Ethics & Compliance Protocol

1. Overview & Mission

At GatiFlow, we believe that data intelligence should never come at the expense of privacy, ethics, or legal compliance. Our mission is to provide enterprise-grade data insights while maintaining the highest standards of ethical data sourcing.

Core Commitment:

We source data exclusively from public sources, respect all applicable laws and regulations, and operate with complete transparency about our methods and sources.

What makes us different:

✓ Compliance-first architecture designed from the ground up

✓ Minimal public data only — no private PII, emails, or authenticated content

✓ Complete source attribution and auditability

2. Data Sources & Collection

2.1 Approved Public Sources

Code Hosting: GitHub public repositories, contribution graphs, and API metadata (via official API)

Developer Q&A: StackOverflow public questions and tags (via official API)

Tech Communities: HackerNews public posts and comments + Dev.to public articles (via official APIs)

Academic Research: arXiv research papers in CS and AI + OpenReview peer-review records (via official APIs)

Package Registries: npm and PyPI public package metadata and download statistics (via official APIs)

Job Boards: Adzuna and Remotive public job listings, plus public postings on company boards hosted by Greenhouse and Lever (via official APIs)

AI/ML Community: HuggingFace public model and dataset metadata (via official API)

Regulatory Filings: SEC EDGAR public regulatory filings of legal entities, used solely for entity-level signals — no natural-person data is extracted from this source

2.2 What We Never Access

❌ Private user profiles or accounts

❌ Email addresses or contact information

❌ Personal messages or communications

❌ Paywalled or subscription-only content

❌ Data behind authentication or login walls

❌ Social media private posts

❌ Any source marked as 'do not scrape' in robots.txt

2.3 Collection Methodology

API-First: We prioritize official APIs over web scraping whenever available

Rate Limiting: Exponential backoff with jitter; Retry-After headers and source-defined rate limits respected

robots.txt Compliance: Automated verification of robots.txt before any collection

User-Agent Declaration: All requests identify as GatiFlow with contact information

Scheduled Collection: Automated pipeline runs every 6 hours; failed sources degrade gracefully

3. Legal Compliance Framework

3.1 GDPR Compliance (European Union)

Legal Basis: Legitimate interest for publicly available data (Article 6(1)(f))

Data Minimization: We collect only what's necessary for stated purposes (Article 5(1)(c))

Purpose Limitation: Data used only for business intelligence, not profiling (Article 5(1)(b))

Storage Limitation: Data retained only as long as necessary (Article 5(1)(e))

Right to Object: Individuals can request data removal (Article 21)

Data Inquiries: Written requests handled via privacy@gatiflow.io within one month (Article 12)

3.2 LGPD Compliance (Brazil)

Legal Foundation: Legitimate interest in publicly available data (Article 7, IX) — see /privacy for full LIA

Transparency: Clear communication of processing activities (Article 9)

Data Subject Rights: Access, correction, and deletion rights honored (Article 18)

Security Measures: Technical safeguards as required (Article 46)

International Transfers: Adequate protection mechanisms in place (Article 33)

Data Inquiries: Written requests handled via privacy@gatiflow.io within 15 business days (Article 19)

3.3 CCPA Compliance (California)

Publicly Available Information: Exemption under CCPA § 1798.140(o)(2)

Notice Requirement: Clear privacy policy and data use disclosure

Opt-Out Rights: Mechanisms for data removal requests via /opt-out

No Sale of Data: We do not sell personal information

3.4 Other Regulations

4. Ethical Principles

4.1 Transparency

✓ Public documentation of all data sources

✓ Clear explanation of collection methodologies

✓ Open communication about data use and purposes

✓ Regular publication of compliance reports

✓ Accessible contact channels for concerns

✓ Public claims are verifiable in our codebase — what we say we do is what the system actually does

✓ Aspirational language is avoided — we document what is, not what should be

4.2 Privacy Protection

No PII Collection: Zero collection of names, emails, addresses, or phone numbers

Anonymization: All data is aggregated and anonymized before storage

Data Minimization: We collect only aggregate trends, not individual records

Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)

