Privacy Policy

When you apply: your name, email address, mobile number, home city, social media handles (Instagram, TikTok), an optional portfolio link, your password (stored hashed by our authentication provider, never readable by us), the terms version you agreed to and when, which advert or link brought you to us (UTM parameters), and which of our sites your application came through. Alongside your consent record we keep a hashed (anonymised) form of your IP address and your browser's user agent. Automatically: technical data needed to run and protect the site, including the bot-protection signals described in section 3.

To assess your application and run your membership (performance of a contract / steps prior to a contract); to contact you about your application by WhatsApp and email (same basis); to protect the site from bots and abuse (legitimate interest); to understand which adverts work (legitimate interest); to meet legal obligations.

We use Cloudflare Turnstile to verify that applications come from real people. Turnstile runs invisibly when you submit the form and evaluates technical signals from your browser. Cloudflare processes this data as described in the Cloudflare Turnstile Privacy Addendum.

We use these providers to run Gratis, each under a data processing agreement: Vercel (site hosting), Supabase (database and authentication, hosted in London), Cloudflare (bot protection, per section 3), Twilio (WhatsApp messages), Resend (email), and Google (only if you choose "Continue with Google" to sign in).

Some providers process data outside the UK/EEA (including in the United States, and by the controller in the UAE). Transfers are protected by appropriate safeguards, including standard contractual clauses. [TO CONFIRM: the UK GDPR Article 27 representative position for the Dubai entity, to be confirmed by our legal advisers.]

Applications that do not become memberships: [TO CONFIRM: retention period to be set by our legal advisers]. Member data: for the life of the membership plus [TO CONFIRM]. Communication logs: [TO CONFIRM]. Consent records: kept as long as legally required.

You can ask for a copy of your data, correction, deletion, restriction, or portability, and you can object to processing based on legitimate interest. Contact hello@joingratis.co. You can complain to the ICO (UK) or your local supervisory authority.

The site sets only the cookies needed to run it, including Cloudflare's bot-protection cookie and the cookies that keep you signed in. No advertising cookies.

We will post updates here with a new version number and date.