Privacy

Draft for review. This page hasn't been reviewed by a lawyer yet, and items in [square brackets] are still to be filled in. Last updated 2026-11-05.

This page explains what information Gelaito handles, why, and what you can do about it. Gelaito is operated by [Operator's legal name]. Questions: [support email address].

What we store

• Your account: email address and a password. Passwords are handled by our sign-in provider and are never visible to us.
• Your workspace: business details you enter during setup, and the records you add (leads and customers, payments, expenses, tasks, saved emails), plus team members and their roles.
• Activity needed to run the service: subscription status, purchases of AI credit packs, AI credit balances and a record of each AI request (which action, who ran it, credits charged), automation run history, notifications, and an audit log of important changes (for example who invited or removed someone).
• If you request a demo: your name, email, company, team size, the plan you're interested in, the times that suit you and your message, plus a one-way fingerprint of your network address used only to slow down repeated submissions. We use these only to arrange the demo.
• AI answers are kept for up to 24 hours so a retried request isn't charged twice, then deleted. The record of the request (without the answer) is kept.

We use this information to provide Gelaito to you. We don't sell it, and we don't use your records for advertising.

Who processes it

• Supabase: sign-in and the database that stores your workspace.
• Vercel: hosting for the website and app.
• Stripe: payments for paid plans. Card details go straight to Stripe; Gelaito never receives your full card number.
• Our AI provider, [Anthropic or OpenAI, whichever is in use]: only when someone in your workspace uses an AI feature. The request includes the text shown in the AI preview, or for analyses and Gelaito Intelligence, your question plus summary figures calculated from your records. Contacts' email addresses and phone numbers are left out.
• [Email delivery provider]: sign-up confirmation and password reset emails.
• [Invitation email provider, for example Resend]: when someone invites you to a workspace, your email address, the workspace name and the invitation link.

Data may be processed in [hosting region(s)].

Cookies and storage

Gelaito uses cookies that are needed to keep you signed in and remember which workspace you're using. It also stores a few display preferences (like light or dark mode) in your browser. There are no advertising cookies. The installable app keeps a small offline page and the app's code on your device, but not your records.

Gelaito doesn't use analytics or tracking tools.

Your choices

• Export: download all of a workspace's records at any time from Settings, on every plan.
• Delete: workspace owners can delete a workspace, and anyone can delete their account, from Settings. This removes the data from our live database straight away.
• Our providers may keep backups for a limited time under their own schedules: [backup retention period].
• For anything else, including questions about your rights where you live, contact [support email address].

Security

Connections are encrypted (HTTPS). Each workspace's records are separated in the database so one workspace can't read another's, and AI provider keys stay on our servers. No system is perfectly secure; please use a strong, unique password.

Children

Gelaito is a business tool and isn't intended for children.

Changes

If this policy changes in a way that matters, we'll update this page and the date above, and tell account holders by email or in the app.