Privacy Policy

1. Introduction

Gift of Gab Tech Inc. ("Company," "we," "us," or "our") operates the Gift of Gab platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly when you:

• Create an account: name, email address, password, and organization name
• Subscribe to a plan: billing information processed through Stripe (we do not store credit card numbers directly)
• Connect integrations: CRM API keys, authentication tokens for Follow Up Boss and other connected services
• Use the Service: contacts, notes, conversations, tags, and other CRM data you input or import
• Contact support: any information you provide in support requests or communications with us

2.2 Information Collected Automatically

When you use the Service, we may automatically collect:

• Device information (browser type, operating system, device type)
• Log data (IP address, access times, pages viewed, referring URL)
• Usage data (features used, actions taken within the Service)
• Performance data (error logs, response times, diagnostic data)

2.3 Information from Third-Party Services

When you connect third-party integrations (such as Follow Up Boss), we receive data from those services as authorized by you, including contact records, interaction history, and related CRM data. We only access data necessary to provide the features you have enabled.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process subscriptions and manage billing
• Generate AI-powered insights, recommendations, and briefings from your CRM data
• Sync data between Gift of Gab and your connected CRM systems
• Send transactional emails (account verification, billing receipts, service notifications)
• Respond to support requests and communicate with you about the Service
• Monitor and analyze usage patterns to improve the user experience
• Detect, prevent, and address technical issues, fraud, or security breaches
• Comply with legal obligations

4. Optional Call Recording, Transcription, and AI Processing

4.1 Call Recording (Opt-In)

If you choose to enable call recording, Gift of Gab will record phone calls made or received through the platform. Recordings are stored securely on Microsoft Azure infrastructure in Canada. Under Canadian law (Criminal Code s.184), one party to a conversation may consent to its recording. When you opt in to call recording, you provide that consent as a party to the call.

4.2 Call Transcription (Opt-In)

When you opt in to call recording, you may also enable automatic transcription. If transcription is enabled, recorded calls are transcribed using AI-powered speech-to-text services provided by Deepgram. Transcripts may then be processed by Azure OpenAI to generate call summaries, action items, and sentiment analysis within your account.

4.3 AI Processing of Communications (Opt-In)

If you choose to enable AI call processing, Emma, our AI assistant, can analyze your call transcripts to identify follow-up opportunities, lead scoring, and recommended next steps. Contact information including names, phone numbers, and conversation history is processed only when you have opted in and only to provide contextual intelligence within your account.

4.4 Semantic Memory (Opt-In)

When you opt in to AI call processing, key insights from your conversations may be stored in a semantic memory system to provide context for future interactions. This data is scoped to your account and is not shared across tenants. Each subscriber's semantic memory is isolated and accessible only within their own account. Semantic memory is only populated from features you have explicitly enabled.

4.5 Third-Party AI Processors

If you enable call recording and AI processing, the following third-party services may process your data:

4.6 Data Retention for Recordings and Transcripts

If you have enabled call recording, recordings and transcripts are retained for the duration of your active subscription and may be retained after cancellation under our standard retention practices. You may request deletion of your recordings and transcripts at any time by contacting privacy@giftofgab.ai, and we will action your request. You can also disable call recording at any time in your account settings, which stops all future recording and transcription.

4.7 Notice to Call Participants

If you choose to enable call recording, you are responsible for complying with applicable laws regarding call recording notification in your jurisdiction. Some jurisdictions require all-party consent to record conversations. Gift of Gab provides configurable call recording announcements that can be enabled on a per-jurisdiction basis to help you meet your notification obligations.

5. Google User Data (Gmail & Google Calendar)

If you choose to connect your Google account, Gift of Gab accesses certain Google user data through Google's APIs. Connecting Google is entirely optional — the Service works without it. This section explains exactly what we access, how we use it, how we protect it, and how you can revoke access at any time.

5.1 What We Access

• Gmail messages (read-only): your email messages and their metadata, accessed through Google's gmail.readonly permission. We cannot modify, label, archive, or delete anything in your mailbox.
• Email sending: the ability to send email from your Gmail address, through Google's gmail.send permission.
• Calendar events: your calendar events, through Google's calendar.events permission. We can view, create, and update events; we do not access your calendar settings, sharing rules, or account configuration.
• Basic profile (name and email address): used only at connection time to confirm the Google account you connected matches your Gift of Gab account, and to label the connected account in your settings. It is not used for identity resolution, contact creation, or any other purpose.

