Privacy Policy

1. Data controller

BlackYack SUARL, RNE 1730839M, Avenue Hédi Nouira, 5000 Monastir, Tunisia. Contact: hello@gamra.dev.

We process personal data in accordance with Tunisian Organic Law No. 2004-63 on the protection of personal data and, where it applies, the General Data Protection Regulation (GDPR).

2. Data we collect

• Account — name, email address, authentication identifiers.
• Billing — tier, top-up and transaction history, amounts in millimes. Card data is handled by our payment providers — we do not store it.
• Usage and metering — requests made, model used, token counts, cost in millimes, timestamps.
• Content — the code, prompts and files you submit for processing by the Models.
• Technical data — IP address, device and browser type, access and error logs.
• Waitlist — the email address you provide to be notified at launch.
• Advertising measurement — advertising cookie identifiers and signups attributed to an ad, only if you accept advertising cookies (see section 11).

3. How we use your data

• Provide, operate and secure the Service, including routing your requests to the Models.
• Meter usage, manage your Wallet, and process payments.
• Provide support, communicate about the Service, and respond to your requests.
• Prevent fraud, abuse and security incidents, and comply with our legal obligations.
• Improve the Service using aggregated or anonymised statistics.

4. Legal bases

Depending on the case, we process your data on the basis of: performance of the contract (providing the Service); your consent (for example the waitlist, or the advertising cookies described in section 11, which you may withdraw at any time); our legitimate interests (security, fraud prevention, improving the Service); and compliance with a legal obligation.

5. AI processing of your code and prompts

When you invoke a Model, your prompt and the associated Content (which may include excerpts of your code) are transmitted to the relevant Model provider to generate a response. This processing is necessary to provide the Service.

• We do not use your Content to train models, and we contractually require our Model providers not to use it for that purpose where that option is available.
• Content is transmitted for as long as needed to process the request. We retain metering metadata (without prompt content) for billing and security.
• You control what you send: do not include secrets or sensitive data that a request does not need.

6. Sharing and subprocessors

We do not sell your personal data. We share it with providers (subprocessors) acting on our behalf, including:

• Payment provider — ClicToPay / Société Monétique Tunisie and our acquiring bank BIAT, to process card payments.
• AI Model providers — to run your requests against the Models you choose.
• Hosting and infrastructure — to host the Service and its databases.
• Email — to send transactional and waitlist emails.
• Advertising and measurement — Google Ireland Limited and Google LLC (Google Ads), and Meta Platforms Ireland Limited (Facebook, Instagram), to measure how our campaigns perform. This sharing happens only if you accept advertising cookies, and each of these providers processes some of this data for its own purposes (see section 11).

We may also disclose data where required by law or to protect our rights, safety and those of our users.

7. International transfers

Some of our providers (Model providers, hosting, payments, advertising measurement) are located outside Tunisia. Your data may therefore be transferred and processed abroad. Where such transfers occur, we take reasonable steps to ensure they are subject to appropriate safeguards under applicable law.

8. Retention

We keep account and metering data for as long as your account is active, then for as long as needed to meet our legal, accounting and tax obligations or to resolve disputes. Waitlist emails are kept until you unsubscribe or they are no longer needed.

Chat conversations. These are kept until you delete them: any conversation can be deleted from the dashboard, and deletion is permanent. You can also ask us to delete all of them by writing to hello@gamra.dev. We do not use them to train AI models.

9. Security

We implement reasonable technical and organisational measures to protect your data (encryption in transit, access control, logging). No system is perfectly secure, so we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you have rights of access, rectification, erasure, restriction and objection to processing, as well as the right to portability and the right to withdraw consent at any time.

To exercise these rights, write to hello@gamra.dev. We respond within the timeframes required by law. You may also lodge a complaint with the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) in Tunisia.

11. Cookies and advertising measurement

Strictly necessary cookies. The site and dashboard use cookies they cannot work without: authentication, security, preferences, and load balancing (ARRAffinity and ARRAffinitySameSite, set by our host and cleared when you close the browser). These do not require your consent, because the Service cannot function without them.

Advertising cookies. We use two advertising measurement tools to understand which ads lead to a signup: Google Ads, provided by Google Ireland Limited and Google LLC, and the Meta Pixel, provided by Meta Platforms Ireland Limited (Facebook, Instagram). These cookies are set only after you agree, via the banner shown on your first visit:

• _gcl_au — set by Google on the gamra.dev domain; attributes a signup to the ad that preceded it. Lifetime: 90 days.
• IDE — set on the doubleclick.net domain by Google; advertising measurement and targeting. Lifetime: 13 months.
• _fbp — set by the Meta Pixel on the gamra.dev domain; identifies your browser so a signup can be attributed to a Facebook or Instagram ad. Lifetime: 90 days.
• _fbc — set by the Meta Pixel on the gamra.dev domain, only if you arrive from a Meta ad; stores that ad's click identifier. Lifetime: 90 days.
• fr — set on the facebook.com domain by Meta; advertising measurement and targeting. Lifetime: 90 days.

The two tools handle a refusal differently, and we would rather say so plainly. Until you accept, Google's Consent Mode v2 is set to “denied” for ad storage, ad user data and personalisation: no advertising cookie is set, your IP address is redacted, and only aggregated, identifier-free measurement is sent. The Meta Pixel offers no equivalent setting, so we do not load it at all: no request is made to Meta and no Meta cookie is set until you accept. If you decline, both behaviours stay in place.

Withdrawing your consent. Clear the cookies and site data for gamra.dev in your browser settings: the banner will reappear on your next visit and you can decline. Google's own processing is described in its privacy policy (policies.google.com/privacy) and in “How Google uses information from sites or apps that use our services” (policies.google.com/technologies/partner-sites). Meta's is described in its privacy policy (facebook.com/privacy/policy) and its cookie policy (facebook.com/policies/cookies).

12. Children

The Service is not directed to anyone under 18, and we do not knowingly collect their data.

13. Changes

We may update this Policy. For material changes we will notify you by a reasonable means. The last-updated date appears at the top of this document.

14. Contact

Privacy questions or complaints: hello@gamra.dev — BlackYack SUARL, Avenue Hédi Nouira, 5000 Monastir, Tunisia.