Privacy Policy

Effective Date: October 5, 2026

Gallic ("we," "us," or "our") operates the Gallic platform, including work.gallic.com, compute.gallic.com, and related services (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use our Service, and the choices you have regarding that information. It applies to all users of the Service and to any Google user data we access through Google OAuth and Google APIs.

1. Information We Collect

Account Information: When you create an account, we collect your email address, password (stored in hashed form using a one-way algorithm), and, if you sign in with Google OAuth, your Google account identifier, name, email address, and profile picture as released by Google.

Organization Data: Information you provide about your business, including company name, employee records, financial data, customer records, inventory, and other business information entered into the Service.

Payment Information: If you subscribe to a paid plan, we collect payment details through our payment processor, Stripe. We do not store your full credit card number on our servers.

Usage Data: We automatically collect information about how you access and use the Service, including IP addresses, browser type, device identifiers, pages visited, and timestamps.

Communications: If you contact us for support or send messages through the Service, we retain those communications.

2. Google User Data We Access

When you connect your Google account, we request only the narrowly scoped permissions required to provide the features you enable. Depending on the integrations you choose, we may access:

• Basic profile and email (openid, email, profile scopes) to authenticate you, create and secure your account, and display your identity within the Service.
• Additional Google Workspace data only where a feature you explicitly activate requires it, and only to the extent of the scope you grant at the Google consent screen.

We request the minimum scopes necessary for the requested functionality, and you may review and revoke Gallic's access at any time from your Google Account permissions page.

3. How We Use Your Information

We use the account, organization, payment, usage, and communications information described above to:

• Provide, maintain, secure, and improve the Service and its features
• Authenticate you and manage your account and sessions
• Process transactions and manage your subscription
• Send you service-related communications, including account verification emails and security alerts
• Respond to your requests and provide customer support
• Detect, prevent, and address technical issues, fraud, abuse, or security breaches
• Comply with legal obligations

4. Limited Use of Google User Data

Google user data is used solely to provide and improve the user-facing features of the Service that you enable — such as authenticating you, securing your account, and powering the specific integration you activate. We do not use Google user data for any purpose other than providing or improving these features. In particular, Google user data is never used for advertising, fraud scoring unrelated to the Service, market research, or any independent purpose.

Gallic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we affirm that we do not:

• Use Google user data for serving targeted or personalized advertising;
• Sell Google user data or transfer it to data brokers or information resellers;
• Use or transfer Google user data to train, develop, or improve generalized or non-personalized artificial intelligence or machine learning models;
• Use Google user data to determine creditworthiness or for lending purposes; or
• Allow humans to read Google user data, unless (a) we obtain your affirmative consent for specific messages, (b) it is necessary for security purposes such as investigating abuse, (c) it is required to comply with applicable law, or (d) the data is aggregated and anonymized and used to improve the Service in a manner that complies with the Limited Use requirements.

Google user data is used only to provide or improve user-facing features that are prominent in the Service's user interface, and is not transferred to others except as necessary to provide and improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with user notice.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Gallic does not use, transfer, or sell Google Workspace or Gmail user data — whether raw, aggregated, or derived — to develop, train, or improve any generalized or foundational AI/ML models. Where AI/ML is used to process this data (e.g. reading an invoice email to extract the vendor, amount, and due date), it is solely to provide the specific feature the user requested.

5. Data Storage and Security

Your data is stored on secure servers. We implement industry-standard security measures, including encryption in transit (TLS/SSL), encryption of sensitive data at rest, hashed passwords, CSRF protection, access controls, and the principle of least privilege for internal access. Business data is logically segregated per organization through our multi-tenant architecture. Access to Google user data is restricted to the automated systems and authorized personnel who require it to operate and support the Service.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Sharing and Disclosure

We do not sell your personal information or your Google user data. We may share your data only with:

• Service Providers: Third-party vendors who assist us in operating the Service, including Stripe (payments), email delivery services, and infrastructure providers. These providers are contractually obligated to protect your data and may only use it to perform services on our behalf.
• Legal Requirements: When required by law, regulation, legal process, or enforceable governmental request.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to this Privacy Policy and with notice to you.
• With Your Consent: For any other purpose disclosed to you at the time we request your consent.

7. Third-Party Integrations

The Service may integrate with third-party services such as Plaid (banking data), Google (authentication and Workspace features), Stripe (payments), and others. Your use of these integrations is subject to the respective third party's privacy policy. We only access the data necessary to provide the functionality you request, and only for as long as you keep the integration enabled.

8. Data Retention and Deletion

We retain your account information for as long as your account is active or as needed to provide you the Service. Business data you enter into the Service is retained until you delete it or close your account. We may retain certain data for a limited period where required by law or for legitimate business purposes such as fraud prevention, dispute resolution, and enforcing our agreements.

Google user data is retained only as long as necessary to provide the feature for which it was granted. You can delete your Google user data at any time by:

• Disconnecting the Google integration within your account settings, which deletes the associated Google user data and tokens from our systems;
• Revoking Gallic's access from your Google Account permissions page; or
• Requesting deletion of your account by emailing support@gallic.com.

Upon account deletion, we delete or de-identify your personal information and Google user data within 30 days, except where retention is required by law. Residual copies may persist in secure backups for a limited period before they are overwritten.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to legal retention requirements
• Export your data in a portable format
• Object to or restrict certain processing of your data
• Withdraw consent, including revoking Google OAuth access, at any time

To exercise these rights, contact us at support@gallic.com. We will respond within the timeframe required by applicable law.

10. Cookies and Tracking

We use session cookies to maintain your authenticated state. These cookies are essential for the Service to function and are not used for advertising or cross-site tracking purposes.

11. Children's Privacy

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will take steps to delete it promptly.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in accordance with applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective Date." Your continued use of the Service after such changes constitutes your acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: support@gallic.com

Website: https://gallic.com