5.2 How We Use It

Google user data is used solely to provide the following user-facing features inside your own account:

• Email on your contact timeline: we display your own client email conversations on the matching contact's record in your CRM.
• Summaries and follow-up suggestions: we analyze those emails to surface important messages, summarize conversations, suggest follow-ups, and prepare draft replies for your review.
• Sending your replies: we send email replies from your own Gmail address so conversations stay in one thread. By default, every outgoing message — including any AI-drafted reply — requires your explicit approval before it is sent. If you choose to enable a higher automation level in your settings, Emma can send messages on your behalf under rules you control; you can change or turn this off at any time.
• Showing appointments and availability: we read your upcoming calendar events to show your availability, and create or update events on your Google Calendar when you book showings or meetings in the app.

5.3 How We Store and Protect It

• Google user data is stored on Microsoft Azure infrastructure in Canada and is encrypted at rest and in transit (see Section 7, Data Storage and Security)
• Your Google access and refresh tokens are additionally encrypted at the application level before storage, using managed encryption keys protected by Azure Key Vault
• Data is isolated per customer account; access is restricted by role-based access controls within our multi-tenant architecture
• AI analysis of email content runs on Azure OpenAI services under Microsoft's data processing agreement and is not used to train general-purpose models

5.4 Sharing

We do not share Google user data with third parties except the service providers that host and process data on our behalf to deliver the features described above (such as Microsoft Azure), for security purposes, or as required by law. We never sell Google user data and never share it for advertising.

5.5 Human Access

No person at Gift of Gab reads your Google user data, except: (a) with your explicit permission (for example, when you ask us to investigate a support issue); (b) when necessary for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized for internal operations.

5.6 Retention, Disconnection, and Deletion

• Disconnect at any time: in Settings → Integrations, you can disconnect Gmail or Google Calendar. We revoke our access tokens with Google and immediately stop accessing your Google data.
• Revoke from Google: you can also revoke Gift of Gab's access directly from your Google account at https://myaccount.google.com/permissions.
• Stored copies: copies of emails and calendar events already synced into your CRM remain available in your account and follow our standard retention policy (Section 8). You can request deletion of this data at any time.
• Deletion on request: you can request earlier deletion of stored Google user data at any time by contacting privacy@giftofgab.ai, and we will respond within 30 days.

5.7 Limited Use Disclosure

6. Third-Party Services

We use the following categories of third-party services to operate and deliver the Service. Each provider has its own privacy policy governing how they handle your data:

7. Data Storage and Security

Your data is stored on secure cloud infrastructure provided by Microsoft Azure. We implement industry-standard security measures to protect your information, including:

• AES-256 encryption of data at rest, TLS 1.3 encryption in transit
• Access controls and JWT-based authentication for all systems
• Azure Key Vault for secrets management with HSM-backed protection
• Role-based access controls within multi-tenant architecture
• Regular security monitoring, vulnerability assessments, and automated alerts

For complete security details, visit our Security page.

8. Data Retention

We retain your personal information and account data for as long as your account is active or as needed to provide the Service:

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to certain legal exceptions.
• Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Opt-Out: Opt out of non-essential communications at any time.
• Restriction: Request that we restrict processing of your personal information under certain circumstances.

To exercise any of these rights, please contact us at privacy@giftofgab.ai. We will respond to your request within 30 days.

10. Canadian Privacy Law (PIPEDA)

Gift of Gab Tech Inc. is a Canadian company. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Under PIPEDA, you have the right to:

• Know why your personal information is being collected
• Expect your personal information to be used only for the purposes for which it was collected
• Know who in our organization is responsible for protecting your personal information
• Expect your personal information to be protected by appropriate safeguards
• Challenge the accuracy and completeness of your personal information
• Access your personal information and be informed of its use and disclosure
• Complain to the Office of the Privacy Commissioner of Canada about our handling of your personal information

Our Privacy Officer can be reached at privacy@giftofgab.ai. If you are unsatisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada.

11. International Data Transfers

Your personal information may be stored and processed in Canada, the United States, or any other country where our service providers maintain facilities. When your data is transferred outside of Canada, we ensure it receives a comparable level of protection through contractual obligations with our sub-processors consistent with PIPEDA requirements.

12. Cookies and Tracking

We use essential cookies and similar technologies to operate the Service. These include session cookies for authentication and security purposes. We do not use third-party advertising cookies or cross-site tracking technologies. You may control cookie preferences through your browser settings.

13. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

14. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the federal laws of Canada and the laws of the Province of Ontario, without regard to conflict of law provisions. Any disputes arising under this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in the Province of Ontario, Canada.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. If the changes are significant, we will provide additional notice, such as an email notification. We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: