Effective 29 October 2026 · Version 1.1
Data and purposes
We process account identity (name, email address and mobile number), workspace membership, plan content (plans, tasks, comments, and files), assistant conversations, security events such as sessions, device names, and IP addresses, support records, and billing metadata to provide, secure, support, and improve the contracted service. We use your mobile number to contact you about your account, for support, and to follow up on sales enquiries.
The GlooFloo mobile app
The app asks for each permission only when you use the feature that needs it, and you can withdraw it in your phone's settings. • Camera and photos: only when you take or choose a photo to attach to a task or to a message to GlooFloo AI. • Files: only the files you choose to attach are uploaded. • Microphone: only while you hold the button to talk to GlooFloo AI. The recording goes to a speech-to-text provider (Deepgram or Speechmatics) to become text. GlooFloo does not keep the recording, and keeps the text only if you send it. • Notifications: if you allow them, the app registers a push token with Firebase Cloud Messaging (Google). Each notification's title and text pass through Firebase and, on iPhone, Apple's push service. • Purchases: plans and AI credits bought in the app are paid through the App Store or Google Play, which handle the payment details. RevenueCat verifies purchases for us using a workspace billing identifier, and GlooFloo keeps the purchase record. The app contains no advertising, analytics, or crash-reporting SDK.
GlooFloo AI and model providers
When you use GlooFloo AI, such as the assistant, suggestions, summaries, or document import, the messages, files, photos, and transcribed voice you send, with the workspace details needed for the answer, are sent to an external AI model provider to generate it. AI features that run on their own, such as recurring briefings, send the workspace details they cover. Depending on our configuration and your workspace settings, the provider may be Anthropic (Claude), Google (Gemini), DeepSeek, or OpenAI. Each provider processes the data under its own API terms, which govern how long it keeps the data and whether it may use it to improve its services. Some providers process data outside your country, including in the United States and, for DeepSeek, China. Workspace administrators can switch the assistant off and, where the setting is available, limit which providers may be used.
Retention and deletion
Tenant administrators control workspace access and content. Data is kept while the service is provided, then deleted or anonymized: • Deleting your account removes your sign-in identity, sessions, and workspace memberships at once. Content you added stays in its workspace under an anonymous name. • A deleted workspace is held for 30 days so it can be restored, then its records and stored files are erased. • Database backups expire in rotation, normally within 35 days. • Billing and store-purchase records are kept for as long as tax and accounting law requires.
Rights and transfers
Requests for access, correction, export, deletion, restriction, or objection can be sent to [email protected]. Applicable rights and transfer safeguards depend on location and contract.