Privacy Notice

Section 1 – Changes to This Notice

We may update this Notice from time to time as our platform evolves, as we introduce new features, or as applicable laws change. When we make material changes, we will notify you by posting the updated Notice on the Site and, where appropriate, by sending an email notification to your registered address. The “Last Updated” date at the top of this page reflects when the Notice was most recently revised.

Your continued use of the Services after any update constitutes your acceptance of the revised Notice. We encourage you to review this Notice periodically.

Section 2 – Information We Collect

We collect information about you in three ways: information you give us directly, information we collect automatically as you use the Services, and information we may receive from third parties.

A. Information You Provide to Us

• Account Registration. When you create a GUSU account, we collect your name, email address, and the password you choose (stored in hashed form). Account creation is required to participate in a Group Buy.
• Shipping Information. To deliver your order, we collect your delivery address. You may save one or more addresses to your account for convenience.
• Payment Information. When you join a Group Buy, you provide payment details directly to Stripe, our payment processor. GUSU does not store, access, or transmit your full card details. We receive only a tokenized reference and the last four digits of your card from Stripe.
• Group Buy Preferences. When you join a Group Buy, we collect your product selection, chosen quantity, size or variant (where applicable), and any product-specific options.
• User-Generated Content. If you submit a product review, upload a photo, post in a community discussion, or ask a question on a product page, we collect the content of that submission along with any associated media files.
• Referral Activity. When you share a Group Buy link using our share feature, we may record that you shared the link and track whether others joined through it. When we launch our referral credit program, we will collect additional information needed to identify and reward qualifying referrals.
• Customer Support Communications. When you contact our support team—whether through Order → Order ID → Get Help or by email—we collect the content of your messages and any documentation you provide.
• Voluntary Submissions. Any other information you choose to provide, such as through surveys, feedback forms, or other features we may offer.

B. Information We Collect Automatically

• Usage and Interaction Data. Pages and product listings you view, Group Buy pages you visit, share link activity, features you use, search queries you enter, and time spent on the Site.
• Device and Log Information. Your IP address, browser type and version, operating system, device type and identifiers, referring URL, and date and time of requests made to our servers.
• Order and Transaction Data. Your Group Buy participation history (including groups joined, groups that expired, groups you left voluntarily, and fulfilled orders), payment hold and release events, and order status progression.
• Cookies and Tracking Technologies. We use cookies and similar technologies as described in Section 6 of this Notice.

C. Information We Receive From Third Parties

• Stripe. Stripe may share tokenized payment references, payment status, and authorization or decline information with us in connection with your payment activity on the Services.
• Analytics Providers. Our analytics service providers (currently Google Analytics) provide us with aggregated reports about how users interact with the Site.
• Advertising Platforms (Future). When we activate advertising integrations (such as Meta Ads or TikTok Ads), those platforms may provide audience or attribution data as described in Section 6 below.
• Brand Partners (Future). When our Brand Partner Program launches and independent brands manage their own storefronts on GUSU, participating brands may provide us with fulfillment updates or dispute-related communications that reference your order.

Section 3 – How We Use Your Information

We use the information we collect for the following purposes:

