Gaeci Privacy Policy

Last updated: 19 August 2026 Effective from: 19 August 2026

Gaeci is a platform for giving things away for free. We built it to know as little about you as possible. We do not need your address, your email, your date of birth, your documents, or your payment details — and we do not collect them.

This Policy explains what data we do process, why, on what legal basis, how long we keep it, and what you can do about it.

We operate under the Law of Georgia on Personal Data Protection (adopted 14 June 2023; main provisions in force from 1 March 2024).

Important — the supervisory authority has changed. Until 2 March 2026, supervision was carried out by the Personal Data Protection Service of Georgia. From 2 March 2026 that Service was abolished and its functions were transferred to the State Audit Office of Georgia (სახელმწიფო აუდიტის სამსახური, sao.ge). All references to the supervisory authority in this Policy mean the State Audit Office.

1. Who processes your data

Controller: [LEGAL ENTITY NAME], [identification number], [registered address, Georgia].

Data enquiries: [privacy@gaeci.ge]

Person responsible for data protection: [name and contact, if appointed].

Launch note: the obligation to appoint a personal data protection officer (Article 33 of the Law) does not apply to organisations that process the data of fewer than 3% of Georgia's population, special-category data of fewer than 1%, and do not carry out systematic large-scale monitoring of behaviour. At launch Gaeci is very unlikely to reach those thresholds, but we name a contact for data questions in any case.

2. What data we collect

2.1. What you give us

We do not ask for: surname, patronymic, exact address, email, date of birth, passport or other identity documents, bank cards or any payment data, or a photograph of your face.

2.2. Generated as you use the platform

• Claim and handover history: which listings you posted, what you claimed, what you gave and received.
• Karma and no-show records — a reliability counter calculated automatically.
• Moderation records: decisions on your listings, reasons for rejection, warnings and blocks, reports you filed and reports about you.
• Notification subscriptions: the categories and cities you asked to be alerted about.

2.3. Technical data

• IP address, browser type and version, device type, interface language;
• date and time of sign-ins, session identifier;
• the fact that an SMS code was sent and the verification result (the code itself is not stored in plain form);
• server error logs.

We do not collect geolocation data, do not track you across third-party sites, and do not build advertising profiles.

3. Why we process it and on what basis

Legal bases are given by reference to Article 5 of the Law of Georgia on Personal Data Protection.

We do not process special categories of data (Article 6 of the Law): health, religion, political views, ethnic origin, sex life, and the like. Please do not include such details in listings or messages.

We do not use biometric data (Article 9 of the Law).

4. How long we keep data

The storage limitation principle is set out in Article 4(1)(e) of the Law: data may be stored only for as long as is necessary for the purpose.

Longer retention happens only where the law expressly requires it, or where the data is needed for an unresolved dispute or a request from a public authority.

5. Your rights

The Law gives you the following rights. Article references are to the Law of Georgia on Personal Data Protection.

• To be informed how your data is processed (Art. 13).
• To access your data and obtain a copy (Art. 14).
• To have data corrected, updated, and completed (Art. 15). Name, city, and messengers you can change yourself in your profile at any moment.
• To require processing to stop, and data to be erased or destroyed (Art. 16).
• To have data blocked — processing paused while a dispute is resolved (Art. 17).
• To receive your data in a machine-readable form and transmit it to another controller (Art. 18), where technically feasible.
• Not to be subject to a decision taken solely by automated means, and to require human involvement (Art. 19).
• To withdraw consent at any time, in the same form in which it was given (Art. 20).

Response times

We answer your request within 10 working days. In justified cases this may be extended by no more than a further 10 working days, and we will tell you immediately about the extension and its reasons.

A blocking request (Art. 17) is actioned within 3 working days.

Send requests from the phone number linked to your account, or to [privacy@gaeci.ge]. We may ask you to confirm that the account is yours — so that we do not hand your data to a stranger.

Responses are free of charge. The Law permits a reasonable fee for manifestly unfounded or repetitive requests; in practice we do not charge one.

Automated decisions

Karma, and the release of a claim after 48 hours, are calculated automatically. Decisions that affect you materially — rejecting a listing, a warning, a block — are made by a person. If an automated mechanism has treated you unfairly, write to us: a moderator will review it, not an algorithm.

6. Deleting your account yourself

6.1. Go to Profile → Settings → Delete account. No separate request and no correspondence with us is needed.

6.2. What happens immediately: the account closes, all your active listings are unpublished, active claims are cancelled, and you stop being visible to other users.

6.3. What happens within 30 days: your phone number, name, city, messengers, listing photographs and text, messages, karma, and claim history are erased.

6.4. Those 30 days exist so you can change your mind and so any open investigation can conclude. You can restore your account during that period by signing in as usual.

6.5. What remains after deletion:

• anonymised statistics (for example, "400 items changed hands in August") — you cannot be identified from these;
• if your account was blocked for a violation, an irreversible hash of your phone number for up to 36 months, so that the block cannot be evaded by re-registering;
• material relating to an unresolved report, until it concludes;
• data we are required to keep by law or under a lawful request from a public authority;
• copies in backup archives — these are overwritten on the ordinary cycle and are not used in day-to-day operation.

6.6. If you gave an item to someone, the other party may still have your name and number in their own messages from the claim. We delete data on our side, but we cannot delete it from someone else's phone.

