Privacy Policy — Gimbl.dev

Last updated: August 17, 2026

This Privacy Policy explains how Precision Infinity, Inc., a Florida corporation and the operator of Gimbl ("Gimbl," "we," "us," or "our"), accesses, collects, stores, uses, and shares ("processes") your personal information when you use the Gimbl platform and related content, features, and tools (the "Services"), including when you:

Visit our website at gimbl.dev (or any site of ours that links to this Privacy Policy); or
Register for, access, or use the Gimbl Services.

This Privacy Policy is part of, and is incorporated by reference into, the Gimbl Terms of Service (the "ToS"). Capitalized terms not defined here have the meaning given in the ToS. If you do not agree with this Privacy Policy, please do not access or use the Services.

Questions? See Section 14 — How to contact us.

SUMMARY OF KEY POINTS

What we process. Account and contact details you give us; billing information (card data is handled by our payment processor, Stripe); the targets, repositories, code, connection credentials, and configuration you submit so we can test your systems; the messages and instructions you send while using the Services; the Artifacts and Outputs the Services generate; and technical/usage data such as IP address and log data. See Section 1.
Sensitive information. We do not seek special-category/sensitive personal information, and the ToS prohibits you from submitting certain sensitive data (e.g., health, payment-card, government-ID, biometric, and secrets) into the Services. See Section 1 and ToS §8.
Your code and testing data. We access connected repositories read-only and use what you submit only to provide the Services to you. We do not use your Source Code, End-User Data, or project content to train AI models, and we do not sell your personal information. See Sections 2, 3, and 5.
AI providers. The Services use the third-party AI providers identified in our Terms of Service to process your inputs and generate Outputs. We do not use AI models or services developed or operated by entities based in or subject to the jurisdiction of the People's Republic of China to process your data. See Section 5.
No advertising. We do not run targeted advertising, do not buy personal information from data brokers, and do not sell or share your personal information for advertising. See Sections 2, 3, and 4.
How we keep it safe. We use organizational and technical safeguards, but no method of transmission or storage is 100% secure. See Section 8.
Your rights. Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. See Sections 10 and 12.
How to exercise them. Signed-in users can review and update most information in Account settings, and can close their account on request (see Section 10). For privacy-rights requests, submit a request at gimbl.dev/privacy/request or email privacy@precisioninfinity.com. See Sections 10, 14, and 15.

What information do we collect?
How do we process your information?
When and with whom do we share your personal information?
Do we use cookies and other tracking technologies?
Do we offer artificial-intelligence-based products?
How do we handle repository connections and sign-in providers?
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for Do-Not-Track features
Do United States residents have specific privacy rights?
Do we make updates to this Policy?
How can you contact us about this Policy?
How can you review, update, or delete the data we collect from you?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect the personal information you provide when you register, contact us, or use the Services.

Depending on how you interact with us, this may include:

Account and contact data: name, email address, username, password and other authentication data, and (optionally) a phone number. If you register or sign in using a third-party identity provider, see Section 6.
Access requests: if you request access to the Services (for example, an invitation to a beta or early-access program), the name and email address you submit and any details you include with the request.
Organization data: if you use the Services on behalf of an Organization, business contact details and role.
Billing data: the information needed to bill you for the Services. Billing addresses and card/payment-instrument data are collected and stored by our payment processor, Stripe, under Stripe's own privacy notice (https://stripe.com/privacy); we do not store full payment-card numbers or billing addresses, and we retain only the limited billing records needed for receipts, accounting, and fraud prevention.

Information you submit to run the Services

In Short: To test your systems, we process the targets, repositories, code, credentials, and configuration you submit — and we generate diagnostic Artifacts and Outputs.

Because Gimbl tests your systems, the Services process what you submit for testing, which may include:

End-User Systems: the URLs, applications, or targets you submit for analysis or testing.
Repository connections and Source Code: where you connect a code repository (e.g., GitHub or Perforce), we retrieve file listings and file content read-only, for analysis only (see Section 6).
Connection credentials: repository-connection tokens and similar credentials you provide through the Services' designated credential fields. These should be scoped to the minimum, read-only access needed, and we handle them as secrets (see Section 8).
Messages and instructions: the prompts, messages, and configuration you send while directing the Services.
Artifacts and Outputs: diagnostic and testing byproducts (e.g., screenshots, DOM snapshots, metadata, event logs, performance traces) and the findings/reports the Services produce.

You are responsible for having authorization to submit each End-User System, and you must not submit prohibited or sensitive data. The ToS (§8) prohibits submitting, among other things, protected health information, payment-card data, financial-account credentials, government-identification numbers, biometric data, personal data of children under 13, and secrets or Production Credentials. Do not paste secrets or sensitive personal data into free-text fields, uploads, or configuration parameters.

