Legal

Privacy Policy

Last Updated: September 24, 2026

Guap.lol, including its related websites, profile tools, media hosting, payment features, and services (collectively, the “Service”), is operated by Guap (“Guap,” “we,” “us,” or “our”).

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use the Service. It also describes certain privacy choices and rights that may be available to you.

By using Guap, you acknowledge the practices described in this Privacy Policy.

1. Our Approach to Privacy

We aim to collect information that is reasonably necessary to operate Guap, secure accounts, provide profile and media features, process transactions, prevent abuse, and comply with legal obligations.

Guap does not use cookies for advertising analytics or cross-site behavioral tracking. We may collect limited, privacy-conscious activity information about public profile visits and link clicks so creators can understand how their pages are being used.

We do not sell personal information for money. We also do not sell or share personal information for cross-context behavioral advertising as those terms are defined under applicable privacy laws, unless we clearly tell you otherwise and provide any required choices.

2. Information We Collect

The information we collect depends on how you use Guap, the features you enable, and the services you connect.

Account information

When you create, manage, or use an account, we may collect:

  • Username, display name, profile information, and account settings
  • Email address
  • Password, stored in hashed form rather than as readable plaintext
  • Account identifier and account status
  • Login, signup, password-reset, and account-change activity
  • Payment or subscription status
  • Support requests and communications with us

If you update your email address, we may temporarily retain your previous email address when reasonably necessary for security, fraud prevention, account recovery, dispute handling, or legal compliance. We do not use a previous email address for new marketing communications after it has been replaced. We delete or de-identify it when it is no longer needed for those purposes.

Security and device information

When you register, sign in, use the Service, or take certain account actions, we may collect technical and security-related information, including:

  • IP address
  • Login and account-action timestamps
  • Browser type and version
  • Operating system and device category
  • Session identifier
  • Approximate country or regional location inferred from IP address
  • Security, fraud, or abuse-prevention signals
  • Information about active account sessions

We use this information to authenticate users, keep sessions working, identify suspicious activity, investigate fraud or abuse, maintain platform security, and allow users to view or revoke active sessions where that feature is available.

Profile and public-content information

When you create or edit a profile, we process information you choose to publish, including:

  • Profile names, usernames, bios, text, labels, and customization choices
  • Links and destinations you add to your profile
  • Images, videos, graphics, badges, or other media you upload
  • Public-facing profile settings and visibility preferences
  • Metadata associated with your published content

Your profile and content may be visible to the public depending on your settings and the functionality of the Service. You should not post information that you do not want others to see or copy.

Media-upload information

When you upload files, images, screen recordings, clips, or similar media, we may collect and store:

  • The account associated with the upload
  • File name or display name
  • File type, size, format, dimensions, and related technical attributes
  • Upload date and time
  • File storage and delivery information
  • IP address, browser, and device information associated with the upload

We use this information to host, deliver, secure, troubleshoot, moderate, and manage uploaded content.

Cookie-free profile analytics

Guap may offer creators limited analytics for public profile pages and links.

When a visitor loads a public Guap profile or selects a link on one, we may record an event containing:

  • The profile or account associated with the event
  • The date and time of the visit or click
  • The destination link selected, if applicable
  • Referral source, if available
  • Approximate country or region inferred from IP address
  • Broad device or browser category

We do not use analytics cookies for this purpose. We also do not intentionally use these analytics events to identify individual visitors, build behavioral advertising profiles, or track people across unrelated websites.

Diagnostics and service logs

We may create logs when the Service encounters an error, performance issue, security incident, or unexpected behavior.

These logs may include:

  • Account ID, where applicable
  • Session ID
  • IP address
  • Browser, device, or operating-system details
  • Page, feature, action, request, and timestamp information
  • Error details and technical diagnostic data

We use these records to maintain availability, identify bugs, improve reliability, investigate security events, prevent abuse, and enforce our Terms of Service. We do not use diagnostic logs for targeted advertising or behavioral profiling.

Communications

If you email us, submit a support request, respond to a message, or otherwise contact Guap, we process the information included in your communication, as well as related metadata such as your email address, timestamps, account details, and support history.

We use this information to respond to you, resolve technical or billing issues, investigate reports, provide account assistance, and maintain records related to customer support.

Payment information

If you purchase a subscription, customization, upgrade, or other paid feature, our payment processors collect payment information necessary to complete the transaction.

Depending on the payment method, this may include:

  • Name and billing address
  • Email address
  • Transaction amount, currency, date, and payment status
  • Payment-method details
  • Tax-related information where required
  • Fraud-prevention and verification information

Guap does not receive or store complete payment-card numbers or CVV codes. Card payments are processed by Stripe. Subscriptions, checkout, and plan entitlements are managed through Autumn.

We may retain limited payment-related records, such as transaction identifiers, plan status, purchase history, billing email, payment status, and fraud or dispute information. We use these records to activate purchases, provide support, prevent fraud, manage subscriptions, comply with tax and accounting obligations, and resolve payment disputes.

3. Cookies and Similar Technologies

Guap does not use analytics cookies to measure profile traffic or link performance.

