Privacy Policy

1. Introduction

Gift of Gab Tech Inc. ("Company," "we," "us," or "our") operates the Gift of Gab platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly when you:

• Create an account: name, email address, password, and organization name
• Subscribe to a plan: billing information processed through Stripe (we do not store credit card numbers directly)
• Connect integrations: CRM API keys, authentication tokens for Follow Up Boss and other connected services
• Use the Service: contacts, notes, conversations, tags, and other CRM data you input or import
• Contact support: any information you provide in support requests or communications with us

2.2 Information Collected Automatically

When you use the Service, we may automatically collect:

• Device information (browser type, operating system, device type)
• Log data (IP address, access times, pages viewed, referring URL)
• Usage data (features used, actions taken within the Service)
• Performance data (error logs, response times, diagnostic data)

2.3 Information from Third-Party Services

When you connect third-party integrations (such as Follow Up Boss), we receive data from those services as authorized by you, including contact records, interaction history, and related CRM data. We only access data necessary to provide the features you have enabled.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process subscriptions and manage billing
• Generate AI-powered insights, recommendations, and briefings from your CRM data
• Sync data between Gift of Gab and your connected CRM systems
• Send transactional emails (account verification, billing receipts, service notifications)
• Respond to support requests and communicate with you about the Service
• Monitor and analyze usage patterns to improve the user experience
• Detect, prevent, and address technical issues, fraud, or security breaches
• Comply with legal obligations

4. Call Recording, Transcription, and AI Processing

4.1 Information Collected and Created

When recording is enabled, Gift of Gab may capture and store call audio and create a transcript. The recording and transcript may be processed to create CRM notes, summaries, action items, sentiment or follow-up insights, and other enabled call-related outputs. Source recordings and those derived outputs are separate data and may follow different retention and deletion processes.

4.2 Transcription and AI Processing

Recorded calls may be transcribed using speech-to-text services provided by Deepgram. Transcripts may then be processed by Azure OpenAI to create call summaries, action items, sentiment analysis, and contextual follow-up insights within your organization.

4.3 Organization Controls and Responsibilities

Gift of Gab does not determine the jurisdiction governing a call and does not block recording based on location or a participant-consent record. The customer determines the purposes of its calls and is responsible for determining and satisfying applicable participant notice, consent, objection, and alternative-channel requirements. Gift of Gab retains its own obligations concerning platform operation, privacy, security, data processing, subprocessors, incident response, and support for individual rights.

4.4 Semantic Memory and Derived Data

Where enabled, key insights from call transcripts may be stored in a semantic memory system to provide context for future interactions. This data is scoped to your organization and is not shared across tenants. Disabling future call recording does not itself delete semantic memory or other information already derived from prior calls.

4.5 Third-Party AI Processors

When call recording, transcription, and AI processing are enabled, the following third-party services may process call data:

4.6 Data Retention for Recordings and Transcripts

Retention periods may differ for audio, transcripts, CRM notes, summaries, insights, semantic memory, backups, and audit records. We retain those categories according to our documented retention and deletion processes and applicable legal, security, and contractual requirements. We do not represent a single fixed recording-retention period. You may contact privacy@giftofgab.ai about access, correction, or deletion requests.

4.7 Notice to Call Participants

The recording announcement is enabled by default for existing and new organizations and operates only while call recording is enabled. Organization owners and administrators can control it in Phone Settings. The announcement is a disclosure aid; it does not determine applicable law, prove consent, or satisfy every notice or consent requirement.

Turning recording off stops future call recording, transcription, and recording-driven AI processing. It does not automatically delete recordings, transcripts, notes, summaries, insights, or other information already created.

5. Google User Data (Gmail & Google Calendar)

If you choose to connect your Google account, Gift of Gab accesses certain Google user data through Google's APIs. Connecting Google is entirely optional — the Service works without it. This section explains exactly what we access, how we use it, how we protect it, and how you can revoke access at any time.

5.1 What We Access

• Gmail messages (read-only): your email messages and their metadata, accessed through Google's gmail.readonly permission. We cannot modify, label, archive, or delete anything in your mailbox.
• Email sending: the ability to send email from your Gmail address, through Google's gmail.send permission.
• Calendar events: your calendar events, through Google's calendar.events permission. We can view, create, update, and cancel (delete) events; we do not access your calendar settings, sharing rules, or account configuration.
• Basic profile (name and email address): used only at connection time to confirm the Google account you connected matches your Gift of Gab account, and to label the connected account in your settings. It is not used for identity resolution, contact creation, or any other purpose.