7. Who we share data with — and who we do not

7.1. We do NOT share your data with:

• we never sell it — not for money, not in exchange for services;
• advertisers, ad networks, or data brokers — we have none;
• other users, except in the single case described in 7.2 below;
• marketing and mailing services for someone else's advertising;
• banks, insurers, scoring, or debt collection companies;
• employers, landlords, or anyone running background checks on people;
• other countries for purposes unconnected with running the platform.

7.2. The one exchange between users

After a confirmed claim, the giver and the receiver each see the other's name, phone number, and chosen messengers. Nothing else — no history, no other listings, no address.

Before a claim is confirmed, nobody sees your phone number. That is deliberate.

7.3. Service providers (processors)

To run the platform we use contractors. They process data only on our instructions, only to the extent necessary, and are contractually bound to maintain confidentiality and security.

7.4. Public authorities

We disclose data only on receiving a lawful, properly issued request from an authorised Georgian body, in the manner prescribed by law. We check such requests against the law and provide the minimum necessary. We tell the user about the request unless the law forbids it.

We may also pass information to the competent authorities where there is a genuine threat to life or health, or where we find indications of a crime, including cruelty to animals.

8. Transfers outside Georgia

8.1. Part of the infrastructure (hosting, SMS delivery) may sit outside Georgia. Cross-border transfer is governed by Articles 37 and 38 of the Law.

8.2. Transfer is permitted where appropriate data protection safeguards exist in the recipient country. The list of countries offering an adequate level of protection is established by normative act of the head of the supervisory authority.

8.3. Where the recipient country is not on that list and safeguards rest on a contract with the recipient, the transfer requires a permit from the supervisory authority. We are building the infrastructure so as to use providers in jurisdictions with a recognised level of protection and, where necessary, to obtain a permit before any transfer begins.

Launch note: the actual providers and their jurisdictions must be filled into 7.3, and the transfer route agreed with a lawyer before launch. See the project report.

9. Cookies and analytics

9.1. Strictly necessary cookies are set without your consent — the site does not work without them:

• session cookie (to keep you signed in);
• CSRF token (protection against request forgery);
• interface language choice (Georgian / Russian / English);
• a record of your choice in the cookie banner.

9.2. Analytics cookies are set only with your consent. We ask for it in the banner on your first visit. Declining breaks nothing: the site works in full.

9.3. We do not use advertising or tracking cookies, social network pixels, retargeting, or cross-site tracking.

9.4. You can change your decision at any time: Settings → Cookies. Withdrawing consent is as easy as giving it.

9.5. You can delete and configure cookies in your browser. If you delete the strictly necessary ones, you will have to sign in again.

9.6. We respect the Do Not Track and Global Privacy Control browser signals and do not enable optional analytics when we see them.

10. Direct marketing

10.1. We do not run advertising mailings. The notifications you receive are operational: listing status, claims, moderator decisions, and the subscriptions you set up yourself.

10.2. Should marketing messages ever appear, they will be sent only with your written consent, as Article 12 of the Law requires, and every message will carry a simple way to opt out.

10.3. We action an opt-out from marketing messages within a reasonable period and no later than 7 working days from receiving the request (Art. 12).

10.4. Operational notifications without which the platform cannot function (the sign-in code, a claim notification) cannot be switched off — the service would not work.

11. Security

11.1. What we do:

• encrypt the connection (HTTPS) on every page;
• store no passwords, because there are none — sign-in is by one-time SMS code;
• never store the code in plain form, and limit the number of entry attempts;
• restrict staff access to data on a least-privilege basis;
• keep an audit log of moderator actions;
• update dependencies regularly and take backups;
• store the block marker as an irreversible hash rather than as a phone number.

11.2. Incidents. If a data breach occurs that may cause significant harm or pose a significant threat to your rights, we will notify the supervisory authority in writing no later than 72 hours after identifying the incident (Article 29 of the Law), and we maintain an internal incident register. Where there is a high probability of significant damage to you, we will also notify you, without undue delay (Article 30).

11.3. What depends on you: never tell anyone your SMS code, keep control of your phone number, do not publish more than necessary in a listing, and update your number in your profile if it changes.

11.4. No one has absolute security. We say so honestly, and we try to collect less data — less data means less risk.

12. Age

12.1. Gaeci is for people aged 16 and over.

12.2. Article 7 of the Law permits processing based on a minor's own consent where the minor has reached the age of 16; below that, a parent's or legal representative's consent is required. Our age threshold matches that rule.

12.3. We do not knowingly collect children's data. If you believe an account belongs to someone under 16, write to [privacy@gaeci.ge] — we will check, block the account, and delete the data.

13. Changes to this Policy

13.1. We may update this Policy — for example if the law changes or a new service provider is added.

13.2. We will announce material changes on the platform in advance and update the date at the top of this document.

13.3. If a change requires your consent, we will ask for it separately rather than assuming it.

14. Complaints

14.1. Write to us first: [privacy@gaeci.ge]. We reply within 10 working days.

14.2. If our answer does not satisfy you, you may approach the supervisory authority — the State Audit Office of Georgia (სახელმწიფო აუდიტის სამსახური), to which supervision of personal data protection passed on 2 March 2026. Current contact details and the complaints procedure are on sao.ge.

Launch note: the specific channel for complaints and incident notifications following the reorganisation of the supervisory authority must be confirmed and written in here before publication. See the project report.

14.3. You also have the right to go to court and to a superior administrative body (Article 22 of the Law). Contacting us does not remove your right to go to court straight away.

15. Contact

Data questions: [privacy@gaeci.ge] General questions and support: [support@gaeci.ge] Postal address: [address, Georgia]

We reply in Georgian, Russian, and English.