We do use strictly necessary cookies or similar technologies that are required to operate and protect the Service. These may support:

  • Authentication and account sessions
  • Security controls
  • Fraud and abuse prevention
  • Load balancing and network routing
  • Service functionality
  • Bot detection and DDoS mitigation

If you block or delete essential cookies, some parts of Guap may not work correctly, including account login, session management, security verification, and access to protected areas.

Cloudflare

Guap may use Cloudflare for content delivery, network performance, security, bot protection, and mitigation of malicious traffic. Cloudflare may place cookies or use similar technical identifiers when necessary to provide those functions.

Cloudflare’s privacy practices are governed by its own policy, available at Cloudflare Privacy Policy.

Browser controls may allow you to manage some cookies. However, disabling essential Guap or Cloudflare security cookies may prevent you from using the Service or reduce its performance and security.

4. How We Use Information

We may use personal information and other data for the following purposes:

  • Creating, managing, and authenticating accounts
  • Providing profile pages, links, media hosting, customization, and related Service features
  • Rendering public profiles and delivering public content
  • Maintaining account sessions and allowing session management
  • Measuring public profile visits and link engagement using cookie-free analytics
  • Processing payments, subscriptions, upgrades, refunds, credits, and payment disputes
  • Sending transactional messages, receipts, security alerts, account notices, and service updates
  • Responding to support requests, feedback, and reports
  • Detecting, investigating, preventing, and addressing fraud, spam, abuse, security incidents, and Terms violations
  • Debugging errors, maintaining infrastructure, monitoring performance, and improving reliability
  • Enforcing our Terms of Service and protecting the rights, safety, property, and security of Guap, users, and others
  • Complying with legal, accounting, tax, regulatory, and recordkeeping obligations
  • Administering corporate transactions, such as a merger, financing, acquisition, or sale of assets
  • Sending marketing communications where permitted by law and consistent with your choices

5. Marketing Communications

We may send product announcements, feature updates, promotions, offers, or other marketing emails if you opt in or if applicable law otherwise permits us to do so.

You can unsubscribe from marketing emails by using the unsubscribe link in the email or contacting us at support@guap.lol.

Even if you opt out of marketing, we may still send non-promotional messages that are necessary to operate your account or the Service. These may include password-reset messages, security alerts, billing notices, receipts, policy updates, account notices, and responses to your support requests.

Our email providers may process limited delivery and engagement information, such as whether a message was delivered, opened, or clicked. We use this information to maintain deliverability, understand message performance, prevent abuse, and improve communications.

6. Legal Bases for Processing

If privacy laws such as the GDPR apply to our processing, we rely on one or more of the following legal bases:

  • Contract performance: Processing needed to provide the Service, manage your account, process purchases, host content, and deliver requested features.
  • Legitimate interests: Processing needed for security, fraud prevention, abuse detection, service maintenance, limited cookie-free analytics, troubleshooting, product improvement, and protection of our legal rights.
  • Consent: Processing based on your permission, such as certain marketing communications or other optional features where consent is required.
  • Legal obligations: Processing needed to comply with tax, accounting, legal, regulatory, or lawful government-request obligations.
  • Vital interests or public interest: Processing where permitted or required to protect people from serious harm or meet legal obligations.

7. How We Share Information

We do not sell personal information for money.

We may disclose personal information to the following categories of recipients when necessary to operate the Service:

Categories of recipients that may receive personal information
Recipient categoryWhy information may be shared
Hosting and infrastructure providersTo host, store, secure, and deliver the Service and user content
Content-delivery and edge-security providersTo improve reliability, route traffic, prevent attacks, and protect against abuse
Payment processorsTo process transactions, manage subscriptions, prevent payment fraud, and handle disputes
Email and communication providersTo deliver transactional, support, and permitted marketing messages
Security and anti-abuse providersTo detect fraud, spam, malicious activity, and account abuse
Professional advisersTo obtain legal, accounting, tax, insurance, or business advice
Government authorities, courts, or law enforcementTo comply with valid legal processes or protect rights, safety, property, and security
Corporate transaction participantsIn connection with a merger, financing, acquisition, restructuring, bankruptcy, or sale of assets

Service providers may process information only as needed to perform services for Guap and subject to contractual confidentiality, security, and use restrictions.

If Guap is involved in a business transaction, personal information may be transferred as part of that transaction. Where required by law, we will provide notice of a material change in ownership or data practices.

8. Third-Party Links and Services

Guap profiles may contain links to websites, social platforms, stores, messaging services, applications, embeds, payment pages, and other third-party destinations.

We do not own or control those services. When you follow a link or interact with a third party, that third party’s privacy policy, terms, and data practices apply.

This includes:

  • Links placed on public Guap profiles
  • Embedded content on user profiles
  • Connected social or messaging accounts
  • External apps or integrations
  • Payment processors
  • Other services that users choose to link or connect

Guap is not responsible for the privacy, security, content, availability, or practices of third parties. Review their policies before providing personal information or using their services.