• Operating the Group Buy Platform. To process your Group Buy participation, track progress toward minimum member goals, send automated status notifications (Unlocked, Failed, Shipped, Delivered), manage payment holds and releases through Stripe, and coordinate order sourcing and fulfillment once a Group Buy is successfully unlocked.
• Account Management. To create and maintain your account, authenticate your identity at login, and enable account features such as saved addresses, order history, and settings.
• Payment Processing. To communicate with Stripe about authorization holds, payment captures, and refund initiations in connection with your Group Buy activity.
• Order Fulfillment. Currently, GUSU fulfills all orders directly. We use your shipping address exclusively to arrange delivery of your confirmed order.
• User-Generated Content. To publish your reviews, photos, and community posts on the Services, to enable other members to interact with your content, and to moderate content in accordance with our community guidelines.
• Referral and Incentive Programs. To track referral activity and, once our referral credit program launches, to calculate and apply credits to qualifying accounts.
• Customer Support. To respond to your inquiries, resolve disputes, investigate issues, and improve our support processes.
• Platform Improvement and Analytics. To analyze how users engage with the Services, identify feature improvements, troubleshoot technical issues, and understand Group Buy performance patterns.
• Personalization. To tailor product recommendations, surface relevant Group Buys, and personalize your experience based on your activity and preferences.
• Marketing and Advertising. To send you promotional communications you have opted into, and—once we activate advertising tools—to deliver targeted advertising through third-party platforms as described in Section 6.
• Legal Compliance and Safety. To comply with applicable laws and regulations, enforce our Terms of Service, detect and prevent fraud and abuse, respond to legal process, and protect the rights, safety, and property of GUSU, our members, and others.
• De-identified and Aggregated Research. We may de-identify or aggregate personal information and use it for internal research, business intelligence, and public reporting. De-identified or aggregated data does not identify you personally and is not subject to this Notice.

Section 4 – How We Share Your Information

We do not sell your personal information. We share your information only as described in this Notice and as permitted or required by applicable law. The table below summarizes how and with whom we share your information, including changes anticipated as our platform grows.

Section 5 – Group Buy Payment Mechanics and Stripe

Because GUSU’s payment model differs from a standard retail checkout, we want to be fully transparent about how your payment information is handled at each stage of a Group Buy.

• Authorization Hold. When you join a Group Buy, Stripe places a temporary authorization hold on your payment method for the full amount (including any applicable shipping). This hold reserves your spot without immediately charging you. Your bank may reflect this as a pending transaction.
• Charge Upon Unlock. Your payment is only captured when the Group Buy reaches its minimum member goal and the group price is unlocked. If you join after the price is already unlocked during the final 24-hour window, your payment is captured at the moment of checkout.
• Automatic Release on Expiry. If the Group Buy does not reach its minimum member goal within the 6-day window, all holds are automatically released. No action is required. Funds typically reflect in your account within a few hours, though your bank’s processing times may vary.
• Voluntary Leave. You may leave a Group Buy and have your hold released at any time before the group price has been unlocked by selecting “Leave Group Buy” on your Orders page.
• Refunds. Refunds initiated by GUSU are processed back to your original payment method through Stripe. We cannot issue refunds to a different card or payment method.
• PCI Compliance. Stripe is a PCI-DSS Level 1 certified payment processor. We do not store, log, or have access to your full card number. All payment data is transmitted directly between your browser and Stripe over encrypted connections.

Section 6 – Advertising, Analytics, and Tracking Technologies

A. Cookies We Use Today

• Essential Cookies. These are required for the Services to function. They maintain your login session, preserve your Group Buy cart state and product selections, and enable checkout. These cookies cannot be disabled without breaking core platform functionality.
• Analytics Cookies. We use Google Analytics with IP anonymization to understand aggregate usage patterns—such as which product categories attract the most interest and how members navigate the Group Buy flow. This data is collected in aggregate and does not personally identify you. You can opt out by installing the Google Analytics Opt-out Browser Add-on.

B. Advertising Tools We Plan to Activate

We do not currently use advertising tracking pixels or run paid advertising campaigns. We plan to activate the following advertising tools in the future. Before doing so, we will update this Notice and provide you with clear opt-out mechanisms:

• Meta Pixel (Facebook / Instagram). Allows Meta to match Site visitors with Meta accounts in order to serve relevant ads, measure ad effectiveness, and build custom audiences.
• TikTok Pixel. Enables TikTok to attribute conversions and serve relevant ads to users who have visited our Site.
• Google Ads / Remarketing. Allows us to show ads to past Site visitors across the Google Display Network and measure campaign performance.

When these tools are active, you will be able to manage your preferences through our cookie consent interface, through your browser settings, or by following the opt-out instructions provided by each advertising platform.

