Privacy Policy

1. Who we are

Gancio is developed and operated by I.E. BLANKET BYTE (individual entrepreneur), registration ID 305834292, University Street N.17a, Floor 10, Vake district, Tbilisi, Georgia ("we", "us").

You can reach us at contact@blanketbyte.com for anything privacy-related. We answer in English or Italian.

2. Our two roles

• Your account: for the data about you as a Gancio user (your account, profile, team membership, usage and billing), we are the data controller.
• Your contacts: for the data you put into Gancio about other people and companies (leads, clients, notes, calls, imported lists, files), you, or the organization you work for, are the controller and we are the processor. We process that data only to provide Gancio to you, following your instructions and the data processing terms in our Terms of Service. You are responsible for having a lawful basis to keep and contact those people, and for answering their requests; we help you do so.

3. The short version

• We store what you and your team put into Gancio so we can show it back to you, in the workspaces you can access.
• No ads, no advertising networks, no analytics or tracking scripts, no selling of data.
• The app sets no cookies. It keeps your sign-in session and a few preferences in your browser storage (section 7).
• AI features send only the data needed for the task you start to Anthropic (Claude), which does not use it to train its models (section 6).
• Data from Google (sign-in, and Gmail if you connect it) is used only to provide the features you use, under Google's Limited Use requirements (section 5).
• Data is hosted in the European Union: database and files in Sweden (Supabase), application servers in Germany (Hetzner).

4. What we store

• Account: your email address and, if you sign up with one, a password, stored only as a secure hash by our authentication provider (Supabase). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Profile and preferences: name, role, a short description of you and what you offer, preferred tone and language for AI messages, interface language, time zone and theme.
• Organizations and workspaces: the organizations and workspaces you create or join, members and their roles, invitations (the invited email address; the invitation link is stored only as a hash), seats and plan.
• Your CRM data: contacts and companies (names, job titles, email addresses, phone numbers, LinkedIn profile links and text, city, province and region, industry, number of employees, VAT number, website, notes, tags, custom fields, status and lifecycle, owner), timeline entries, notes, call logs and their outcomes, tasks, agenda events, saved segments, campaigns and message drafts.
• Imports: the files you upload to import contacts (spreadsheets, CSV, XML, JSON, PDFs, photos or pasted text), what was read from them, the column mapping you confirmed, and a list of which records each import created, updated or skipped.
• Files you attach to contacts or companies, and exports you request (export files are deleted after 7 days).
• Calendar feeds: if you create a calendar link, we store only a hash of its secret token. Anyone who has the link can see the agenda it shows, so keep it private; you can revoke it at any time.
• Usage counters: how many AI generations and AI-read import rows your organization used each month, to apply your plan's limits.
• Technical records: request identifiers that prevent the same action from being applied twice (deleted after about 48 hours), background job records (deleted after a few weeks), and brief server logs kept by our hosting providers (such as IP address and request time) to run the service securely.

5. Google user data

Gancio uses Google APIs in two ways, only when you choose to:

• Sign in with Google: we request your basic profile (name, email address, profile picture) to create and sign in to your account. We use it for nothing else.
• Gmail (when you connect a Gmail mailbox, as the feature becomes available): Gancio uses the Gmail API to send the emails you write or approve, one by one or as steps of a sequence you set up, from your own address; and to read the replies and messages exchanged with your Gancio contacts, so that a reply can stop a sequence, update the contact's status and appear on the contact's timeline. We read only what is needed for these features and store only the metadata and text of messages exchanged with your Gancio contacts.

Gancio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not transfer it to third parties, except as needed to provide those features (for example to our hosting providers), to comply with the law, or as part of a merger or acquisition with notice to you.
• We never use it for advertising, never sell it, and never use it to build user profiles for others.
• We do not use Google user data, including Gmail content, to train or develop artificial intelligence or machine learning models, ours or anyone else's.
• No person at Gancio reads your Google user data unless you ask us to (for example for support), it is necessary for security purposes such as investigating abuse, or it is required by law.