9. Payments, Billing, and Hosting

Guap uses Stripe, Autumn, and Vercel to take payments, manage plans, and host the Service.

Card payments are processed by Stripe. Guap does not store full card numbers or card security codes. Stripe receives the payment details needed to complete a charge, including billing information submitted at checkout.

Subscriptions, checkout, plan status, and feature entitlements are managed through Autumn (useautumn.com). Autumn uses Stripe to create subscriptions and complete charges. Guap sends Autumn the account information needed to attach a plan, such as an account identifier and the product selected.

The Service is hosted on Vercel. Vercel processes technical information required to deliver the site, such as IP address, request data, and diagnostic logs.

These providers handle information under their own terms and privacy policies.

For more information, review the relevant provider policies:

10. Data Retention and Deletion

We retain information for as long as reasonably necessary to provide the Service, meet the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, and maintain security.

Retention periods vary by data type and purpose.

General retention approach by data category
Data categoryGeneral retention approach
Account informationRetained while your account is active and for a limited period afterward where needed for security, legal, dispute, fraud, or recordkeeping purposes
Account sessionsRetained until expiration, logout, revocation, or security-related removal
Public-profile analyticsRetained for a limited period and deleted or aggregated according to our operational retention settings
Uploaded media and related recordsRetained while the media remains available, until removed, or until any configured expiration period ends
Security, fraud, and diagnostic logsRetained for a limited period based on security, reliability, operational, and legal needs
Billing and transaction recordsRetained as necessary for accounting, tax, fraud prevention, dispute handling, and legal compliance
Support communicationsRetained as reasonably necessary to resolve issues, maintain support history, and protect legal interests

When you submit and we verify an account-deletion request, we will delete or de-identify personal account information and User Content from active systems, subject to lawful exceptions.

Deleted information may remain temporarily in backups, logs, security systems, or records required for legal, fraud-prevention, audit, dispute-resolution, or compliance purposes. These copies are access-restricted and are deleted or rotated according to our backup and retention practices.

Once account data and content are permanently deleted from active systems, the deletion cannot be undone.

11. International Data Transfers

Guap, its infrastructure providers, and its service providers may process information in the United States and other countries that may have privacy laws different from those in your country.

Where required, we use appropriate safeguards for cross-border transfers, such as contractual protections, recognized transfer mechanisms, technical security controls, and organizational measures.

By using the Service, you understand that your information may be processed in countries outside your place of residence, subject to applicable legal protections.

12. Security

We use reasonable technical, administrative, and organizational safeguards intended to protect information against unauthorized access, disclosure, alteration, loss, or misuse.

These safeguards may include:

  • Encryption in transit
  • Access controls and permission management
  • Password hashing
  • Session controls
  • Security logging and monitoring
  • Fraud and abuse detection
  • Infrastructure and network protections
  • Limited access to personal information by authorized personnel and providers

No online platform, storage environment, or transmission method is completely secure. We cannot guarantee absolute security.

If you believe your account has been accessed without authorization, contact support@guap.lol as soon as possible.

13. Your Privacy Rights

Depending on where you live and applicable law, you may have the right to:

  • Know whether we process your personal information
  • Access personal information we hold about you
  • Request a copy of your information in a portable format
  • Correct inaccurate or incomplete information
  • Request deletion of personal information
  • Restrict certain processing
  • Object to processing based on legitimate interests
  • Withdraw consent where processing depends on consent
  • Opt out of certain marketing communications
  • Lodge a complaint with your local privacy or data-protection authority
  • Avoid discrimination for exercising applicable privacy rights

Guap does not intentionally make decisions that produce legal or similarly significant effects solely through automated processing of personal information.

To submit a privacy request, email support@guap.lol. Where available, you may also be able to update, correct, export, or delete some account information through your account settings.

We may ask for information necessary to verify your identity before responding to a request. We will respond within the timeframes required by applicable law.

California privacy rights

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to Guap, you may have rights to know, access, correct, delete, and receive information about how we use or disclose personal information.

Based on this Policy, Guap states that it does not sell personal information for money and does not use personal information for cross-context behavioral advertising. If that changes, we will update this Policy and provide any required notice and opt-out tools.

14. Children’s Privacy

Guap is not directed to children under 13 years old, or a higher minimum age where required by law in your country or region.

We do not knowingly collect personal information from children below the applicable minimum age. If you believe that a child has provided personal information to Guap, contact support@guap.lol. We will investigate and take appropriate action, including deleting the information where required.

15. Changes to This Policy

We may revise this Privacy Policy when our practices, features, vendors, legal obligations, or operational needs change.

If we make changes, we will post the updated Policy on guap.lol and update the “Last Updated” date at the top. We may also provide additional notice through the Service or by email when required by law or when a change is material.

Your continued use of Guap after an updated Policy becomes effective means that you acknowledge the updated Policy, to the extent allowed by law.

16. Contact Us

For privacy questions, support requests, account deletion requests, or concerns about this Privacy Policy, contact:

support@guap.lol

For legal notices or law-enforcement requests, contact:

legal@guap.lol