Privacy Policy

1. Who we are

AGByte Labs B.V. is a private limited company registered in the Netherlands and based in Amsterdam. Gathersense is a product owned by AGByte.

For the processing described in this policy, AGByte is the controller within the meaning of the EU General Data Protection Regulation (GDPR), except where section 2 says that we act as a processor.

You can reach us at support@gathersense.com. Please put "Privacy" in the subject line so that your message reaches the right person quickly.

2. Our role: controller or processor

We handle personal data in two different roles.

As controller. We decide why and how personal data is used for our own business: running our website, answering demo requests and other questions, managing customer relationships and billing, keeping accounts and the Service secure, providing support, and improving the Service using information about how it is used.

As processor. Customers upload documents and other content to Gathersense, such as contracts, playbooks, templates, comments and questions, and the Service produces results from them. We call all of this "Customer Content". Customer Content often contains personal data, for example the names and contact details of the people named in a contract. For Customer Content, the customer organisation is the controller and we are its processor. We process Customer Content only to provide the Service to that customer and on its instructions, under a data processing agreement.

If your personal data appears in Customer Content, the organisation that uploaded it decides what happens to it, so please contact that organisation. If you contact us instead, we will pass your request on and help the organisation respond.

3. The personal data we collect

When you visit our website

• Technical data that your browser sends when it loads a page, such as your IP address, browser type, operating system, the page you came from, and the date and time of your visit. Our hosting and security providers use this data to deliver the website and to protect it against attacks and abuse.
• Analytics data, only if you accept analytics cookies: which pages you visit, how long you stay, the links you click, your device type and your approximate location (country or city, derived from your IP address). See section 10.

When you request a demo or contact us

• Your name, work email address, role, organisation, team size, the topics you are interested in, and anything you write in your message.
• Your IP address and the result of an automated check that tells people from bots, which we use to block spam and abuse.
• Our correspondence with you, including emails and notes from our conversations.

When you use Gathersense

• Account data: your name, work email address, password (stored only in hashed form), an optional profile photo, your language preference, and your organisation, workspace, teams and role.
• Sign-in and security data: your two-factor authentication setting and one-time codes, sign-in times, your active sessions, the type of device or app you use (for example a browser, the Word add-in or a mobile app), a device identifier that the add-in and apps use to label your sessions, and IP addresses.
• Sign-in with Google: if you choose to sign in with your Google account, we receive basic account information from Google, such as your name, email address and Google account identifier.
• Activity and usage data: what you do in the Service, such as the documents you upload, the reviews you run, and the features you use; records of AI requests (time, feature, model used and volume of text processed), which we use for usage limits, billing and security; technical logs of requests, errors and performance; and the audit trail that your workspace keeps of important actions.
• Customer Content: the documents and other content that you and your colleagues add, which we process as a processor (see section 2).
• Communications: the emails we send you about your account and the Service, such as sign-in codes, invitations, alerts and reminders, and the messages you send to our support.

When you are a customer contact or other business contact

• Your name, job title, employer and business contact details, and our communications and agreements with you.
• Billing contacts, invoicing details and payment records of the organisation you represent.
• Professional information about business contacts we would like to work with, from public sources such as company websites and professional networks.

Information we receive from others

• When your organisation's administrators invite you to a workspace, they give us your name, email address and role.
• When you sign in with Google, Google gives us the information described above.

You are not required to give us personal data. Some data is, however, necessary to provide the Service: without an email address, for example, we cannot create an account for you.