Information automatically collected

In Short: Some technical information is collected automatically when you use the Services.

Log and usage data: IP address, browser and device characteristics, operating system, referring URLs, and information about how and when you use the Services (e.g., timestamps, pages/features used, searches, and actions), including diagnostic and error data. This is used primarily to operate and secure the Services and for internal analytics and reporting.
Approximate location: we may infer coarse location (e.g., country or region) from your IP address for security and localization purposes. We do not collect precise (GPS) geolocation.
Cookies and similar technologies: including our bot-protection service on certain pages — see Section 4.

Information from other sources

In Short: We do not buy personal information about you from outside sources.

We do not purchase personal information from data brokers, and we do not otherwise acquire personal information about you from third-party sources for marketing purposes. The only personal information we receive from a third-party source is the limited profile information your chosen identity provider sends us if you sign in with single sign-on — see Section 6.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: To provide, secure, and improve the Services, to communicate with you, and to comply with law.

We process your personal information to:

Create and manage your Account and authenticate you.
Deliver the Services — run the analysis and testing you request against the systems you submit, connect to your repositories read-only, and generate Artifacts and Outputs.
Provide support and respond to your inquiries.
Send administrative/service communications — e.g., changes to our terms and policies, security notices, and transactional messages. (Under the ToS, material changes to the terms are subject to advance notice.)
Secure the Services — bot protection, fraud monitoring, abuse prevention, and enforcement of the ToS.
Bill and account for your use of the Services (via Stripe).
Improve the Services — using aggregated or de-identified usage data.
Comply with law and to establish, exercise, or defend legal claims.

We do not:

use your Source Code, End-User Data, or project content to train, fine-tune, or improve AI models (see Section 5);
process your personal information for targeted advertising; or
sell your personal information.

The Services are currently designed for and offered to users located in the United States. If we make the Services available internationally, we will update this Policy to address applicable international privacy requirements (such as the GDPR) before doing so.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information only with the service providers that help us run the Services, and in the limited legal situations below. We do not sell your personal information.

We share personal information with the following categories of vendors and service providers ("subprocessors"), who process it on our behalf under written contract and only as needed to perform their services:

Third-Party AI Providers — the external AI services identified in our Terms of Service (the ToS §2 Definitions name the current providers, and that list is kept up to date as providers change — ToS §10). What is shared: the project data, connected repository content, and messages needed to provide the Services — see Section 5.
Payment processing — Stripe (your card data and billing address are collected and stored by Stripe directly, under its own privacy notice — see Section 1).
Cloud hosting and infrastructure providers.
Email and text-message delivery providers.
Bot protection — Google reCAPTCHA (see Section 4).
Product analytics — Microsoft Clarity (see Section 4).

Other than the service providers above, we do not disclose your personal information to third parties, except:

To comply with law — in response to a valid court order, subpoena, or lawful government/law-enforcement request, or to protect our rights, users, or the public.
In a business transfer — in connection with a merger, acquisition, financing, or sale of assets (any successor will remain bound by this Policy or an equally protective one).
To affiliates — who must honor this Policy.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use essential cookies to run the Services, a bot-protection service, and one permissioned product-analytics tool. We do not use advertising or retargeting technologies.

Essential/functional cookies maintain your session and security, remember preferences, and support core site functions.
Bot protection — Google reCAPTCHA. We use Google reCAPTCHA on certain pages (for example, account registration) to protect the Services from bots and abuse. reCAPTCHA collects device and interaction information to distinguish humans from automated traffic, and its use is subject to the Google Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms).
Product analytics — Microsoft Clarity. With your permission, we use Microsoft Clarity to understand product usage and improve the Services. Clarity is off by default and enabled only where permitted / consented; you are asked to acknowledge it before it runs, and you can change that choice at any time (see Section 10). Data collected through Clarity is governed by Microsoft's privacy terms. Clarity is the only third-party analytics service we use.

Managing cookies

You can remove or block cookies through your browser settings; blocking essential cookies may prevent parts of the Services from working. Your Microsoft Clarity choice can be changed at any time (Section 10). We do not use advertising, retargeting, or cross-site tracking technologies, and we do not work with ad networks, affiliate-marketing programs, retargeting platforms, or social networks. For how we respond to Do-Not-Track signals, see Section 11.

5. DO WE OFFER ARTIFICIAL-INTELLIGENCE-BASED PRODUCTS?

In Short: Yes. Gimbl is an AI-powered service that uses named third-party AI providers, and we do not train AI on your code.

The Services use AI, machine learning, and related technologies ("AI Products") to analyze and test the systems you submit and to generate Outputs.

