Privacy Policy

Geolize SpA ("Geolize," "we," "us," or "our") operates Portals, a business operations platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our websites, applications, and services (collectively, the "Services").

This policy explains our privacy practices. Optional Google connections require specific authorization; using Portals or signing in with Google does not by itself authorize access to Gmail or Google Calendar.

Definitions

• Customer Data means any data, content, or materials that you or your end users submit to the Services.
• Usage Data means information collected automatically about how you interact with the Services.
• Personal Information means information that identifies, relates to, or could reasonably be linked to you or your household.

Information we collect

Information you provide directly

We collect information that you voluntarily provide when you:

• Create an account (name, email address, password)
• Set up your organization (company name, team member details)
• Use the Services (projects, tasks, client information, documents, comments)
• Make a purchase or update billing information (processed by Stripe; we do not store full payment details)
• Contact our support team or provide feedback
• Participate in surveys, promotions, or events

Information collected automatically

When you use the Services, we automatically collect:

• Device information: browser type, operating system, device identifiers
• Log data: IP address, access times, pages viewed, referring URL
• Usage data: features used, actions taken, performance metrics
• Cookies and similar technologies: as described in our cookie practices below

Information from other sources

We may receive information about you from third-party services you integrate with Portals, identity verification services, and publicly available sources.

Google, Gmail, and Google Calendar data

This section applies to Google sign-in and the Google connectors you choose to enable in Portals. Its use and disclosure restrictions take precedence over the general provisions of this policy for data received from Google.

Authorization and account selection

When you sign in with Google, we receive the identity information needed to identify you. Connecting Gmail or Google Calendar is a separate, optional action: you select the account and review permissions with Google. Portals receives authorization credentials, not your Google password. The connection belongs to your user account; belonging to or administering the same workspace does not grant access to another person's Google account.

Information we access

• Identity and connection: email address, Google account identifier, granted permissions, connection status, and access and refresh credentials. Google sign-in may also provide your name and profile picture.
• Gmail: messages and conversations you request, senders, recipients, subjects, dates, message text, labels, drafts, and message-part data included in Gmail's response. To prepare drafts, we process the recipients, subject, and text you specify.
• Google Calendar: accessible calendars, names, time zones, events, titles, descriptions, locations, dates, organizers, participants, and busy or available periods needed for the requested operation.

How we use this data

We use this information to identify your account and perform requested operations: search and read mail, organize messages with labels, archive or mark messages, manage drafts, move messages to trash or restore them; and view calendars, availability, and events, or create events. The Portals Gmail connector does not send email or allow permanent deletion of received or sent messages. The Google permission used for these features also permits sending email, but Portals blocks that operation.

Storage and protection

We store connected-account identity, permissions, connection status, encrypted credentials, and activity records. Credentials are encrypted with keys protected by Google Cloud Key Management Service and decrypted on the server when needed to authorize an operation. We query Gmail and Calendar on request without copying the entire mailbox or building a permanent event index. When you authorize an agent to access an account, retrieved results may become part of its conversations and execution, approval, and outcome records stored in Portals.

Providers and recipients

Convex provides the backend that processes operations and stores connection and agent data. Google provides the Gmail and Calendar APIs and key management. AI and security inspection providers are described below; their processing may take place in other countries. We transmit only the information needed to deliver the feature you authorized. We do not sell Google data or use it for advertising, commercial profiling, data brokerage, or credit evaluation. A business transfer involving this data requires your prior explicit consent. Sharing a workspace does not automatically share the contents of your connected account.

Google data and artificial intelligence

When you allow an agent to use Gmail or Google Calendar, you authorize it to retrieve the information needed to handle your requests and include it in its working context. That context, including tool results, is sent through Geolize's AI service to the model provider; the default configuration uses OpenAI to generate responses. Security checks use Jev, by TypeSafe, through the same service to evaluate your requests and the agent's responses. Portals also sends Jev the arguments of each Google operation before execution and its results before delivering them to the agent, to detect malicious instructions or attempts to extract information. These texts may contain Google data. If this inspection cannot be completed, Portals blocks dispatch of the operation or delivery of the result, as applicable. Blocking a result does not undo an operation that has already executed. This is our own inspection solution, which may block legitimate content or miss an attack; it does not guarantee link safety or scan binary files. These limitations are disclosed before access is allowed, with a recommendation to review actions before approving them. Conversations, results, and action records are stored in Portals as described below. Portals does not use data received from Google to train, fine-tune, or improve general-purpose AI models.