4. How we use personal data and why

Purpose	Main data used	Legal basis under the GDPR
Providing the Service: creating and managing accounts, signing you in, and running the features you use, including AI features	Account, sign-in and activity data; Customer Content (as processor)	Performance of a contract (Art. 6(1)(b)). Where you use the Service on behalf of your organisation: our and your organisation's legitimate interest in providing the Service it has subscribed to (Art. 6(1)(f)). Customer Content: the customer's instructions.
Keeping the Service and the website secure: preventing fraud, spam and abuse, detecting and investigating incidents, limiting request rates, locking accounts after repeated failed sign-ins, and sending security alerts	Technical, log, sign-in and security data	Legitimate interest in protecting our systems, customers and users (Art. 6(1)(f)); our legal obligation to keep personal data secure (Art. 6(1)(c) and Art. 32)
Service emails: sign-in codes, invitations, password resets, the alerts and reminders you have switched on, and important changes to the Service or our terms	Account data	Performance of a contract or legitimate interest, as in the first row
Support: answering your questions and solving problems	Account data, communications and the information you choose to share	Performance of a contract or legitimate interest, as in the first row
Usage limits, billing, invoicing, accounting and tax	Customer contact, billing and usage data	Performance of a contract (Art. 6(1)(b)); legal obligations under tax and accounting law (Art. 6(1)(c))
Responding to demo requests and enquiries, and preparing proposals	Demo request data and correspondence	Steps taken at your request before entering into a contract (Art. 6(1)(b)); legitimate interest in responding to business enquiries (Art. 6(1)(f))
Business-to-business marketing: telling business contacts about Gathersense, updates and events	Business contact data	Legitimate interest in promoting our business (Art. 6(1)(f)), or your consent where the law requires it (Art. 6(1)(a)). You can opt out at any time.
Website analytics	Analytics data	Your consent (Art. 6(1)(a))
Improving the Service: understanding which features are used, fixing errors, and improving performance and quality	Activity, usage and log data, but not Customer Content	Legitimate interest in developing and improving our products (Art. 6(1)(f))
Complying with the law, enforcing our terms, and establishing, exercising or defending legal claims	The data relevant to the matter	Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f))
A merger, acquisition, reorganisation or sale of all or part of our business	The data relevant to the transaction	Legitimate interest (Art. 6(1)(f))

Where we rely on legitimate interest, we have weighed our interests against your rights and freedoms. You can ask us for more information about this assessment, and you can object (see section 9).

We do not use Customer Content for our own purposes, such as marketing or product analytics. Our staff look at Customer Content only when that is necessary to provide the Service, for example when a customer asks our support team to investigate a problem with a specific document, to keep the Service secure, or when the law requires it.

5. AI features

Gathersense uses artificial intelligence to read documents and to produce results such as summaries, risk findings, playbook checks and answers to questions.

• How it works. When you use an AI feature, we send the relevant Customer Content (for example the text or file of a contract, the relevant parts of a playbook or template, and your question) to an AI model provider. The provider processes it to generate the result and returns that result to us. AI processing is the core of Gathersense. Without it, the Service cannot analyse documents, which is why customers agree to this processing when they subscribe.
• No training. We do not use Customer Content to train or fine-tune AI models, whether our own or anyone else's. We use AI providers only on terms, or with settings, under which they may not use Customer Content to train or improve their models.
• Limited retention by AI providers. AI providers may use Customer Content only to provide their service to us. Some keep inputs and results for a limited period to detect abuse or to meet legal obligations. Where a provider keeps a copy of a document so that the AI can search it, that copy exists only while the document is in your workspace and is deleted together with it.
• Adapting to your organisation. Gathersense can adapt to how your organisation works, for example by applying your playbooks and templates, or by turning your team's feedback on findings into directives for future reviews. These adaptations are part of your organisation's Customer Content. They are used only in your workspace and never for other customers.
• No automated decisions about you. We do not use AI to make decisions about individuals that have legal or similarly significant effects within the meaning of Article 22 GDPR. Gathersense supports the people who review documents. It does not decide anything about you.
• Results can be wrong. AI results can be inaccurate or incomplete and must be checked by a person. Gathersense does not give legal advice.

6. Who we share personal data with

We share personal data only as described below, and only as far as necessary.

