Privacy Policy

Introduction

Gaapio, Inc. ("Gaapio") is a provider of AI-powered accounting automation, technical accounting tools, and related professional software services.

We understand that you care about your personal privacy, and we take that responsibility seriously. This Privacy Policy describes Gaapio's practices regarding the collection, use, and protection of personal data, and outlines your privacy rights. Because privacy is an ongoing responsibility, we may update this policy from time to time as we implement new practices or adopt new policies.

Data Protection Officer

Gaapio, Inc. is headquartered in the United States.

Gaapio has appointed an internal Data Protection Officer to address any questions, concerns, or requests related to Gaapio's personal data handling practices. If you wish to exercise any of your privacy rights, please contact:

How We Collect and Use Your Personal Information

Gaapio collects personal information from website visitors, prospects, and customers. This information typically includes:

• Name
• Job title
• Employer name
• Work address
• Work email
• Work phone number

We use this information to deliver services, communicate with customers, and operate our business.

We do not sell personal information and share it only with third parties who help us deliver Gaapio services.

From time to time, Gaapio may also receive personal data from third-party sources, such as LinkedIn or data providers, typically relating to professional details about your employer or industry.

Use of the gaapio.com Website

Like most websites, Gaapio collects certain information automatically and stores it in log files. This may include:

• IP address
• Region or general location of your device
• Browser type
• Operating system
• Pages viewed and site interactions

We use this data to improve site performance, diagnose issues, analyze trends, and better understand user needs.

Gaapio has a legitimate interest in understanding how customers and visitors use our website so we can provide relevant services and appropriate resources.

Cookies and Tracking Technologies

Gaapio uses cookies and similar technologies to support website functionality, analytics, and user preferences.

Use of Gaapio Services

When you use the Gaapio platform or related tools, we may collect additional data required for account management, service delivery, analytics, and security. This information may include:

• Account credentials
• Usage data within the platform
• Customer support interactions
• Configuration and integration details

Gaapio uses this information solely to operate and improve the service and to support your account.

Connected Services (Google, Microsoft and Slack)

Gaapio lets you connect third-party services, such as Google Workspace (Gmail, Google Drive, Google Calendar, Google Docs, Google Sheets, Google Slides, Google Chat and Google Contacts), Microsoft 365 and Slack, so that Gaapio's research assistant can use information from those services when you ask it to. Connecting a service is optional. Each person connects their own account, and you can disconnect at any time.

What we access

When you connect a service, you grant Gaapio permission to access the data that service allows for the permissions shown on its consent screen, limited to what your own account can already see. Depending on the service, this can include email messages and drafts, files and documents, spreadsheets, presentations, calendar events and availability, chat messages and spaces, contacts and directory information, and Slack messages, channels, files and canvases.

How we use it

• Gaapio retrieves data from a connected service only when you ask a question or make a request that needs it, and only to answer that request. The Gaapio add-ons for Google Sheets, Google Docs and Google Slides work differently: they keep a copy of the file you connect, as described below.
• Gaapio does not change anything in a connected service, such as creating a draft, editing a document or posting a message, unless you approve that specific action first.
• We send the data needed to answer your request to the AI model providers that power Gaapio, solely to generate your response. We have zero data retention agreements with these providers: they do not store your data and are not permitted to use it to train their models.
• We do not sell data from connected services, use it for advertising, or use it to train or improve generalized artificial intelligence or machine learning models.
• Gaapio personnel do not read data from connected services, except with your explicit permission (for example, to resolve a support request you raise), when necessary for security purposes such as investigating abuse, or to comply with applicable law.

Storage, retention and deletion

The access tokens that let Gaapio reach a connected service are encrypted and stored in a dedicated secrets store, and are never shown to other users. Information a connected service returns while answering your request becomes part of that chat conversation and is kept and deleted with it, under your organization's retention settings. When you disconnect a service, we delete its access tokens immediately. You can also revoke Gaapio's access at any time from your Google, Microsoft or Slack account settings.

Gaapio add-ons for Google Sheets, Docs and Slides

• Each add-on works only with the file you have open: the spreadsheet, document or presentation. It asks Google for permission to read and edit that file only, to open the one file you choose in Google's file picker, and to show the Gaapio sidebar. It cannot see your other files.
• When you connect a file, Gaapio stores a copy of it (for example cell values and formulas, document text and formatting, or slide content and speaker notes) so it can answer your questions and cite the part of the file behind each answer. While the add-on is open, Gaapio refreshes that copy when the file changes.
• An add-on changes your file only when you approve a specific change.
• Gaapio deletes its copy of the file when you disconnect it in the add-on, and automatically after seven days without use. Answers you have already received stay in your chat history, which is kept and deleted under your organization's retention settings.
• The add-ons do not store your Google access tokens. They are held only in your browser session.

Google user data

This section governs information Gaapio receives from Google APIs. Where it differs from our Terms of Service or other parts of this policy, this section controls.

Gaapio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing Information with Third Parties

Personal information collected by Gaapio is stored in databases hosted by third-party service providers in the United States. These providers do not access or use your information except to provide storage, infrastructure, or operational support.

Gaapio may also use third parties to send communications about products, services, and events.

A current list of Gaapio's sub-processors is available here: https://security.gaapio.com/

Gaapio does not disclose personal data to external parties except in the following cases:

• You request or authorize it
• It is necessary for Gaapio-hosted or co-sponsored events
• Compliance with law enforcement requests or legal obligations
• To enforce agreements or protect the rights and safety of Gaapio and others
• Emergencies or force majeure events
• To resolve disputes or respond to legally authorized representatives

Aggregated, non-identifiable data may also be shared with partners for analytics or marketing purposes.

Gaapio's website may link to third-party platforms (e.g., LinkedIn, Twitter). Interactions with these services are governed by their respective privacy policies.

Transferring Personal Data to the U.S.

Gaapio is based in the United States, and information collected through our services is processed in the U.S.

By using Gaapio's website or services, you acknowledge that your information will be transferred to and processed in the United States.

The U.S. has not received an EU "adequacy" determination; however, Gaapio uses:

• Standard contractual clauses (SCCs)
• Vendor data processing agreements
• Enhanced safeguards directed by the European Data Protection Board

Gaapio has received zero government requests for user data since our founding.

For questions, contact: privacy@gaapio.com

Data Subject Rights

Where applicable under GDPR or similar laws, you have the right to:

• Be informed
• Access your data
• Request correction
• Request deletion
• Restrict processing
• Data portability
• Object to processing
• Avoid automated decision making and profiling

You may request:

• The purpose of processing
• Categories of personal data
• Third parties who received your data
• Data source (if not provided directly by you)
• Storage duration

Gaapio will provide reasonable access at no cost. If access must be delayed, Gaapio will provide a timeline. If access is denied, we will explain the reason.

Residents of the EU may also contact their national Data Protection Authority.

Security of Your Information

Gaapio implements appropriate technical and organizational measures to secure personal data against loss, misuse, or unauthorized access.

Data Storage and Retention

Personal data is stored on Gaapio-managed servers and cloud-based systems located in the United States.

Customer service data is retained for the duration of the business relationship and for a period thereafter for operations, analytics, and archiving.

Prospect data is retained until it is no longer valuable to Gaapio and is then purged.

All personal data may be deleted upon verified request, subject to legal exceptions.

For inquiries, email: privacy@gaapio.com

Children's Data

Gaapio does not knowingly collect or solicit personal information from children. Our services are intended for business and professional users only.

Questions, Concerns, or Complaints

If you have any questions, concerns, or would like to exercise your data rights, please contact: