Legal

Privacy statement

This statement describes which data gabily processes about you, why, who we pass it on to and how long we keep it. It describes what the software actually does, not what is customary.

Who is responsible

The controller for this processing is:

Which data we process

Depending on how you use gabily, this covers:

Your name, email address and, if you request a custom digest, your phone number and the name of your company. If you add colleagues, we also process their names and email addresses so we can send each of them a personal invitation after you approve the digest.
When and how you gave your consent, including your IP address and the browser you used. We record this because we have to be able to demonstrate that you signed up yourself if anyone complains.
What you write yourself: your description of what you want to follow, any notes with a request, a request to adjust your digest, and the reason you give when you unsubscribe.
Which edition went to which address, whether it was opened and whether the audio was played. We use this to see whether delivery works and whether the digest is being read.
Technical data needed to run the service and prevent abuse, such as error messages and temporary log lines.

The intake conversation

If you request a custom digest through the conversation on the site, we keep that conversation: everything you type or say, your email address and your IP address. The text goes to Google to compose a reply, and if you record something, that recording goes there too to be transcribed. So do not mention anything in it that should not sit with us. If you name your company, we look that name up through Google to understand what you do.

A conversation that sits idle for thirty days is closed, and after ninety days we delete it. If the conversation becomes a real request, we keep the request itself and remove the transcript, your IP address and the address from the conversation as soon as you ask us to delete your data.

Why we do this

We process your data to produce and deliver the digest you signed up for, to handle your request, to let you know when something goes wrong, and to invoice you if you have a paid subscription. The legal basis is the performance of our agreement with you, or your consent in the case of a signup, and our legitimate interest in preventing abuse and being able to account for our administration.

Who we pass data to

We do not sell your data and we do not use it for advertising. To run the service we do rely on a number of suppliers, who only do what we instruct them to do:

Google: processes the text of your intake conversation and any voice recordings, writes the digest and produces the audio edition. When we look up a company name, that name goes to Google Search.
Resend: sends our email. They process your email address, the content of the message and whether it arrived and was opened.
Heroku (Salesforce): runs the application and the database holding the data described above.
Cloudflare: hosts the audio files of the editions and checks on forms that you are not a bot. Your IP address goes to Cloudflare for that check.
Stripe: handles payment for a paid subscription. Your email address goes there; you enter your payment details directly with Stripe and they never reach us.

The typefaces on this site are loaded from Google Fonts. Google sees the IP address of your browser in the process.

Some of these suppliers are established in the United States, or may process data there. This happens on the basis of the standard contractual clauses adopted by the European Commission.

We use no analytics, no advertising pixels and no third-party tracking cookies.

How long we keep data

For as long as your subscription or request is running, and after that for as long as we need it for our administration. A few periods are fixed: temporary log lines disappear after a week, operational data about runs after three months, a signup you never confirm after thirty days, and an abandoned intake conversation after ninety days.

We deliberately keep two things longer. We record your consent as evidence that you signed up yourself. On an erasure request we pseudonymize that evidence with a random marker. The suppression list intentionally keeps your recognizable real address, solely to prevent us from emailing you again later.

Your rights

You may see which data we hold about you, have it corrected or deleted, object to its use, and request a copy in a common file format. You can also withdraw consent at any time; that does not affect anything that happened before.

Send us a message through the contact page and we will take care of it. Every digest also carries an unsubscribe link at the bottom that takes effect immediately.

Cookies

We use four cookies, all of them necessary to make the site work: one that remembers which language you view the site in, and three that keep you signed in to the intake conversation, to my gabily and to the admin panel. They last a year (the language) or thirty days (the rest). There are no cookies that track your behaviour.

Complaints

If you disagree with how we handle your data, please tell us first. You also always have the right to lodge a complaint with your national data protection authority.

Last updated on 3 August 2026.