• Service providers that process personal data for us and on our instructions, under contracts that require them to protect it: providers of hosting and infrastructure, content delivery and network security, document storage, background processing, AI models, email delivery, website analytics (only if you accept analytics cookies), bot protection for our forms, and the business software we use to communicate and run our company. Customers can ask us for our current list of sub-processors.
• Your organisation. If you use Gathersense through your organisation's workspace, the owners and administrators of that workspace can see your account details, your activity in the workspace and the content you add, in line with the permissions they set.
• Other companies whose services you choose to use with Gathersense, such as Google when you sign in with Google, or Microsoft when you use our add-in in Word. They process your data under their own privacy policies.
• Professional advisers and insurers, such as lawyers, accountants and auditors, who are bound by confidentiality.
• Authorities and courts, where the law requires it, for example under a court order. We check that each request is lawful, disclose only what is required and, unless the law prohibits it, inform the customer concerned.
• A buyer or successor of all or part of our business, if we are involved in a merger, acquisition, reorganisation or sale of assets. Your personal data will then remain protected under this policy or under a policy that is at least as protective.

We do not sell personal data. We do not rent it out, trade it, or share it with data brokers or for advertising. We disclose Customer Content only to our sub-processors as described in this policy, as the customer instructs, or where the law requires it.

7. Where your data is processed

We host Gathersense in the European Union: our application servers, databases and document storage are located in data centres in the EU.

Some of our service providers, including AI model providers, process data outside the European Economic Area (EEA), for example in the United States. When personal data is transferred outside the EEA, we make sure that it remains protected as the GDPR requires, by relying on:

• an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for providers certified under it; or
• the Standard Contractual Clauses approved by the European Commission, together with additional safeguards where these are needed.

You can ask us for more information about these safeguards, including a copy of the relevant clauses with commercial terms removed.

8. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in section 4, or for as long as the law requires.

Data	Retention period
Account data	As long as your account exists. We delete or anonymise it within 90 days after your account is deleted or your organisation's subscription ends, unless we need to keep part of it for longer to meet a legal obligation or to establish, exercise or defend a legal claim.
Customer Content	As long as the customer keeps it in the Service. A document that a user deletes is kept for up to 30 days in case the deletion was a mistake. It is then permanently deleted, together with its reviews, findings and conversations and any copies held by AI providers for search. All remaining Customer Content is deleted within 90 days after the customer's subscription ends.
Sign-in, security and technical logs	Normally no longer than 12 months, unless we need them for longer to investigate a security incident or a legal claim.
Records of AI requests	As long as needed for usage limits, billing and security, normally no longer than 24 months.
Demo requests and sales correspondence	Up to 24 months after our last contact, unless you become a customer.
Support correspondence	Up to 24 months after the request is closed.
Billing and accounting records	7 years, as required by Dutch tax and accounting law.
Website analytics data	Up to 14 months.
Records of marketing opt-outs	As long as needed to respect your choice.

Deleted data may remain in backup copies for a limited time, until those copies are overwritten in the normal course. Backup copies are protected in the same way as the original data.

9. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• rectification: have inaccurate personal data corrected and incomplete data completed. You can update most of your account details yourself in the Service;
• erasure: have your personal data deleted, for example when we no longer need it or when you withdraw your consent;
• restriction: ask us to limit how we use your personal data, for example while we check a complaint about its accuracy;
• data portability: receive the personal data you have given us in a structured, commonly used and machine-readable format, or have it sent to another organisation where this is technically feasible;
• object to processing based on legitimate interest, on grounds relating to your particular situation, and object at any time to the use of your personal data for direct marketing;
• withdraw your consent at any time where we rely on it. This does not affect the lawfulness of processing before you withdraw.

Some of these rights have limits, for example where the law requires us to keep certain data.

How to use your rights. Email support@gathersense.com with "Privacy request" in the subject line. We may ask you to confirm your identity, for example by replying from the email address linked to your account. We respond within one month. If a request is complex, or if we receive many requests, we may extend this period by up to two further months; we will tell you if we do. Using your rights is free of charge, unless a request is manifestly unfounded or excessive.