AI Service Providers. We provide AI Products through the Third-Party AI Providers identified in our Terms of Service ("AI Service Providers") — the ToS's Definitions (§2) name the current providers, and that list is updated when providers change (ToS §10). To deliver the Services, your inputs — including the End-User Systems and targets you submit, repository file listings and content you connect, the messages and instructions you send to the Services, and related Artifacts — and the resulting Outputs are shared with and processed by these AI Service Providers. You must not use the AI Products in a way that violates any AI Service Provider's terms.

No training on your content. We do not use your Source Code, End-User Data, or project content to train, fine-tune, or improve AI models, and our agreements with our AI Service Providers require that they do not train their models on it either.

No PRC-jurisdiction providers. We do not use AI models or services developed or operated by entities based in or subject to the jurisdiction of the People's Republic of China to process your data (ToS §10). Adding or changing an AI provider requires updating this Policy, the ToS, and/or the subprocessor list (ToS §10).

6. HOW DO WE HANDLE REPOSITORY CONNECTIONS AND SIGN-IN PROVIDERS?

In Short: You can connect code repositories (read-only) and sign in with a supported identity provider; we receive only what those connections need.

Repository connections. To analyze your code, you can connect a source-code repository (currently GitHub or Perforce) to the Services through the designated repository-connection fields (including via OAuth where offered). When you do:

We retrieve file listings and file content read-only, for analysis only, and do not modify, write to, or deploy to your systems (ToS §3(b)).
We recommend you scope any access token to the minimum, read-only permissions for a single repository, and prefer test accounts on non-production environments.
We store connection credentials as secrets and use them only to provide the Services to you.

Signing in with an identity provider (single sign-on). You may register for or sign in to your Gimbl Account using a supported third-party identity provider; the providers currently offered are shown at sign-in. If you do, we receive limited profile information from that provider — such as your name, email address, and account identifier — which we use to create, authenticate, and secure your Account. Your relationship with the identity provider is governed by its own terms and privacy statement; we do not control, and are not responsible for, its use of your personal information.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep personal information only as long as needed for the purposes in this Policy, unless a longer period is required by law.

Account and profile data: kept while your Account is active and for a limited period afterward as needed for legal, tax, and accounting purposes.
Access requests: kept while we process your request to join the Services and for a limited period afterward.
Source Code and End-User Data: retained only as needed to provide the Services and then deleted or de-identified in accordance with our data-retention practices; deleted following account closure (ToS §8(c), §17). Limited encrypted backup copies may persist for a reasonable period and are excluded from AI training.
Connection credentials and stored sign-in state: retained only while needed for the connections and testing you configure; stored browser sign-in state from testing expires and is purged automatically.
Artifacts and Outputs: retained for the applicable retention period. On account closure, Outputs become inaccessible — you are responsible for downloading anything you wish to keep before closing your Account (ToS §17).
Logs and diagnostics: kept for a limited period for security, operations, and troubleshooting, then deleted or de-identified.
De-identified or aggregated usage data: may be retained indefinitely.
Consent and compliance records: records of your acceptance of the ToS and any arbitration opt-out are retained as needed to meet our legal and compliance obligations, including after account closure, and are not deleted by account-closure or routine data-deletion processes (see the opt-out window in ToS §21).

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use reasonable safeguards, but no system is 100% secure.

We implement appropriate technical and organizational measures designed to protect personal information: we encrypt data in transit, store connection credentials and other secrets as protected secrets, access connected repositories read-only, and restrict internal access to personal information. However, no electronic transmission or storage is guaranteed to be 100% secure, and we cannot guarantee that unauthorized third parties will never defeat our safeguards. You are responsible for keeping your Account credentials secret and for accessing the Services in a secure environment.

9. DO WE COLLECT INFORMATION FROM MINORS?

In Short: The Services are for adults; we do not knowingly collect personal information from children.

The Services are intended for users who are at least 18 years old (or the age of legal majority in your jurisdiction, if higher — ToS §3(c)). We do not knowingly collect or solicit personal information from anyone under 18. If you believe a minor has provided us personal information, contact us at privacy@precisioninfinity.com (or via gimbl.dev/privacy/request) and we will take reasonable steps to delete it.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You can review or update your information, close your account, and — depending on where you live — exercise additional rights.

