wrote it, because it is the subject of the research and of the brief you get back.

An email address, up to 200 characters, and an optional note of up to 1,000 — but only if you choose to send a request from inside a finished brief. That is the one place on this site where you hand us a way to reach you, and it is never required to use the service.

Please do not type anything confidential into the topic box. It is stored as written, it is sent to the providers described below, and anyone you send the resulting link to can read it.

What is recorded automatically

The run itself: the topic, when it started and finished, whether it succeeded, and the material the research produced. That material is the brief you read, and it stays readable at its own address after you close the tab.

A one-way salted hash of your network connection. It has one purpose — counting your runs against the allowance — and it cannot be turned back into an address.

Your network address itself is not stored in our database. It can appear in our server log and in our hosting provider's request logs, which are kept for a limited time and used only to operate and secure the service. The security check on the run form sees it too: before a run starts, a provider acting on our behalf looks at your browser and connection to tell a person from a script, and we keep nothing from that check.

We build no profile of you and we follow you to no other site. The analytics service below sets an identifier of its own, and what it does with it is described in its own terms, not ours.

That service is Google Analytics, provided by Google, and it runs for every visitor on every page. It records the pages you open, roughly where you are from, the kind of device you use and what brought you here, and a few actions: starting a run, generating or downloading a plan, sending a request. It receives your network address as any web request does, and Google may process what it collects outside the European Economic Area, including in the United States. The page of a run is reported only as a run page: neither its address, nor its title, nor your topic is ever sent.

Who can read a brief

A finished brief lives at its own web address, and anyone who has that address can read it without signing in. There is no password on it — the address itself is long and random, and that is what keeps it private.

So treat the link as the key. If you paste it into a chat or a document, the topic you typed will usually appear in the link preview, and everyone who can see that message can open the brief.

Cookies and browser storage

The only cookies on this site are the analytics ones, and the site loads no advertising technology, no social embeds and no font from anyone else's servers. Two things do come from elsewhere. The security check on the run form loads with the page and sets no cookie on this site; whatever it keeps stays on its provider's own domain. Analytics is the other: it loads with every page, and the Cookie Policy says what it stores.

One thing is kept in your own browser: a list of the runs it started, holding each run's address, its topic and the local time you started it, capped at the 200 most recent. It is never sent to us — the list exists so closing the tab does not lose your work. You can remove entries one at a time on the history page, and clearing this site's data in your browser removes the list and the analytics cookies together.

Who else processes it, and where they are

Your topic, and the material gathered for it, is processed by a small number of third-party providers acting on our behalf: some host this site and store the runs, one checks that a run is started by a person rather than a script, others do the work of producing the research. A request you send from inside a brief is delivered to our inbox by an email provider. We describe them by the role they play rather than individually.

Nobody else, apart from the analytics service, which is named above and is not part of producing your brief. We do not sell your data and there is no data broker in this list.

Some of these providers are located outside the European Economic Area and the United Kingdom, so your topic may be processed there. Where that happens we rely on the European Commission's Standard Contractual Clauses.

Why we are allowed to do this

We process your topic to produce the brief you asked for, which is the service you came here to use. We keep runs to operate the service and to judge whether the research is getting better or worse, which is our legitimate interest in improving a product we are still building. We count runs against the allowance to keep the service available and its costs survivable, and we check that a run is started by a person for the same reason: without it, a script could use up the service for everyone. Analytics rests on our legitimate interest in knowing how the site is used — which pages people reach, where they leave and what brought them — and it is kept narrow for that reason: no advertising features, and from the page of a run nothing beyond the fact that one was opened and the actions named above. You can object to it at any time, as the Cookie Policy describes, and doing so changes nothing about the service.

If you send us an email address from inside a brief, we use it for one thing: replying to you.

How long we keep it

Runs and their topics have no automatic deletion today. The honest reason is that stored runs are what we compare against each other to tell whether the research is improving. We delete on request — see below.

An email address you send us is kept, with the request and in our mailbox, until that conversation is finished. It is deliberately kept out of our application logs.

The list in your browser lives only in your browser, for as long as you leave it there. Analytics cookies expire after two years unless you clear them sooner. The visit-level data Google Analytics collected is kept for 14 months, counted from your last visit, and then deleted; the aggregated totals in its reports are not covered by that limit.

Your rights and requests

Write to support@gapreveal.com to ask what we hold about you, to correct it, to have it deleted, to object to us keeping it, or to get a copy. Because we do not know who you are, please include the address of the run you mean, or the email address you used — it is the only way we can find the right records.

One limit worth stating: the list of runs held in your own browser is cleared by you, entry by entry on the history page or through your browser settings — we cannot reach it. Everything on our side we can delete. To object to analytics, block it in your browser or with Google's opt-out add-on, as the Cookie Policy describes; the site works the same either way.

Nothing on this site makes automated decisions about you. The research writes about a market, not about the person who asked.

If you are in the European Economic Area or the United Kingdom and you think we have handled your data badly, you can complain to your national data protection authority. We would rather you wrote to us first, but that right does not depend on us.

Changes to this policy

If this changes, the date at the top of the page changes with it. The service is still being built, so expect this page to be revised rather than frozen.