The plainspoken version. Then the legal one.

Gabe (“Gabe,” “we,” “us”) is a software service operated by Gabe. We provide a business-management platform that combines a custom CRM, a generated website, and an AI co-operator for solo and small-team service businesses.

This Privacy Policy explains what information we collect when you use Gabe, how we use it, who we share it with, and what choices you have.

From you, directly

When you create an account and complete the onboarding wizard, you give us your email address, your business name and description, your customer terminology, your brand voice preferences, and similar details you choose to enter.

From your Google account, with your permission

If you connect your Gmail mailbox, we access:

• Your basic Google profile — the email address of the connected mailbox
• Read-only access to your Gmail messages — senders, recipients, subjects, bodies, and attachments
• Access to your Google Calendar events — we sync event titles, times, locations, and attendee names from your primary calendar and store them in your account. This lets Gabe remember past meetings, understand how you spend time with customers, and surface richer context in readings over time. The same permission lets Gabe add an event to your calendar, but only when you explicitly ask — never automatically.
• Permission to send email on your behalf — used only when you explicitly click Send on an outreach draft. We never send mail automatically or in the background.

We request these as gmail.readonly, gmail.send, and calendar.events scopes. Google asks you to explicitly grant each during the OAuth flow — you can grant Gmail without Calendar — and you can revoke any of them at any time from your Google Account Permissions page or from Gabe's Settings page.

Customer records you create

Any contact information, notes, observations, or other content you enter about your customers — directly or via accepted contact proposals — is stored in your tenant's database.

Automatically

We collect basic technical information — IP address, browser type, pages visited, timestamps — for security, debugging, and operational health. Errors and exceptions may be sent to Sentry.

Payment information

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your full card details; Stripe handles them under their own security standards.

We treat data obtained from Google APIs as the most sensitive category of information we handle. The following is the specific, limited use we make of your Google account data:

• Surfacing email threads on customer records. Synced emails are matched to customers in your CRM by email address. When you open a customer record, you see the threads associated with that customer.
• Proposing new contacts. We analyze the recipients of mail you have sent to identify people you appear to engage with who are not yet in your CRM. We extract their name, company, title, and similar details from message signatures, and present these as proposed contacts for you to review and accept or reject.
• Generating AI-assisted summaries and suggestions. Email content from a customer's threads may be passed to our AI model providers (Anthropic, OpenAI) to generate the record's summary, suggested next actions, and similar features that appear in your account.
• Scheduling context in Monday and Friday readings. When Calendar access is granted, event titles, times, and attendee names are stored in your account and passed to our AI model providers to compose the “a read on the week ahead” section of Monday's reading, enrich the Friday meeting, and build context about how you spend time with customers over time.

We do not use your Google user data for any other purpose. Specifically, we do not:

• Send email on your behalf, modify your mail, or delete messages
• Sell, rent, or share your Google user data with advertisers
• Use your Google user data to train or improve generalized AI/ML models
• Transfer your Google user data to other parties except as strictly required to provide the user-facing features described above, comply with applicable law, or with your explicit consent
• Allow humans at Gabe to read your messages, except (a) with your explicit consent for a specific message, (b) when necessary for security investigations, (c) when required by law, or (d) when needed to operate the service in aggregated or anonymized form

Gabe's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use the information you provide and the data we collect to:

• Operate the service — host your CRM, your website, your forms, and your account
• Generate AI-assisted output (CRM schema, brand voice, marketing plan, weekly agendas, chat responses, contact extractions) on your behalf
• Send you transactional email — sign-in codes, billing receipts, weekly insights, system notifications
• Bill you for paid subscriptions
• Detect, investigate, and prevent abuse, fraud, and security incidents
• Comply with applicable legal obligations

We use a small set of third-party service providers to operate Gabe. Each one acts as a data processor on our behalf and receives only the data needed for its function:

• Supabase — primary database and authentication infrastructure
• Vercel — hosting and serverless function runtime
• Anthropic — Claude API, used to generate AI output
• OpenAI — embeddings and voice transcription
• Google — Gmail and account profile data, with your explicit OAuth consent
• Resend — outbound transactional email delivery
• Stripe — subscription billing and payment processing
• Sentry — error and performance monitoring

When SMS-based features ship, we will add Twilio as a service provider for inbound and outbound text messages, and update this policy accordingly.

We keep your account information and customer records for as long as your account is active. If you cancel your subscription or close your account, we delete or anonymize your data within a reasonable period, except where we are required to retain it for legal, accounting, or security reasons.

You can disconnect your Gmail integration at any time from Settings. Disconnection stops new emails from syncing. Previously synced messages remain on your customer records until you delete them or close your account.

You can:

• Access the data we hold about you
• Correct inaccuracies in your account or records
• Request deletion of your account and associated data
• Export your customer records and notes
• Revoke Gabe's access to your Google account at any time via Google Account Permissions or via the Disconnect button on the Gabe Settings page
• Opt out of non-essential email from us

To exercise any of these rights, write to [contact@yourdomain].

We use industry-standard security practices to protect your data, including encryption of OAuth tokens at rest, row-level security in our database, and HTTPS for all data in transit. No system is perfectly secure; if we become aware of a security incident affecting your data, we will notify you in a timely manner.

Gabe is not intended for use by anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Gabe is operated from the United States. If you access the service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where our service providers are located.

We may update this Privacy Policy from time to time. When we make material changes, we update the “Effective” date at the top of this page and notify you by email or via the app. Continued use of Gabe after a change constitutes acceptance of the updated policy.

For privacy questions, data requests, or anything else covered by this policy, write to [contact@yourdomain].