This Privacy Policy (“Policy”) explains how Gambix LLC (“Gambix,” “we,” “us,” or “our”) collects, uses, discloses, and protects Personal Information when you: (a) visit or interact with Gambix.io and related pages that link to this Policy (the “Site”); (b) communicate with us; (c) receive our marketing; (d) participate in webinars/events; or (e) use our services, including digital marketing, analytics, conversion optimization, advertising operations, creative, and AI-assisted marketing services (the “Services”).
If you do not agree with this Policy, do not use the Site or Services.
Policy Scope
- 1.1 Controller vs. Processor. This Policy applies where Gambix acts as a controller for Site visitors, leads, partners, and business contacts. When we process Personal Information on behalf of a client in providing Services (for example, customer lists, lead data, event tracking, ad platform data, CRM records, or campaign analytics), we typically act as a processor (or “service provider” under certain U.S. laws). In those cases, the client controls the data and their privacy policy and instructions apply. You should direct requests about client-controlled data to the client.
- 1.2 Business-to-business context. The Site and Services are intended for business and professional users. We do not offer consumer-only Services, though we may process consumer data provided to us by clients.
- 1.3 Separate agreements. If you sign a Master Services Agreement, Statement of Work, Order Form, or Data Processing Addendum (each, a “Service Agreement”), that agreement may add to or override certain terms for the Services.
Definitions
- 2.1 “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable individual.
- 2.2 “Client Data” means Personal Information and other data a client (or its users/customers) provides to us, or that we process on the client’s behalf, in connection with Services.
- 2.3 “Usage Data” means device, log, and analytics data collected automatically when you use the Site or Services.
- 2.4 “Third-Party Platforms” means external platforms used in marketing operations, such as ad networks, analytics providers, CRMs, email providers, automation tools, and social platforms.
Personal Information You Provide
Personal Information You Provide
We may collect Personal Information you submit directly, including:
- 3.1 Contact and identity info. Name, business email, phone number, company name, job title, and business address.
- 3.2 Sales and onboarding info. Meeting notes, service requirements, campaign goals, creative preferences, budget ranges, and communications.
- 3.3 Billing and contract info. Invoice details, tax information, payment status, and transaction references. Payments are processed through Stripe; we do not store full payment card numbers on our servers if processed by Stripe.
- 3.4 Content you provide. Messages, files, briefs, brand assets, creative inputs, feedback, and support requests.
- 3.5 Event and webinar info. Registration details and attendance/engagement signals.
- 3.6 Client Data. If you are a client, you (or your end users) may provide Client Data such as lead lists, CRM records, website events, call tracking data, and customer segmentation data. Categories depend on what you choose to connect and share.
Personal Information Automatically Collected
- 4.1 Device and connection data. IP address, browser type, device identifiers, operating system, language, and approximate location (derived from IP).
- 4.2 Log and usage data. Pages viewed, time spent, referring URLs, clickstream, and feature usage.
- 4.3 Cookies and similar technologies. Identifiers and activity info collected via cookies, pixels, tags, SDKs, and similar technologies (see Section 9).
Personal Information We Collect From Other Sources
- 5.1 Third-Party Platforms you connect or authorize. If you connect marketing tools (ad accounts, analytics, CRM), we may receive data from those tools to provide Services.
- 5.2 Partners and referrals. Contact details from partners, event co-hosts, or referrers.
- 5.3 Public/professional sources. Professional networking sites and public business directories (to the extent permitted by law).
Why We Process Personal Information
- 6.1 Provide and operate the Site and Services. Account management, onboarding, support, deliverables, project operations, and client communications.
- 6.2 Marketing operations and performance work. Campaign setup and optimization, conversion tracking, landing page testing, attribution, reporting, audience analysis, and creative iteration.
- 6.3 Analytics and improvement. Improve Site performance, improve Services, troubleshoot issues, and develop new features or offerings.
- 6.4 Security and fraud prevention. Detect and prevent abuse, unauthorized access, and suspicious activity.
- 6.5 Communications. Send service notices, security updates, administrative messages, and (where allowed) marketing communications with opt-out options.
- 6.6 Legal and compliance. Contract enforcement, audits, tax, and responding to lawful requests.
- 6.7 Aggregated or de-identified insights (industry-standard approach). Where permitted by law and contract, we may create aggregated and/or de-identified information from Personal Information and Client Data (for example: overall trend reporting, performance benchmarks across many clients, service usage analytics, and quality improvement). We will take reasonable steps to ensure aggregated/de-identified information does not identify you, your customers, or your business.
