Privacy Policy

Effective October 2, 2026. This policy covers NotUserError.com, the central dispatch and organization tool operated by GateIron, LLC.

Information We Collect

• Organization information including name, logo, related domains, chat webhooks, AI integration tokens, sending email address, its members' names, emails and access levels.
• Individual user information including name, username, avatar, email and OAuth account identifier.
• Requests and request metadata including title, description and uploaded files, as well as who made the request. The requests are user-provided content that will contain what the user chooses to put in them.
• Questions, answers and other comments made during the answering of requests. These are also user-provided content that will contain what the user chooses to put in them.
• Dates and history of events related to the answering of requests, including status at various times, dates and times of specific user access, deletion, approvals, denials and other status handling.
• Server logs of errors and service events, with timestamps.

Data Location and Movement

All live data is encrypted in transit and housed on AWS servers in the United States. The database itself keeps each organization's data separate from every other organization's.

Backups are stored encrypted, and in multiple USA regions, with AWS, Hostinger and on GateIron's own equipment.

How We Use It

Request information is used to assist in the organization and operation of an efficient workflow: to route work, to notify people involved, and to keep record of what was requested, what was completed, when and by whom.

Account information is used to identify users, to determine which organization they belong to, and what roles and privileges they should have in the processing of requests.

Server logs are used for debugging, diagnostics and abuse investigation.

Who Can Access Data

• A standard request is visible to the person who created it, the entire staff of the organization it was filed in, and potentially the public at large if the organization has chosen to make its work public.
• An anonymous request has visibility set at the discretion of the subscribing organization.
• A confidential request is visible within our system to the person making the request, administrators responsible for approving and allocating resources, staff assigned to complete the request, and specific members of the organization who are intentionally brought into the request by someone working on it.
• The service-provider has full access to all data and logs, for support and operation of the service.

Email

We do not operate a mailing list. We do not sell email addresses. We do not share user data for any purpose other than for expediting work, except as required by law.

Disclosure

We do not share personal information for advertising or marketing, and we do not sell it. Information is disclosed only to the Third-Party Services listed below, to the extent required for them to operate, and where required by law.

Third-Party Services

• Amazon Web Services — hosting and database. Handles all data stored by this service.
• Amazon SES - outgoing email. Email sent by this service passes through its servers.
• Google Sign-In — used for sign-in. Google supplies the account identifier, email address and name.
• Microsoft Sign-In — used for sign-in. Microsoft supplies the account identifier, email address and name.
• Hostinger — off-site backup storage. Holds encrypted backup copies of all data stored by this service.

Integrations a subscribing organization turns on, such as a chat space or an AI assistant, use and retain the data sent to them under their own privacy and data retention policies.

Cookies and Local Storage

A signed-in session uses session cookies to manage sign in. There are no advertising cookies and no third-party analytics. Local storage in the browser keeps display preferences, such as column widths.

Retention

Requests, comments, attachments and history are the subscribing organization's records and are retained while the organization's agreement with GateIron, LLC is in effect. Records will be retained for a minimum of 6 months and a maximum of 3 years beyond the subscription period to ease restarting the service, unless deletion is requested earlier by the subscriber.

Server logs are deleted on a rolling basis, oldest first, once they reach a size limit, and in full whenever the service is updated, whichever comes first.

Backups are retained for a minimum of 14 days and a maximum of 2 years depending on the backup. The backup strategy is designed to provide reliable restoration of recent data. Backups exist to recover from a loss of the service, not to restore records an organization has changed or deleted. A deleted record remains in backups until they expire.

Access and Deletion

All data housed in NotUserError is owned by the organization that created and manages it. An organization may export its data at any time, and may correct or delete its own records. Where data protection law grants a person rights over their personal information, those rights apply. The first recourse is to ask the subscribing organization to remove covered data, which it can do directly in the NotUserError web application. If the required removal is not completed, request deletion via our 'Contact' form.

Children

This service is not directed to children and does not knowingly collect personal information from anyone under 13.

Changes

This policy is updated when what we collect or how we use it changes. The effective date above is revised at the same time.

Contact

GateIron, LLC, Oregon, United States. Use the contact form to reach us.