Privacy Policy

We collect information you provide (such as name, email, and company details) and information collected automatically (such as IP address and device data). We use it to operate and improve our services, respond to your requests, and communicate with you where permitted. We share information with service providers who help us operate our business and as required by law. Depending on where you live, you may have specific privacy rights, including under the California Consumer Privacy Act (CCPA/CPRA) and the EU/UK General Data Protection Regulation (GDPR).

A. Information You Provide

When you complete forms on the Site (such as "Request early access"), create a Platform account, or communicate with us, we may collect:

• Contact information: first name, last name, email address, phone number
• Professional information: company name, job title or role, team size, company size
• Business information: growth target or revenue goal, scheduling preferences (best time to meet)
• Communications: messages, questions, or feedback you submit
• Account information: login credentials and profile details (when you create a Platform account)
• Content and data: marketing content, campaign data, contact lists, and other materials you upload or create within the Platform

B. Information Collected Automatically

When you use the Site or Platform, we may automatically collect:

• Device and browser details: operating system, browser type, screen resolution
• Log data: IP address, timestamps, pages viewed, referring URLs, actions taken
• Approximate location: derived from IP address
• Cookie and similar technology data: see our Cookie Policy for details

C. Information from Third Parties

We may receive information about you from third-party integrations you connect to the Platform (such as CRM systems or email service providers) and from publicly available business directories.

We use the information we collect to:

• Provide our services: operate the Site and Platform, process your requests, manage your account
• Communicate with you: respond to inquiries, send product updates and early access communications (where permitted), and provide customer support
• Improve our services: analyze usage patterns, debug issues, conduct research, and develop new features
• Ensure security: monitor for abuse, fraud, and unauthorized access
• Fulfill legal obligations: comply with applicable laws, respond to lawful requests, and enforce our terms

If the GDPR applies to our processing of your personal data, we rely on the following legal bases:

• Consent: for non-essential cookies and certain marketing communications
• Legitimate interests: operating and improving our services, security, responding to inquiries
• Contract: where processing is necessary to provide services you have requested
• Legal obligation: compliance with applicable laws and regulations

We may share information with:

• Service providers: companies that help us operate our business, including hosting and infrastructure (Vercel), email delivery (SendGrid), database hosting (Neon), AI processing (Anthropic, which processes the data needed to draft findings, recommendations and content in the Platform and does not use it to train its models), analytics, CRM, and form processing
• Professional advisors: legal, accounting, and other professional advisors as needed
• Authorities: law enforcement or regulators when required by law or to protect rights and safety
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets

We do not sell personal information for monetary consideration. If we engage in cross-context behavioral advertising in the future, we will update this policy and provide opt-out choices.

The Gane app at app.gane.ai, part of the Platform, lets a company connect its Google Search Console, Google Analytics and Google Ads accounts so it can measure its marketing in one place. This section describes what we do with data we receive from Google APIs. Where it differs from the rest of this policy, this section governs Google user data.

A. What We Access

With your permission, given on Google's consent screen, the app asks for these Google permissions and reads:

• Google Search Console (read-only): the sites your Google account can see, and for the site you choose, clicks, impressions, click-through rate and average position, in total, for branded and other searches, and by search query and by page;
• Google Analytics (read-only): the accounts and properties your Google account can see, the key events set up on the property you choose, and for that property sessions, key events and event counts, in total and by traffic source and medium, landing page, campaign tag and event name;
• Google Ads, connected separately: the ad accounts your Google account can see, and for the account you choose, spend, impressions, clicks, conversions and impression share by campaign and ad group; your keywords with their match type and Quality Score; the search terms that triggered your ads; the pages your ads link to; your ads' text and assets with Google's ratings of them; and your conversion actions;
• Your Google account: its email address, to show which Google account a connection belongs to.

The app does not read data about individual people from Google: no visitor, user or customer records. The figures it reads are totals for your site, property or ad account. It does not change your Search Console, Analytics or Ads settings or data. (Google Ads offers one permission for reading and changing an account. To show you whether your account would accept changes, the app asks Google to check a test change that Google validates and never makes.)

B. How We Use It

Only to provide features you see in the app: your search, traffic and paid media reports; the goals and plan built from them; the findings and recommended actions drawn from them; your programs' results; and, when you ask for them, drafted changes to your ads. Your figures also appear in the app's emails to the people in your workspace, such as the weekly summary.

To draft findings, recommendations and ad changes, the app sends Anthropic's Claude API the figures and findings those drafts need (for an ad change, the ad's current text and the search terms that triggered it). Anthropic processes them on our behalf to return the draft, and does not use them to train its models.

