Privacy Policy

Information you provide. We may handle contact details, organization and role information, request or intake answers, account/profile information, messages, documents, and other information you choose to submit through an available GEM workflow.

Account and technical information. When platform features are used, systems may generate authentication, session, device, browser, network, access, audit, security, and operational records needed to operate and protect the service.

Verification information. Some approved services or applicant types may require identity, eligibility, compliance, or other verification information. GEM does not represent that every user is subject to KYC/AML, biometric, accreditation, source-of-funds, or similar checks. Any such collection must be tied to the applicable workflow, jurisdiction, configured provider, and stated purpose.

Payment information. Where a paid engagement is approved, payment and reconciliation information may be processed through the payment method or provider used for that engagement. GEM should not be assumed to store full card or bank credentials unless a specific production workflow expressly states that it does.

We use information as reasonably necessary to receive and evaluate requests, operate accounts and approved workspaces, provide contracted or requested services, communicate about a request or relationship, maintain security and audit evidence, prevent misuse, improve platform operations, and comply with applicable legal obligations.

Marketing communications are subject to the applicable communication preference, consent or other reviewed basis, suppression state, jurisdictional requirements, and unsubscribe controls. An active account or verified email address alone is not treated as marketing permission.

We may disclose information to service providers that support hosting, communications, identity or verification, analytics, payment, security, storage, or other approved platform functions when those providers are actually configured for the relevant workflow. Access should be limited to the information reasonably needed for that function and governed by the applicable provider terms and controls.

We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, investigate misuse, or support a lawful business transaction. GEM does not claim a provider, regulator, accreditation, partnership, or data-processing relationship unless that relationship is actually in place and applicable.

GEM uses technical and organizational safeguards appropriate to the production systems and providers used for a given workflow. These may include access controls, authentication controls, encrypted transport or storage provided by applicable infrastructure, audit logging, secret-management practices, and security monitoring where configured and verified.

Security controls differ by system and can change as infrastructure is updated. This policy does not make an absolute claim that every datum, endpoint, administrator, provider, or environment uses a particular protocol, cipher, PAM product, SOC/SIEM service, penetration-test cadence, or certification unless that control is separately verified and published as such.

No transmission, storage, or security control can guarantee complete security. If a reportable incident affects personal information, GEM will handle notification obligations according to the facts, applicable law, and relevant service-provider responsibilities.

We retain information for the period reasonably needed for the purpose for which it was collected, to maintain security or audit evidence, resolve disputes, enforce agreements, or meet applicable legal obligations. Retention periods can differ by record type, workflow, jurisdiction, and service-provider configuration.

GEM does not apply a universal five-, seven-, or ten-year retention period to every user or record merely because the platform can support financial, compliance, or verification-related workflows.

Depending on where you live and the law that applies, you may have rights concerning access, correction, deletion, portability, objection, restriction, or withdrawal of consent. Some requests may be limited by security, identity-verification, recordkeeping, contractual, or legal requirements.

To make a privacy request, email privacy@gemcybersecurityassist.com. GEM may need reasonable information to verify the requester and identify the records involved. Response timing follows applicable law rather than a universal public service-level guarantee.

The platform may use cookies, local storage, session mechanisms, analytics, or similar technologies that are necessary for authentication, security, preferences, measurement, or other configured functions. The exact technologies in use can vary by route and deployment.

Where optional analytics or marketing technologies are introduced, they should be used consistently with the applicable notice, consent requirements, provider configuration, and GEM governance controls.

Some service providers or infrastructure may process information in locations different from your own. Where cross-border processing is subject to specific legal requirements, the applicable safeguards depend on the provider, data flow, jurisdiction, and legal mechanism actually used for that workflow.

GEM Enterprise is designed for business and adult-user workflows and is not intended for children. If you believe a child has submitted personal information through a GEM service, contact the privacy address below so the situation can be reviewed and handled appropriately.