Draft, pending review. This text is a placeholder for the structure of the final document. The wording is being prepared and has not been approved; do not rely on it.
Last updated: October 2026Privacy Policy
What we collect, why we collect it, and the control you have over it.
01What we collect
We collect what you give us when you sign up: your name, your university email, your field of study and your year. We collect what you add to your profile: a headline, a bio, skills, interests, availability, past work, a photo and links. We collect what you do on Gamboa: the projects you create and the roles you apply to, with your answers and CV. We also keep your messages, posts, connections, saved items and settings. Our servers keep technical records of requests, and an error report when something breaks. When you sign up, our sign-in provider runs a bot check in your browser. We do not collect payment details, government identifiers, phone numbers or your precise location, and we re-encode uploaded photos, which removes their location data. We do not use advertising or analytics trackers, and we do not track you across other websites, so a Do Not Track signal changes nothing.
02How the match uses your data
The match compares your profile with what a project asks for, on five signals: skills, role fit, interests, availability and experience. It uses only what is on your profile, never your messages. The score is between you and a project, never between you and another student. You see it on projects you browse.
03What we share
Students at your university see your profile, filtered by your privacy settings, and the projects you publish, unless you keep them private. Anyone with the link can see your profile photo and a project's cover and logo. Anyone, signed in or not, can read the title and one-line summary of a project listed on the board. Founders you apply to see your application. People you message see your messages. A post you write on Explore reaches your whole campus or only your connections, as you choose. A post in a project's thread reaches everyone who can see the project. Comments reach the people who can see the post. We do not sell your personal data, and we do not share it for advertising. Five companies run parts of our service for us, under contract. Render hosts the service and the database. Clerk runs sign-in. Cloudflare stores files and protects the network. Resend sends email. Sentry receives error reports and a sample of request timings.
04Your university's role
Your university brings Gamboa to campus and does not run it. It sees counts: how many students joined, how many teams formed and how many projects are open. It sees the list of projects open to the whole campus with each founder's name, which every student on campus can see too. It does not see your profile, your messages, your applications or who you connected with. Gamboa, not your university, is responsible for your data here.
05Retention
We keep your data while your account is open. When you delete your account, your profile, applications, connections, saved items, settings and Explore posts are deleted at once. Your files are deleted shortly after. If something of yours was reported, the copy saved with the report stays as long as the report does. That copy can include your name. We also ask Clerk, our sign-in provider, to delete your sign-in account, and Clerk keeps its own logs under its own policy. Messages you sent stay visible to the people you wrote to for 30 days, with your name removed, then they are deleted. Messages under a report we are still reviewing stay until the report is closed. Posts and updates you wrote on other students' projects, and replies you left on their posts, stay with your name removed. Notifications that other students already received keep your name where they showed it. A closed project you founded that still has teammates stays as the team's history. We keep a record that an account existed and was deleted, without your name or email. Deleted data can remain in our backups for up to 14 days, and we use backups only to recover from a failure. Reports to our moderators are kept for 12 months after the report is closed, then deleted. Content our moderators removed is kept for up to 12 months after the removal, or after its report closes if later, then deleted. A post or comment you delete, or a founder removes from their project, is kept hidden for the same time, then deleted. Records of moderation actions are kept for 24 months. Technical records of requests are kept for up to 30 days. Error reports and request timings are kept for up to 90 days. If your university is not on Gamboa yet and you leave an email, we keep it for up to 12 months. We use it only to tell you when your university joins, and to count which universities students ask for. If your university's partnership with Gamboa ends, we tell you, keep your account for 90 days so you can take a copy, then delete it.
06Your rights
You can see and change your profile and your settings at any time. You can delete your account in Settings; the deletion is immediate and cannot be undone. If you founded a project that is still running and has teammates, you close it first, or ask us through the Help form. You can ask for a copy of your data through the Help form while signed in, and we send it within 10 business days. You can ask us to correct or delete anything we hold about you the same way. Every student has these rights, wherever they live.
07Security
Your data travels encrypted between your browser and our servers, and between our servers and the companies that run parts of our service. Your password is held by Clerk, our sign-in provider, never by us. CVs and other private files sit in a private store and open only through short-lived links after a permission check. Access to student data inside Gamboa is limited to the people who run it, and every moderation action is logged. If a security incident affects your personal data, we tell you and your university without unreasonable delay, and within any deadline the law sets.
08Contact
Write to us with any privacy question or request through the Help form, or at support@gamboaconnect.com. Messages you send through the Help form reach that mailbox with your account email, so we can reply. If we change this policy in a way that matters to you, we email you before the change takes effect and update the date above. Gamboa is operated by Gamboa Connect, S.A., a company registered in Panama. Our address: Provincia de Panamá, Distrito de Panamá, Corregimiento de Betania, Calle Ricardo J. Alfaro, Edificio City Center, Departamento 2, Urbanización Villa de Las Fuentes, Ciudad de Panamá, Panamá.