Access tokens for a connected mailbox are stored encrypted. You can disconnect a mailbox in Gancio at any time, and you can also revoke Gancio's access from your Google Account at myaccount.google.com/permissions. Microsoft Outlook mailboxes, when available, are handled under the same rules.

6. Where your data lives and who helps us run Gancio

We use a small number of providers. Each processes data only on our instructions and only as needed to provide their service to us:

• Supabase — database, authentication and file storage, hosted in the European Union (Stockholm, Sweden).
• Hetzner Online — servers in Germany that run the Gancio web app, API and background jobs.
• Anthropic (Claude API) — only when you use an AI feature: reading an import (the file or text you import, or sample rows and the columns you let the AI read), writing message drafts (your profile, the contact's details and any instructions or screenshots you add), or filling your profile from LinkedIn text or screenshots. Under Anthropic's commercial terms this data is not used to train their models; Anthropic may keep it for a limited time for safety and abuse monitoring. If you do not use AI features, nothing is sent to Anthropic.
• Google and Microsoft — sign-in, and the mailboxes you connect (section 5).
• Email delivery providers — to send account emails such as signup confirmations, password resets and team invitations.
• Our payment provider, acting as merchant of record, when you buy a paid plan: it processes your billing details and payment; we never see your full card number.
• Let's Encrypt — to issue the certificates that keep your connection encrypted.

Some providers may process data outside the European Economic Area (for example Anthropic in the United States). Where that happens, transfers rely on the providers' contractual safeguards such as the EU Standard Contractual Clauses. We do not use any provider for advertising or analytics.

7. Cookies and browser storage

Gancio sets no cookies. Your browser keeps your sign-in session and a few preferences (interface language, theme, last workspace, list or pipeline view, agenda view) in local storage, so the app works as you left it. Nothing is used for tracking. Signing out removes the session.

8. Why we process your data

• To provide Gancio under our Terms of Service (performance of a contract): your account, workspaces, CRM data, imports, AI features you use, emails you send, billing.
• To keep Gancio secure and working (legitimate interest): technical logs, abuse prevention, rate limits, backups.
• To meet legal obligations, such as tax and accounting records for payments.

We do not use your data or your contacts' data for our own marketing, and we never sell it.

9. How long we keep data

We keep your data for as long as you keep it in Gancio or keep your account. Export files, including the account export from Settings → Account, are deleted after 7 days; technical records as described in section 4. When you delete data or your account, it is removed from the live database and its files from storage right away; database backups are kept for a limited period, after which deleted data also disappears from backups.

When you delete your account (Settings → Account → Delete account), we delete your sign-in, profile, personal workspace and every team where you are the only member, with all their data and files, plus your exports, private segments, calendar links and API tokens. In a team with other members, the contacts, companies and activities you created belong to that team’s organization and stay with it; records assigned to you become unassigned, and the team’s security log keeps an entry that a member deleted their account.

10. Security

• All traffic is encrypted in transit (HTTPS).
• Every workspace is isolated at the database level (row-level security), so members only see the workspaces they belong to.
• Secret links and tokens (invitations, calendar feeds, API tokens) are stored only as hashes; mailbox access tokens are stored encrypted.
• Uploaded files live in private storage and are opened through short-lived signed links.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and, where required, the authorities.

11. Your rights

Depending on where you live (for example under the EU GDPR), you have the right to access, correct, export and delete your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on it. You can do the most common requests yourself in Settings → Account: correct your profile, download a copy of your data (a ZIP file, also emailed to you and available for 7 days) and delete your account (section 9). For anything else, or if you cannot use the app, write to contact@blanketbyte.com and we will answer within one month. You can also lodge a complaint with your local data protection authority.

If you are a contact stored in someone's Gancio workspace, please contact that person or organization first: they control that data. If you cannot reach them, write to us and we will forward your request.

12. Age

Gancio is a professional tool for adults. It is not intended for anyone under 18.

13. Changes to this policy

We may update this policy as Gancio evolves. The current version is always published here with its date at the top; for material changes we will let you know in the app or by email before they take effect.

14. Contact

I.E. BLANKET BYTE · University Street N.17a, Floor 10, Vake district, Tbilisi, Georgia · contact@blanketbyte.com · blanketbyte.com