Gabay Privacy Policy

This Privacy Policy explains how Gabay collects, uses, stores, and protects information when you use our website, applications, and related services.

This document is designed for transparency and plain language. It does not limit rights that may apply under privacy laws in your region.

We collect information you provide directly, information created through your use of the service, and limited technical information needed for security and operations.

• Account and profile data, such as your name, email, avatar, and authentication provider details.
• Workspace content, including projects, tasks, notes, reminders, workflow settings, and files you upload.
• AI interaction data, such as prompts, model outputs, and tool-call context needed to provide AI features.
• Technical and diagnostic data, such as IP address, browser type, device identifiers, logs, and error traces.
• Communication data if you contact support or respond to service-related messages.

We use personal information only for legitimate product and operational purposes.

• Provide and maintain core functionality, including authentication, syncing, reminders, and workflow execution.
• Improve reliability, performance, and product quality through analytics and diagnostics.
• Deliver AI-assisted functionality based on your explicit prompts and selected actions.
• Detect and prevent fraud, abuse, unauthorized access, and platform misuse.
• Comply with applicable law, enforce terms, and protect users and service integrity.

Gabay offers AI features that process inputs you provide. These features may generate suggestions, summaries, schedules, drafts, and other outputs.

• AI inputs may include prompt text and related workspace context necessary to fulfill your request.
• Generated output may be inaccurate or incomplete and should be reviewed before relying on it.
• You are responsible for your decisions and actions based on AI-generated output.
• We may use service providers to process AI requests under contractual and security controls.

Where required by law, we process personal information under valid legal bases such as contract performance, legitimate interests, legal obligations, and consent.

When we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already completed before consent was withdrawn.

We do not sell personal information. We may share data with trusted providers that help us operate the service.

• Hosting and infrastructure providers.
• Authentication and identity providers.
• Analytics, diagnostics, and observability providers.
• Communication and notification providers (for example, email delivery).
• AI model and inference providers used to deliver requested AI functionality.

We may also disclose data when required by law or to protect rights, safety, and security.

Your information may be processed in countries other than your own. Where required, we apply safeguards for cross-border transfers.

These safeguards may include contractual clauses, access controls, encryption, and internal governance measures.

We keep data for as long as needed to provide the service, support operations, and comply with legal obligations.

• Account and workspace data are generally retained while your account is active.
• Backups and logs may be retained for limited periods for recovery, auditing, and abuse prevention.
• Data may be retained longer if required by law, regulation, or dispute-resolution needs.
• When eligible, data is deleted or anonymized after account closure or valid deletion request.

We use administrative, technical, and organizational safeguards to protect personal information.

• Access control and authentication safeguards.
• Encryption in transit and other platform security controls.
• Monitoring, logging, and incident response procedures.
• Role-based access principles and provider due diligence.

No system is completely secure. You should also protect your account credentials and device security.

Depending on your location, you may have privacy rights such as access, correction, deletion, portability, and objection to certain processing.

• Access and review information associated with your account.
• Correct inaccurate personal data.
• Request deletion of eligible personal data.
• Object to or restrict specific processing in applicable jurisdictions.
• Withdraw consent where processing is based on consent.

You may exercise rights by contacting support at hi@aigabay.xyz.

Gabay is not directed to children under the age required by local law to provide valid consent for online services.

If you believe a child submitted personal information in violation of applicable law, contact us and we will take appropriate action.

We may update this Privacy Policy to reflect legal, product, or operational changes. When material updates are made, we will update the effective date and provide notice as required.

Continued use of Gabay after policy updates constitutes acceptance of the revised terms, unless otherwise required by law.

For privacy questions, requests, or concerns, contact the Gabay team at hi@aigabay.xyz.

We recommend reviewing this policy periodically to stay informed about how data is handled.