Human access

Content received from Google is not used for routine human review. We limit human access to cases permitted by Google: your explicit authorization for specific content, investigation of a security issue or abuse, compliance with a legal obligation, or aggregated and anonymized information for internal operations.

Connection retention

We retain encrypted credentials while the connection is active. Disconnecting immediately blocks new operations and starts revocation with Google. We delete the stored credentials when Google confirms revocation. If revocation fails, the encrypted material needed to resolve it remains protected until recovery is complete; the connection stays blocked.

Connector activity records contain identifiers, operation, time, and outcome, without email bodies, search text, or credentials. Their retention period is 30 days, with daily batch deletion. Expired or completed authorization records are scheduled for deletion after 24 hours when they do not contain material awaiting recovery. These periods do not apply to agent conversations or execution and approval records, which may contain retrieved information, action arguments, and results.

Disconnecting does not delete the connected-account record, which lets us display its status and identify issues. You can request deletion of this metadata and other connection data through the privacy contact below. Information needed for pending revocation is handled as described above.

Drafts, messages, and events remain in Google, where you can manage them. Disconnecting does not delete Google data already included in agent conversations, results, and action records, or content saved in Portals tasks or documents. Archiving an agent or removing one of its conversations from view preserves the conversation and execution and approval records; it does not erase that data. You can request deletion by emailing privacy@geolize.io and identifying the connected account and the affected conversations or data.

Disconnecting or requesting deletion

You can disconnect an account in Portals under My account → Connectors, or remove access through your Google Account connections. To request deletion of connection data, conversations, or agent records containing Google data, email privacy@geolize.io from your Portals email address and identify the connected account and affected data. Do not include passwords, credentials, or email content. We will verify your identity and process your request within applicable legal time limits. Removing access can affect Gmail and Calendar linked through the same Google authorization.

Limited use of Google data

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Services
• Process transactions and send related communications
• Send technical notices, security alerts, and administrative messages
• Respond to your requests, comments, and questions
• Monitor and analyze trends, usage, and activities
• Detect, prevent, and address fraud, abuse, and technical issues
• Personalize and improve your experience
• Comply with legal obligations

How we share your information

We do not sell your personal information. We may share your information in the following circumstances:

• Service providers: with vendors who perform services on our behalf (hosting, analytics, payment processing, customer support), bound by confidentiality obligations.
• Within your organization: with other members of your workspace, as determined by your organization's settings and permissions.
• Business transfers: in connection with a merger, acquisition, or sale of assets.
• Legal requirements: when required by law, regulation, legal process, or governmental request.
• Protection: to protect the rights, privacy, safety, or property of Geolize, our users, or the public.

Data retention

We retain your information for as long as your account is active or as needed to provide the Services. When you delete your account, we delete or anonymize your Customer Data within 90 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).

Data security

We apply access controls and encrypt communications to protect information. Google connector credentials are encrypted at rest as described in the relevant section. No transmission or storage method eliminates every risk; we do not guarantee absolute security.

International data transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we implement appropriate safeguards in accordance with applicable data protection laws, including standard contractual clauses where required.

Your privacy rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal information
• Object to or restrict certain processing activities
• Request portability of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at privacy@geolize.io. We will respond within the timeframe required by applicable law.

For California residents

Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information we collect and how we use it, the right to request deletion, and the right to non-discrimination for exercising your rights. We do not sell personal information as defined by the CCPA.

For European Economic Area residents

Under the General Data Protection Regulation (GDPR), our legal bases for processing your information include performance of a contract, legitimate interests, consent, and compliance with legal obligations. You may contact us to exercise your rights under the GDPR.

For Chilean residents

Under Chilean Law No. 19.628 on the Protection of Private Life, you have the right to access, modify, cancel, and block your personal data. Geolize SpA is domiciled in Santiago, Chile, and complies with applicable Chilean data protection regulations.

Cookies and tracking technologies

We use cookies and similar technologies to operate the Services, remember your preferences, and understand how you use the Services. You can control cookies through your browser settings. Disabling certain cookies may limit functionality of the Services.

We use the following categories of cookies:

• Essential cookies: required for the Services to function properly.
• Analytics cookies: help us understand how the Services are used.
• Preference cookies: remember your settings and choices.

Children's information

The Services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will take steps to delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice (such as email notification). Your continued use of the Services after any changes constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Geolize SpA
Av. Italia 850, Providencia, Santiago, Chile
Email: privacy@geolize.io
Web: geolize.io