Deleting your account. To delete your Gathersense account, ask your workspace administrator, or email us from the address linked to your account. If your account belongs to an organisation's workspace, we may confirm your request with that organisation first, because it controls the workspace. Deleting your account removes your profile and sign-in details. Content that you created in a workspace, such as comments or reviews, belongs to the organisation and is handled according to its instructions. An organisation can ask us to delete its entire workspace, in which case we delete its content as described in section 8.

Demo requests and marketing. To have a demo request deleted, write to support@gathersense.com. To stop receiving marketing emails, use the unsubscribe link in any marketing email or write to us.

Content uploaded by an organisation. If your personal data is in Customer Content, for example because your name appears in a contract, please send your request to the organisation that uploaded it. We will forward any such request we receive to that organisation and help it respond.

Complaints. If you are unhappy with how we handle your personal data, please tell us first, so that we can try to put it right. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe the infringement took place. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In the United Kingdom, it is the Information Commissioner's Office (ico.org.uk).

10. Cookies and similar technologies

Cookies are small files that a website stores on your device. Similar technologies, such as your browser's local storage, work in a comparable way. We use them as follows.

On our website (gathersense.com)

Type	What it does	Your consent
Strictly necessary	Delivers the website securely and protects it and our forms against attacks, spam and bots. This includes a bot check by Cloudflare Turnstile on our demo request form, which processes technical information about your browser and connection.	Not needed: the website cannot work securely without it
Preferences	Remembers your language (local storage item gathersense-locale) and your cookie choice (local storage item gathersense-cookie-consent).	Not needed: these only remember choices you made
Analytics	Google Analytics, provided by Google Ireland Limited, measures how visitors use the website so that we can improve it. It sets the cookies _ga and _ga_<ID>, which expire after up to 2 years. We have set it up not to use the data for advertising or for Google signals. Google may process this data in the United States under the EU-U.S. Data Privacy Framework.	Only used if you accept

When you first visit our website, you choose whether to accept analytics cookies. You can change your choice at any time through Cookie settings at the bottom of every page. If you withdraw your consent, we stop loading Google Analytics and remove its cookies from our domain.

In Gathersense

Gathersense uses only what it needs to work:

• strictly necessary cookies that keep you securely signed in to the web application. They hold your session and cannot be read by scripts on the page;
• local storage in your browser, in the Word add-in and in our apps, for your sign-in session, your preferences (such as your language) and the state of the interface.

Gathersense does not use advertising cookies or third-party analytics.

11. How we protect personal data

We use technical and organisational measures that are appropriate to the risk, including:

• encryption of data in transit, and encryption of stored documents;
• access controls that keep each customer's data separate, and that limit what each user can see to their role and permissions;
• hashed passwords, optional two-factor authentication, protection against password guessing, and session controls that let you see and end your active sessions;
• strict limits on which of our staff can access production systems, with logging of administrative changes;
• careful selection of service providers, which are bound by data processing agreements and confidentiality.

No system is completely secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay. To report a security vulnerability, write to support@gathersense.com.

12. Children

Our website and the Service are intended for professionals. They are not directed at children, and Gathersense may not be used by anyone under 18. We do not knowingly collect personal data from children. If you believe that a child has given us personal data, please contact us and we will delete it.

13. Other companies' services

Our website and the Service link to, or work with, services of other companies, such as Google, Microsoft and LinkedIn. Those companies handle personal data under their own privacy policies, which we encourage you to read. When you visit our page on LinkedIn, LinkedIn processes your personal data under its own privacy policy; for the statistics LinkedIn gives us about our page, LinkedIn and we may be joint controllers.

14. Changes to this policy

We may update this policy when our services or the law change. The date at the top of this page shows when it was last updated. If we make important changes, we will inform our customers in advance by email or in the Service.

15. Contact us

AGByte Labs B.V., Amsterdam, the Netherlands

Email: support@gathersense.com

Read our Terms of Service for the terms that apply to the use of Gathersense and our website.