C. Do Not Track and Global Privacy Control

We do not currently respond to “Do Not Track” browser signals. However, we recognize and honor the Global Privacy Control (GPC) signal to the extent required by applicable law. If you broadcast a GPC signal, we will treat it as a request to opt out of the sale or sharing of your personal information for cross-contextual behavioral advertising. To learn more, visit globalprivacycontrol.org.

D. Third-Party Tracking

Third-party analytics and advertising services operate under their own privacy policies, which govern their collection and use of data collected through their tools. We do not control these third parties and encourage you to review their policies directly.

Section 7 – User-Generated Content

GUSU allows members to submit product reviews, upload photos, and participate in community discussions. When you submit User-Generated Content (“UGC”), please be aware of the following:

• Public Visibility. Reviews, ratings, photos, and community posts you submit may be displayed publicly on the Site. Do not include personal information in UGC that you do not wish to be publicly visible.
• Our License to Use Your Content. By submitting UGC, you grant GUSU a non-exclusive, royalty-free, worldwide license to display, distribute, and promote your content on the Services and in our marketing materials in connection with GUSU’s business.
• Brand Visibility (Future). When the Brand Partner Program launches, brands whose products are reviewed may be able to view and respond to reviews of their products on the GUSU platform.
• Content Moderation. We reserve the right to remove UGC that violates our community guidelines, Terms of Service, or applicable law.
• Your Responsibility. You are responsible for the content you submit. Do not submit UGC that infringes third-party rights, contains false or misleading claims, or violates any applicable law.

Section 8 – Data Security

We take the security of your personal information seriously and implement commercially reasonable administrative, technical, and physical safeguards to protect it against unauthorized access, alteration, disclosure, or destruction.

• All data transmitted between your browser and our servers is encrypted using SSL/TLS.
• Passwords are stored using one-way cryptographic hashing; we do not have access to your plaintext password.
• Payment data is handled exclusively by Stripe under PCI-DSS Level 1 compliance. We store only a tokenized reference.
• Access to personal information within GUSU is limited to personnel who need it to perform their job functions.
• We conduct periodic security reviews and maintain a process for identifying and addressing vulnerabilities.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you transmit information to us at your own risk. If you believe your account has been compromised or you become aware of a security issue affecting the Services, please contact us immediately at contact@gusu.co.

Section 9 – Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Notice and to comply with our legal obligations.

• Account Information. Retained while your account is active and for a reasonable period after you close your account, to handle any pending matters and meet legal requirements.
• Order and Group Buy Records. Transaction records—including records of expired, failed, and fulfilled Group Buys—are retained as required for accounting, tax, and legal compliance purposes.
• Payment Authorization Data. Authorization and capture records are retained as required by Stripe’s policies and applicable financial regulations.
• User-Generated Content. Reviews, photos, and community posts are retained until you request deletion or we remove them in accordance with our community guidelines.
• Customer Support Communications. Retained for a reasonable period for record-keeping, dispute resolution, and service quality purposes.
• Analytics Data. Anonymized or aggregated analytics data may be retained indefinitely as it does not identify you personally.

When we no longer have a legitimate purpose to retain your personal information, we will either delete it or anonymize it. If deletion is not immediately possible (for example, because data is stored in backup archives), we will securely isolate it from further processing until deletion is feasible.

Section 10 – Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information. GUSU respects and supports these rights and will respond to verifiable requests within the timeframes required by applicable law.

• Right to Know / Access. You may request confirmation of whether we process your personal information and access to the specific pieces of information we hold about you, the categories collected, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Correction. You may request that we correct inaccurate or incomplete personal information we hold about you.
• Right to Deletion. You may request that we delete your personal information, subject to exceptions under applicable law (for example, we may need to retain transaction records for legal and accounting purposes).
• Right to Data Portability. You may request a copy of certain personal information you have provided to us in a structured, commonly used, machine-readable format.
• Right to Opt Out of Sale or Sharing. We do not currently sell your personal information. When we activate advertising tools that involve sharing data with advertising platforms, we will provide a clear opt-out mechanism.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights.
• Right to Lodge a Complaint. If you believe we have not handled your personal information lawfully, you have the right to file a complaint with your state Attorney General’s office or other applicable supervisory authority.

