Privacy Policy
Last updated: October 27, 2026
This policy explains which personal data Gatebase collects, why, how long it is kept, who processes it and what rights you have. It covers the website (gatebase.dev), the documentation, the dashboard (app.gatebase.dev) and the API addresses Gatebase serves for its customers' projects.
Who is responsible
The controller of the data described in this policy is EI VIGNERES TOM, an individual entrepreneur registered in France under SIREN 904 063 146 ("we", "us"). For any question about your data or to exercise your rights, write to contact@gatebase.dev.
Two roles
- Your Gatebase account. For the data about you as a Gatebase user (your account, your team, your billing), we are the controller. The sections below describe that data.
- The APIs our customers publish. When a Gatebase customer publishes an API, the data its consumers send and the data its Bubble application returns pass through Gatebase. For that data, the customer is the controller and we are its processor, under the data processing terms in section 10 of the Terms of Service. If you are a user of an application built with Gatebase, contact that application's publisher to exercise your rights.
Data we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your email address and name. If you sign in with Bubble: your Bubble account identifier, and an access token (stored encrypted) that lets us list your Bubble apps and, only if you import an option set from Bubble, read your app's structure (never its data). | To create your account, sign you in, offer your Bubble apps when you create a project, import option sets you choose and send you the emails the service needs (sign-in codes, invitations, important notices). | Performance of the contract (the Terms of Service) |
| Sign-in sessions: the IP address and the browser's user agent at sign-in. | To keep you signed in and protect your account against abuse. | Performance of the contract; our legitimate interest in securing accounts |
| Team: the email addresses you invite to a project, and each member's role. | To send invitations and control who can do what in a project. | Performance of the contract |
| Project configuration: your Bubble application's address, its admin API token (stored encrypted), routes, versions, tenants, custom domains. API keys, management tokens and OAuth tokens are stored only as irreversible hashes. | To run the service. | Performance of the contract |
| Billing: your Stripe customer and subscription identifiers, and request counts per project and per hour. Your payment details are collected and kept by Stripe, never by us. | To enforce quotas, bill usage and keep accounting records. | Performance of the contract; legal obligation (accounting) |
| Request logs of your projects: date, route, status, duration, the parameters received, the input sent to Bubble, Bubble's response and the response sent to the caller, and request headers. Client IP addresses, credentials, tokens and secrets are removed or masked before storage. | To show you your project's activity and help you debug routes. | Performance of the contract (we act as your processor for data about your API's users) |
| IP addresses of incoming requests, held in memory for a few minutes. | To apply rate limits and block repeated failed authentication attempts. | Our legitimate interest in protecting the service |
We do not sell your data, use it for advertising, or build marketing profiles. The website and documentation use no analytics or tracking tools.
How long we keep it
- Account data: while your account exists. To delete your account, write to contact@gatebase.dev; we delete it within 30 days.
- Sign-in codes: 10 minutes, stored only as a hash. Invitations: 7 days, or until accepted or revoked.
- Request logs: 7 days, then deleted automatically. Idempotency records: 24 hours. Hourly usage counts: 90 days.
- Project configuration: until you delete the project. A deleted project stops serving requests at once; its data is deleted once its last usage has been billed.
- Invoices and accounting records: 10 years, as French accounting law requires. Stripe keeps them on our behalf.
Who processes the data
We use the following providers to run Gatebase. Each processes data only on our instructions and under a data processing agreement.
| Provider | What it does | Location |
|---|---|---|
| Cloudflare, Inc. | Hosts the website, the dashboard and the API runtime. Stores the published API configuration and each project's runtime data (API keys as hashes, OAuth grants, usage counts, logs waiting to be delivered). | Global network; project runtimes run in western North America |
| Convex, Inc. | Database for accounts, sign-in sessions, teams and project configuration. | United States |
| Tinybird, Inc. | Stores request logs for 7 days and computes the Activity charts. | United States (AWS us-west-2) |
| Stripe, Inc. and its affiliates | Subscriptions, usage-based billing, payments and invoices. | United States and European Union |
| Resend, Inc. | Sends sign-in codes and invitations by email. | United States |
| Google LLC | The documentation pages load their fonts from Google Fonts, which receives your IP address. | United States |
Bubble is not one of our providers: Gatebase sends requests to the Bubble application that a customer connects, on that customer's instructions. When you choose to sign in with Bubble, Bubble Group, Inc. confirms your identity and lets Gatebase see the list of your apps, under Bubble's own privacy policy.
Some of these providers are in the United States. Those transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework when the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
Cookies and local storage
The website and the documentation set no cookies. The dashboard uses only what it needs to work, so it does not ask for consent:
- a session cookie that keeps you signed in, set when you sign in and removed when you sign out or the session expires;
- when you approve an AI agent's access to a project, a security cookie that protects the approval form, deleted after 10 minutes;
- your browser's local storage, for interface preferences such as the theme and panel sizes. This data never leaves your browser.
Security
All traffic is encrypted with HTTPS. Your Bubble admin token and your Bubble sign-in token are encrypted at rest. API keys, management tokens, OAuth tokens and sign-in codes are stored only as hashes. Access to a project is checked on every request according to each member's role.
Your rights
Under the GDPR, you can ask to access your data, correct it, delete it, receive it in a portable format, restrict its use, or object to a use based on our legitimate interest. Write to contact@gatebase.dev; we answer within one month. You can correct your name in the dashboard at any time.
If you think we do not respect your rights, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of the EU country where you live.
Changes
We update this policy when the service or its providers change. The date at the top shows the last update. We email you before a change that affects how your data is used.