Access Controls: Strict role-based access to data systems

4.3 Social Responsibility

✓ No facilitation of discrimination or bias

✓ No contribution to surveillance or tracking

✓ No support for harmful applications

✓ Commitment to beneficial use cases only

✓ Regular ethical review of practices

4.4 Data Accuracy Over Volume

Verified Signals: A report with a smaller set of verified signals is more valuable than an inflated count of unverified ones

No Fabrication: Numeric claims (download counts, mention counts, source coverage) are sourced from real collector data — never approximated, never inflated

Qualitative Fallback: When a number is unavailable or low-confidence, narratives use qualitative language rather than fabricating a figure

4.5 AI Content Integrity

Always Labeled: Every AI-generated narrative is marked with a metadata.ai_generated flag and displayed with a clear visual indication in the user interface

Fact-Checked: Narratives are post-processed by an automated fact-checker that verifies numeric claims against actual collector data before publication

Qualitative Replacement: Unverifiable statistics are replaced with qualitative language rather than fabricated numbers

4.6 Training Data

GatiFlow trains, fine-tunes or distils no machine-learning model, so there is no training dataset to summarise. The narratives and the Deep Dive are written by a third-party model, Anthropic Claude, called through its API; the Privacy Policy lists it as a processor, and every output it writes carries the metadata.ai_generated declaration described above. Customer Data trains no model: GatiFlow has none of its own, and section 9.2 of the Terms of Service rules out shared ones. Customers may not train models on GatiFlow outputs either (Acceptable Use Policy, section 5.5).

5. Technical Safeguards

5.1 Automated Compliance Checks

Every data point passes through our compliance engine before storage:

✓ Verification of public availability

✓ PII detection and filtering

✓ robots.txt validation

✓ License compatibility check

✓ Rate limit enforcement

✓ Source attribution tagging

5.2 Security Measures

5.3 Data Retention

Default Retention: 90 days for free tier, configurable for paid plans

Automatic Deletion: Data automatically purged after retention period

Opt-Out Processing: Processed within 15 business days (LGPD Art. 19), well within GDPR Art. 12, via /opt-out

Audit Logs: Compliance logs retained for 7 years (minimal metadata only)

6. Prohibited Practices

GatiFlow Absolutely Prohibits:

❌ Collection of personal identifiable information (PII)

❌ Circumvention of authentication or paywalls

❌ Ignoring robots.txt or Terms of Service

❌ Aggressive scraping that harms source servers

❌ Sale or sharing of raw collected data

❌ Use of data for individual profiling or targeting

❌ Collection from social media private accounts

❌ Scraping of children's data (COPPA compliance)

❌ Use of data for discriminatory purposes

❌ Training AI models on collected data without explicit consent

Enforcement

Any violation results in:

1. Immediate suspension of data collection

2. Automatic deletion of affected data

3. Internal investigation and corrective action

4. Notification to affected parties if applicable

5. External audit if breach severity warrants

7. Audit & Transparency

7.1 Third-Party Audits

Annual Security Audit: Infrastructure and data protection assessment

Compliance Certification: GDPR/LGPD compliance verification

Penetration Testing: Quarterly security vulnerability assessment

SOC 2 Type II: (In progress) Service organization control certification

7.2 Data Subject Rights

7.3 Continuous Internal Audit

Weekly Audit Cycle: The platform undergoes a full audit cycle every week. Findings are fixed in the same week and tracked in versioned audit documents

Discrepancies Are Critical: Any drift between this compliance documentation and the actual system behaviour is treated as a critical finding and prioritized for correction

Living Document: This page is version-controlled and updated alongside the codebase — every claim here corresponds to an implemented control

8. Contact & Reporting

Have questions or concerns about our compliance practices? We welcome feedback and take all compliance matters seriously.

General: contact@gatiflow.io

Compliance: compliance@gatiflow.io

Data Protection Officer: dpo@gatiflow.io

Security Issues: security@gatiflow.io

Based in Brazil • Serving Clients Worldwide • All inquiries responded to within 2 business days