To exercise any of these rights, please email us at contact@gusu.co with sufficient information to verify your identity and describe your request. We will respond within the timeframe required by the law applicable to your jurisdiction.

Section 11 – Additional Rights for California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). This section supplements the rights described in Section 10.

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information as defined under the CCPA:

• Identifiers: Name, email address, IP address, device identifiers.
• Personal Information (Cal. Civ. Code §1798.80): Name, address, payment card information (collected by Stripe on our behalf).
• Commercial Information: Group Buy participation history, order records, product preferences.
• Internet or Network Activity: Browsing behavior on the Site, features used, referral activity.
• Inferences: Product preferences and interests inferred from your activity on the Services.
• Sensitive Personal Information: Account credentials (login and password). We do not use sensitive personal information for purposes beyond those permitted under the CPRA.

Sale or Sharing of Personal Information

We do not sell your personal information as that term is defined under the CCPA. We currently do not share personal information with third parties for cross-contextual behavioral advertising. When we activate advertising tools in the future, we will update this Notice and provide a “Do Not Sell or Share My Personal Information” link on the Site.

Exercising Your California Rights

To submit a request, email us at contact@gusu.co with the subject line “California Privacy Request.” We will respond within 45 days of receipt and may extend that period by an additional 45 days where necessary, with notice. You may also designate an authorized agent to submit a request on your behalf; we will require written proof of authorization and may verify your identity directly.

Section 12 – Children’s Privacy

The Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. Users between the ages of 13 and 15 may use the Services only with the verifiable consent of a parent or legal guardian.

If we discover that we have inadvertently collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe we have collected such information, please contact us at contact@gusu.co.

Section 13 – Marketing Communications and Referral Program

A. Transactional Communications

Regardless of your marketing preferences, we will send you transactional communications that are essential to the Services. These include Group Buy status notifications (Unlocked, Failed), order confirmations, shipping and delivery notifications, payment hold and release confirmations, refund confirmations, and security or account alerts. You cannot opt out of these communications while your account remains active.

B. Promotional Communications

We will only send you promotional communications—such as new Group Buy announcements, featured brand spotlights, or platform updates—if you have explicitly opted in. You may opt out at any time by:

• Clicking the unsubscribe link in any promotional email.
• Updating your communication preferences in your account settings.
• Emailing us at contact@gusu.co.

C. Referral Program

GUSU’s referral credit program is coming soon. When launched, sharing a Group Buy link with others who then join the same group may earn you platform credits. To operate the referral program, we will track sharing activity and attribution. Specific terms, eligibility requirements, and the information collected for referral tracking will be disclosed when the program launches. This Notice will be updated accordingly.

Section 14 – Third-Party Links and Services

The Services may contain links to third-party websites, social media platforms, or brand websites. These third parties operate under their own privacy policies, which we do not control and for which we are not responsible. We encourage you to review those policies before providing any personal information to a third party. The fact that a third party is linked to from our Services does not constitute an endorsement of that third party or its privacy practices.

Section 15 – U.S.-Only Platform

The Services are currently available only to users located in the United States. We ship only within the United States. If you access the Services from outside the United States, you do so voluntarily and at your own risk, and you are responsible for compliance with the laws of your jurisdiction. By using the Services from outside the U.S., you consent to the transfer and processing of your personal information in the United States.

Section 16 – Contact Us

If you have questions about this Notice, wish to exercise your privacy rights, or want to report a potential security issue, please reach out:

GUSU.inc
Email: contact@gusu.co
Website: www.gusu.co

We will respond to all inquiries within 30 days of receipt.