5.2 How We Use It

Google user data is used solely to provide the following user-facing features inside your own account:

• Email on your contact timeline: we display your own client email conversations on the matching contact's record in your CRM.
• Summaries and follow-up suggestions: we analyze those emails to surface important messages, summarize conversations, suggest follow-ups, and prepare draft replies for your review.
• Sending your replies: we send email replies from your own Gmail address so conversations stay in one thread. By default, every outgoing message — including any AI-drafted reply — requires your explicit approval before it is sent. If you choose to enable a higher automation level in your settings, Emma can send messages on your behalf under rules you control; you can change or turn this off at any time.
• Showing appointments and availability: we read your upcoming calendar events to show your availability, and create, update, or cancel events on your Google Calendar when you book, reschedule, or cancel showings and meetings in the app.

5.3 How We Store and Protect It

• Google user data is stored on Microsoft Azure infrastructure in Canada and is encrypted at rest and in transit (see Section 7, Data Storage and Security)
• Your Google access and refresh tokens are additionally encrypted at the application level before storage, using managed encryption keys protected by Azure Key Vault
• Data is isolated per customer account; access is restricted by role-based access controls within our multi-tenant architecture
• AI analysis of email content runs on Azure OpenAI services under Microsoft's data processing agreement and is not used to train general-purpose models

5.4 Sharing

We do not share Google user data with third parties except the service providers that host and process data on our behalf to deliver the features described above (such as Microsoft Azure), for security purposes, or as required by law. We never sell Google user data and never share it for advertising.

5.5 Human Access

No person at Gift of Gab reads your Google user data, except: (a) with your explicit permission (for example, when you ask us to investigate a support issue); (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized for internal operations.

5.6 Retention, Disconnection, and Deletion

• Disconnect at any time: in Settings → Integrations, you can disconnect Gmail or Google Calendar. We revoke our access tokens with Google and immediately stop accessing your Google data.
• Revoke from Google: you can also revoke Gift of Gab's access directly from your Google account at https://myaccount.google.com/permissions.
• Stored copies: copies of emails and calendar events already synced into your CRM remain available in your account and follow our standard retention policy (Section 8). You can request deletion of this data at any time.
• Deletion on request: you can request earlier deletion of stored Google user data at any time by contacting privacy@giftofgab.ai, and we will respond within 30 days.

5.7 Limited Use Disclosure

6. Third-Party Services

We use the following categories of third-party services to operate and deliver the Service. Each provider has its own privacy policy governing how they handle your data:

7. Data Storage and Security

Your data is stored on secure cloud infrastructure provided by Microsoft Azure. We implement industry-standard security measures to protect your information, including:

• AES-256 encryption of data at rest, TLS 1.3 encryption in transit
• Access controls and JWT-based authentication for all systems
• Azure Key Vault for secrets management with HSM-backed protection
• Role-based access controls within multi-tenant architecture
• Regular security monitoring, vulnerability assessments, and automated alerts

For complete security details, visit our Security page.

8. Data Retention

We retain your personal information and account data for as long as your account is active or as needed to provide the Service:

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain legal exceptions.
• Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Opt-Out: Opt out of non-essential communications at any time.
• Restriction: Request that we restrict processing of your personal information under certain circumstances.

To exercise any of these rights, please contact us at privacy@giftofgab.ai. We will respond to your request within 30 days.

10. Canadian Privacy Law (PIPEDA)

Gift of Gab Tech Inc. is a Canadian company. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Under PIPEDA, you have the right to:

• Know why your personal information is being collected
• Expect your personal information to be used only for the purposes for which it was collected
• Know who in our organization is responsible for protecting your personal information
• Expect your personal information to be protected by appropriate safeguards
• Challenge the accuracy and completeness of your personal information
• Access your personal information and be informed of its use and disclosure
• Complain to the Office of the Privacy Commissioner of Canada about our handling of your personal information

Our designated Privacy Officer is Gabriel Bourque, who is accountable for our compliance with PIPEDA and can be reached at privacy@giftofgab.ai for any questions or concerns about how we handle your personal information. If you are unsatisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada.

11. International Data Transfers

Your personal information may be stored and processed in Canada, the United States, or any other country where our service providers maintain facilities. When your data is transferred outside of Canada, we ensure it receives a comparable level of protection through contractual obligations with our sub-processors consistent with PIPEDA requirements.

12. Cookies and Tracking

We use essential cookies and similar technologies to operate the Service. These include session cookies for authentication and security purposes. We do not use third-party advertising cookies or cross-site tracking technologies. You may control cookie preferences through your browser settings.

13. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

14. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the federal laws of Canada and the laws of the Province of Ontario, without regard to conflict of law provisions. Any disputes arising under this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in the Province of Ontario, Canada.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. If the changes are significant, we will provide additional notice, such as an email notification. We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: