Privacy Policy

Gimel ("Gimel," "we," "us," or "our") is a charitable-giving platform operated by Wayby Inc., DBA Gimel.ai. Gimel lets people convert unused airline miles and credit card points into cash donations for schools and charitable institutions they choose. This Privacy Policy explains what information we collect, how we use it, and the choices you have. Questions: hello@gimel.ai.

• Account and contact information — name, email address, phone number, mailing address, and date of birth.
• Financial and loyalty information — bank account connection details (obtained securely through our payment partner, Plaid), and airline/credit-card loyalty program information you provide or authorize us to access to process a donation.
• Donation activity — the pledges you make, the institutions you choose, and the status of your conversions and donations.
• Communications and consent records — your email and SMS preferences, and a record of any consent you give (including a timestamp), so we can honor your choices and demonstrate compliance.
• Usage information — basic analytics about how you interact with our site, collected through Google Analytics (such as pages visited and general device/browser info).

We use your information to: provide and operate the Gimel service, including processing the conversions and donations you authorize; verify your identity and the accounts you connect, and prevent fraud; send you transactional messages (by email and/or SMS) related to your account and donations; respond to your questions and provide support; maintain records required for legal, tax, accounting, and compliance purposes; and improve and secure our platform. We do not sell your personal information.

Gimel sends transactional, account-related text messages to users who opt in. Consent is collected directly by Gimel through a clearly labeled, unchecked-by-default checkbox at account signup, and through explicit authorization steps within the donation flow. Consent to receive text messages is not a condition of using the Gimel service or of making any donation.

• What you'll receive: transactional, account-related messages such as launch notifications, requests to authorize a pledged transfer, requests to relay a one-time verification code from your own loyalty account, and status confirmations. Gimel does not send marketing or promotional text messages under this program.
• Message frequency: varies based on your account activity.
• Message and data rates may apply.
• Opt-out: reply STOP to any message at any time to cancel and stop receiving further texts. After you reply STOP, we may send one final message confirming your opt-out.
• Help: reply HELP to any message for assistance, or email hello@gimel.ai.
• Carriers are not liable for delayed or undelivered messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with, or sold to, any third party. Information sharing described elsewhere in this Policy excludes text messaging originator opt-in data and consent; the sole exception is the SMS delivery provider acting on our behalf and solely to deliver our messages to you.

We share personal information only as needed to operate Gimel, and only with providers bound by confidentiality obligations. Our key service providers, by purpose:

• Plaid — to securely connect and verify your bank account for donation payouts.
• Supabase — database and application data storage.
• Vercel — website and application hosting.
• Resend — to send transactional email.
• Telnyx — to send and receive transactional SMS.
• Google Analytics — to understand and improve how our site is used.

We may also share information with similar service providers we engage to operate, secure, and improve the platform, under contractual confidentiality obligations. We may disclose information when required by law, to comply with legal process, to enforce our terms, or to protect the rights, safety, and property of Gimel, our users, or others. If Gimel is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

We keep personal information for as long as needed to provide the service, comply with our legal and financial-recordkeeping obligations, resolve disputes, and enforce our agreements. Consent records are retained as needed to demonstrate compliance.

We use reasonable administrative, technical, and physical safeguards to protect your information, including encryption of sensitive credentials at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You may access, correct, or request deletion of your personal information; opt out of marketing or SMS communications at any time; and ask questions about how your information is handled. To exercise any of these, email hello@gimel.ai. Depending on where you live, you may have additional rights under applicable privacy laws (such as the California Consumer Privacy Act).

Gimel is intended for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18.

We may update this Privacy Policy from time to time. When we do, we'll revise the effective date above, and material changes may be communicated to you directly.

Questions about this Privacy Policy or your data: hello@gimel.ai.