Account information. Signed-in users can review and update most Account information in Account settings. You can close your Account at any time by submitting a request through the in-platform Request Support option or by contacting us. On closure we will deactivate or delete your Account and associated data as described in Section 7, except information we must retain for legal, security, fraud-prevention, or compliance reasons (including the consent/compliance records in Section 7).
Withdrawing consent. Where we rely on consent, you may withdraw it at any time — using the controls described in this section (such as unsubscribe links, STOP replies, cookie controls, or your Account settings, where offered) or by contacting us. Withdrawal does not affect processing already carried out.
Marketing communications. If we send product/marketing emails, you can opt out at any time via the unsubscribe link or by contacting us. We may still send non-marketing service messages necessary to administer your Account.
Text messaging. We may offer SMS/text-message notifications, delivered through our SMS provider. If you opt in, message and data rates may apply, and you can opt out at any time by replying STOP or adjusting your notification settings. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties, excluding our SMS delivery provider solely as necessary to send you the messages you requested.
Cookies. You can control cookies through your browser and, where offered, our cookie controls (Section 4).

To exercise privacy rights, submit a request at gimbl.dev/privacy/request or email privacy@precisioninfinity.com. Signed-in users may also submit privacy requests through the in-platform Request Support option — we honor a request the same way whichever channel it arrives through. For general product support, use Request Support.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

Most browsers and some operating systems offer a Do-Not-Track ("DNT") setting. No uniform standard for recognizing DNT signals has been finalized, so we do not currently respond to them. If a standard is adopted, we will revise this Policy accordingly. California law requires us to disclose that we do not respond to DNT signals at this time.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Residents of certain US states have rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of certain processing.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the rights described below, subject to legal limits.

Categories of personal information we collect

A. Identifiers (examples: Name, email address, username, phone number (optional), unique/online identifiers, IP address) — YES
B. Personal information (Cal. Customer Records) (examples: Name, contact information, billing records (payment data and billing addresses are held by Stripe on our behalf)) — YES
C. Protected classifications (examples: Age, race, gender, etc.) — NO
D. Commercial information (examples: Transactions, purchase history, payment information) — YES
E. Biometric information (examples: Fingerprints, voiceprints) — NO
F. Internet/network activity (examples: Browsing/usage within the Services, interactions) — YES
G. Geolocation data (examples: Approximate location inferred from IP address only; no precise (GPS) geolocation) — YES
H. Audio/electronic/sensory (examples: Recordings) — NO
I. Professional/employment (examples: Business contact details and role, for Organization accounts) — YES
J. Education information (examples: Student records) — NO
K. Inferences (examples: Profiles/preferences) — NO
L. Sensitive personal information (examples: —) — NO

We use and retain this information as described in Sections 2 and 7. Note the data you submit about your own systems for testing (targets, code, Artifacts) is processed on your behalf to provide the Services and is governed by the ToS.

Sale/sharing

We do not sell your personal information, and we have not sold or shared personal information for cross-context behavioral (targeted) advertising, including in the preceding twelve (12) months.

Your rights and how to exercise them

Subject to applicable law, you may have the right to: confirm whether we process your personal data; access it; correct inaccuracies; delete it; obtain a portable copy; opt out of targeted advertising, sale, or certain profiling; and not be discriminated against for exercising these rights. Depending on your state, you may also have rights to lists of the categories/third parties to which data was disclosed, and rights regarding sensitive data and profiling.

To submit a request, use gimbl.dev/privacy/request or email privacy@precisioninfinity.com (signed-in users may also use the in-platform Request Support option). You may use an authorized agent (with proof of authorization). We will verify your identity before acting and will respond as required by law. If we decline to act on your request, you may appeal our decision by replying to our response or by contacting us through the same channel and stating that you wish to appeal; we will respond in writing with the reasons for our decision. If your appeal is denied, you may complain to your state attorney general.

California "Shine the Light": California residents may request information about personal information (if any) disclosed to third parties for their direct-marketing purposes. Submit requests via gimbl.dev/privacy/request or privacy@precisioninfinity.com.

13. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes — we will update this Policy as needed and post the revised version here.

We may update this Privacy Policy from time to time; the "Last updated" date shows the latest revision. If we make material changes, we will notify you by posting a prominent notice or by direct notification, consistent with the notice requirements in the ToS. Your continued use of the Services after an update means you accept the revised Policy.

14. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or requests regarding this Policy or your personal information, contact us:

Precision Infinity, Inc. (Gimbl) Attn: Privacy 3801 Avalon Park East Blvd, Suite 320 Orlando, FL 32828, United States

Privacy requests: https://gimbl.dev/privacy/request or privacy@precisioninfinity.com

For formal legal notices (not privacy requests), see the notice provisions of the ToS and https://gimbl.dev/legal/notices. For general product support, signed-in users can submit a request through the in-platform Request Support option.

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal information, and to withdraw consent. Signed-in users can review and update most information in Account settings, and can close their Account as described in Section 10. To make a formal request, visit https://gimbl.dev/privacy/request or contact us at privacy@precisioninfinity.com.