We do not use Google user data for advertising, including retargeting or personalized or interest-based ads; we do not sell it; we do not use it to determine creditworthiness or for lending; and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

C. What We Store

• The figures above, for your workspace only: by month over up to the last 15 months, and for recent windows such as the last 28, 30 or 90 days; each sync replaces the previous one.
• The names and IDs of the sites, properties and ad accounts your Google account can see, so you can choose one.
• Your Google access and refresh tokens, encrypted (AES-256-GCM) and bound to your workspace. They are used only on our servers and are never shown in the app.
• Your Google account's email address, as the connection's label.

D. Sharing

We do not sell Google user data or transfer it to anyone, except:

• the service providers that run the app for us, each only to provide it: hosting, functions and file storage (Vercel), the database (Neon), email delivery (SendGrid) and AI processing (Anthropic);
• AI assistants you connect yourself: if you create a Claude key in the app and connect your own assistant, it reads your figures when you ask it to;
• when required by law, or to investigate security issues or abuse;
• as part of a merger, acquisition or sale of assets, only with your explicit prior consent.

The people in your workspace see your figures. No person at Gane reads your Google user data unless you ask us to (for example, for support, or when Gane runs work in your workspace for you), it is needed for security or to comply with the law, or it has been aggregated and anonymized for our internal operations.

E. Keeping and Deleting It

We keep the figures while the connection is in place. When you disconnect Google or Google Ads in the app (Settings, Integrations), the app revokes its access at Google and at once deletes the connection, its tokens, every figure read through it and the findings the app drew from those figures. Choosing a different site, property or ad account deletes the previous one's figures and the findings drawn from them. You can also remove the app's access at any time at myaccount.google.com/permissions; the app then stops reading, and the stored figures stay until you disconnect in the app or ask us to delete them.

What stays in your workspace after you disconnect: the actions the app recommended, as your team's work (the findings behind them are deleted); plan figures you entered or chose to keep; and a record that a connection was made and removed, with the Google account's email address, in the workspace's activity log for security. To have any of it deleted, or your whole workspace, write to privacy@gane.ai (see Your Choices and Contact Us), and we will confirm when it is done.

F. Limited Use

Gane's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use cookies and similar technologies for essential Site functions and, where consent is obtained, for analytics and performance purposes. For details on the cookies we use and how to manage your preferences, please see our Cookie Preferences.

We retain personal information only as long as necessary for the purposes described in this policy:

• Early access and lead information: 24 months from your last interaction, unless you become a customer
• Customer account data: for the duration of your subscription plus a reasonable period for legal compliance
• Marketing suppression records: retained as long as necessary to honor your opt-out preference
• Automatically collected data: generally retained for up to 12 months for analytics purposes

We implement reasonable administrative, technical, and organizational safeguards designed to protect your information. No system is 100% secure.

Email Preferences

You can unsubscribe from marketing emails at any time using the link in the message. We will honor opt-out requests within 10 business days as required by CAN-SPAM.

Cookies

You can manage cookies via the cookie preference center or your browser settings.

Account Data

If you have a Platform account, you can access and update your account information through your account settings. To request deletion, contact us at the address below.

This section applies if the California Consumer Privacy Act, as amended, applies to our processing of your personal information.

A. Notice at Collection

Categories of personal information we collect: identifiers (name, email, IP address), internet and network activity (usage data, browsing history on the Site), professional and employment information (company, title, team size), and commercial information (revenue goals, business data you provide).

Purposes: operating and securing our services; responding to requests; communications; analytics; legal compliance. See Section 3 for full details.

Retention: see Section 8.

B. Sale and Sharing

We do not "sell" or "share" personal information as those terms are defined under California law. If this changes, we will update this policy and provide opt-out mechanisms, including honoring Global Privacy Control (GPC) signals as a valid opt-out.

C. California Consumer Rights

Depending on how the law applies to us, you may have rights to: know and access your personal information, delete your information, correct inaccurate information, opt out of any future sale or sharing, and not be discriminated against for exercising these rights.

How to submit a request: email: privacy@gane.ai with the subject line "Privacy Request." We may need to verify your identity before processing your request.

Some browsers offer "Do Not Track" signals. We currently do not respond to these signals. We do honor Global Privacy Control (GPC) signals where applicable under California law. You can also manage your preferences through our cookie preference center.

If you access our services from outside the United States, your information may be transferred to and processed in the United States and other countries where our service providers operate. Where required by law, we use appropriate safeguards such as standard contractual clauses.

Our services are not intended for children under 16, and we do not knowingly collect personal information from children under 16.

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top. If changes are material, we will provide additional notice as required by law.