Important limits:
- (a) we do not publish client-specific benchmarks that identify a client without permission;
- (b) we do not include Client Confidential Information in public materials; and
- (c) clients may restrict or opt out of external benchmarking in the applicable Service Agreement.
Legal Bases (EEA/UK GDPR)
If you are in the EEA/UK (or where similar laws apply), we rely on the following legal bases as appropriate:
- 7.1 Contract necessity. To perform a contract or take steps at your request before entering a contract.
- 7.2 Legitimate interests. To operate, secure, improve, and market our business (balanced against your rights).
- 7.3 Consent. For certain cookies/tracking and where required for marketing.
- 7.4 Legal obligation. To comply with legal requirements.
How We Share Personal Information
We may disclose Personal Information to:
- 8.1 Service providers and contractors (subprocessors). We use vendors that support the Site and Services. Depending on scope, these may include providers in the following categories:
- Payment processing: Stripe
- Website hosting, storage, and infrastructure (hosting, file storage, backups, logging)
- Analytics and tag management (traffic analytics, performance monitoring)
- Client relationship tools (CRM, email delivery, scheduling, form builders)
- Advertising and marketing platforms (ad networks, conversion tracking, audience management)
- Automation and integrations (workflow automation, webhooks, connectors)
- Communications and collaboration (email, chat, video conferencing, document collaboration)
- Security (spam prevention, fraud detection, access management)
- Professional advisors (legal, accounting, compliance)
- 8.2 Third-Party Platforms (marketing integrations). When you authorize or request us to manage campaigns, we may share data with ad platforms and marketing tools (for example, configuring conversion tracking, uploading audiences you provide, or syncing CRM events), as necessary to provide Services and consistent with your instructions.
- 8.3 Legal, safety, and enforcement. To comply with law, protect rights, investigate fraud/security issues, or enforce agreements.
- 8.4 Business transfers. In connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets (subject to appropriate safeguards).
- 8.5 With your direction or consent. When you instruct us to share, or otherwise consent.
Cookies, Analytics, and Tracking
- 9.1 What we use. We and our service providers may use cookies and similar technologies for: (a) essential site functions; (b) preferences; (c) analytics; and (d) advertising/retargeting where enabled.
- 9.2 Cookie controls. You can control cookies via browser settings. Where consent is required (for example, in certain EEA/UK contexts), we use a cookie banner and consent preference center through a cookie consent management platform (CMP) to collect and manage cookie choices.
- 9.3 Analytics providers. We may use analytics and measurement tools to understand usage and improve the Site and Services, such as Google Analytics 4 (GA4), Google Tag Manager, Google Search Console, and similar tools. If we run advertising/retargeting, we may also use platform measurement tags (for example, Meta Pixel, LinkedIn Insight Tag, Google Ads conversion tags) to measure campaign performance.
- 9.4 Do Not Track signals. The Site does not respond to “Do Not Track” browser signals.
AI and Automated Processing
- 10.1 AI-assisted services. We may use AI tools to help generate, summarize, classify, optimize, or recommend marketing outputs (for example: ad copy variations, SEO briefs, CRO hypotheses, creative directions, reporting narratives). AI outputs may be inaccurate or incomplete and require human review.
- 10.2 Client Data and AI tools (our operating approach). Client Data may be processed through AI systems only as needed to provide Services and consistent with your instructions and the Service Agreement. Our approach is designed to minimize risk and misuse and typically includes:
- Data minimization: Only using the minimum Client Data needed for a specific task.
- Access controls: Limiting Client Data and prompts to authorized personnel under least-privilege access.
- Segregation: Keeping client work separated by project/workspace where feasible.
- Human review: Reviewing AI outputs before delivery or implementation when practical (especially for claims, compliance-sensitive copy, and audience targeting).
- Sensitive data restrictions: Avoiding use of sensitive personal data (or special category data) in AI tools unless strictly necessary and explicitly authorized in writing.
- Client controls: Honoring client instructions on what data may be processed, stored, or shared with any AI vendor.
- 10.3 Training and model improvement (OPT-IN ONLY). We may use certain data for AI training or model improvement only with your explicit opt-in (for example, via a signed Service Agreement addendum or written authorization). If you do not opt in, we will not use your Client Data or Confidential Information for training.
- 10.4 Automated decision-making and profiling. We and our Third-Party Platforms may use automated processing (including profiling) as part of digital marketing delivery (for example, ad delivery, bidding, audience selection, and conversion optimization). These activities are typically used to optimize marketing performance and measurement. Where applicable law provides rights related to profiling or automated decision-making, you may contact us to request information or exercise applicable rights as described in Section 14.
Security & Confidentiality
- 11.1 Security measures. We use administrative, technical, and physical safeguards designed to protect Personal Information, including access controls, least-privilege practices, encryption in transit (yes), monitoring, backups, and vendor security reviews.
- 11.2 No method is 100% secure. Despite safeguards, no system can be guaranteed fully secure.
- 11.3 Confidential Information. Client confidential information is handled under the applicable Service Agreement and/or NDA, if applicable.
Retention
- 12.1 Retention periods. We retain Personal Information only as long as necessary for the purposes in this Policy, unless a longer period is required or permitted by law.
-
12.2 Retention timeframes.
Sales/lead records: 5 years
Client project records: 5 years
Billing/tax records: 5 years
Analytics logs: 5 years
Support tickets: 5 years - 12.3 Client Data after termination (industry standard). Upon Service termination, we will, upon request and where feasible, provide a reasonable export of Client Data in our possession within 30 days. We will delete or de-identify remaining Client Data from our active systems within 60 daysafter termination, unless we are legally required to retain it or it is needed to resolve disputes or enforce agreements.
- Backups: Client Data may remain in encrypted backups for a limited period (typically up to 180 days) until backups rotate/overwrite, after which it is removed in the normal course. We may retain billing, tax, and compliance records for the retention periods above. Aggregated or de-identified information may be retained.
International Transfers
If Personal Information is transferred across borders, we use appropriate safeguards as required by law (for example, contractual protections and vendor controls).14. Your Privacy Rights and Choices
Your Privacy Rights and Choices
- 14.1 Marketing opt-out. You can opt out of marketing emails by using the “unsubscribe” link or contacting us at info@gambix.io. You may still receive non-marketing service messages.
- 14.2 EEA/UK rights. Depending on law, you may have rights to access, correction, deletion, restriction, objection, portability, and to withdraw consent (without affecting prior processing). You may lodge a complaint with your supervisory authority.
- 14.3 Verification. We may verify your identity before responding.
- 14.4 Processor requests. If we process your info on behalf of a client, direct requests to the client (controller). We will assist the client as required by contract/law.
Notice to California Residents
This section applies only to the extent California law applies.
- 15.1 Categories collected (past 12 months). We may collect: identifiers (name, email, IP), customer records (billing/contact), commercial info (services purchased), internet/network activity (usage/cookies), approximate geolocation (IP-based), professional info (job title/company), and inferences (engagement preferences).
- 15.2 Purposes. Providing services, operating the site, analytics, security, marketing, and compliance.
- 15.3 Disclosures. We may disclose these categories to service providers and vendors for business purposes.
- 15.4 “Sell” or “Share.” We do not sell Personal Information in exchange for money. If we use certain advertising cookies/pixels, some data sharing may be considered “sharing” for cross-context behavioral advertising under California law. If applicable, we will provide a “Do Not Sell or Share My Personal Information” mechanism as required.
- 15.5 California rights. Subject to exceptions, you may have rights to know/access, delete, correct, opt out of sale/sharing, limit use of sensitive PI (if applicable), and not be discriminated against.
- 15.6 How to exercise. Submit requests via info@gambix.io with the subject line: “Privacy Request”.
Other U.S. State Privacy Disclosures
- Other U.S. State Privacy Disclosures If state privacy laws apply (for example CO/CT/UT/VA and others), you may have additional rights related to targeted advertising, profiling, and appeals. You can contact us at info@gambix.io to exercise applicable rights.
Children’s Personal Information
- The Site and Services are not directed to children under 13, and we do not knowingly collect Personal Information from children under 13.
Third-Party Links and Services
- The Site may link to third-party sites or tools. Their privacy practices are governed by their own policies.
Changes to This Policy
- We may update this Policy from time to time. We will update the “Last Updated” date and may provide additional notice if required by law.
Contact Us
Gambix LLCWyoming Address: 32 N Gould St., Sheridan, WY 82801Maryland Address: 5000 Thayer Center, Oakland, MD 21550Email: info@gambix.io
