Privacy notice

Ngbesso Aboua, Anton-Sattler-Gasse 115, 1220 Wien, Austria operates GABO. For privacy requests, write to team.reuso@gmail.com or call +43 660 365 0905.

When you register, Supabase Authentication handles your email, first name, password credentials, confirmation and session data. We use this to create and secure your account and restore your workspace (GDPR Art. 6(1)(b), and Art. 6(1)(f) for abuse prevention and security). An email and credentials are needed for an account; without them you can only use the available anonymous entry flow. Authentication/session cookies are necessary for sign-in.

A source URL, handle or app link you submit can start identity research before signup. GABO stores a handoff and reusable research attempt in Supabase, and may fetch public sources and send the source and evidence to OpenAI. After signup, company sources, identity, Company Brain facts, corrections and research outputs are saved for your workspace. This provides the analysis you request (Art. 6(1)(b) or pre-contractual steps at your request). Without a source, GABO cannot research it.

Saved company data generally remains until you delete that company or request erasure, subject to linked records and legal retention. Anonymous handoff access expires after 24 hours and the identity-session cookie after 30 days; browser expiry does not itself purge associated database rows. No automatic database purge period has been verified.

Market, website/SEO, X and competitor research may process submitted URLs, pages, search results, public posts, usernames, founder or professional contact details, and evidence about identifiable people. GABO may save evidence, generated analyses, prompts/outputs, strategies, opportunities, drafts, actions and measurement history in Supabase. OpenAI generates or analyses requested work; DataForSEO, X, public websites and the Apple iTunes API may provide source data. Public availability alone does not mean consent.

For a user's requested work, the likely basis is Art. 6(1)(b). Processing identifiable third-party public data, including prospect/contact details, requires an Art. 6(1)(f) interests assessment and consideration of Art. 14 notice duties; those questions remain under legal review. Sources include user submissions, public websites/search results, social profiles/posts and connected platforms. Saved records may remain with the company until deletion; no fixed shorter period is implemented.

If you connect X, GABO requests tweet.read, users.read, tweet.write and offline.access. It stores the account identifier/handle, granted scopes and encrypted credentials in Supabase; it may read connected-account and public X data for requested research. Direct posting is rollout-gated and requires a separate explicit action. Disconnecting stops GABO use, but the encrypted credential row is marked revoked rather than immediately erased; company deletion removes company-linked data. X also processes OAuth and API traffic.

If you connect Gmail, GABO requests openid, email and gmail.send. It stores the verified sending address, granted scopes and encrypted refresh token in Supabase. It does not request general mailbox reading. A message is sent through Gmail only after you review and authorize the exact sender, recipient, subject and body. GABO stores the draft, authorization and send outcome with your company. Disconnect attempts provider revocation and marks the connection revoked; the encrypted credential row remains until company deletion. Google processes the OAuth and send request.

For a paid plan, Stripe handles hosted checkout, payment and the Customer Portal. GABO receives and stores Stripe customer, checkout, subscription, plan, status and webhook identifiers in Supabase, with the account/company link. GABO does not store full card details. These data are needed to manage a subscription (Art. 6(1)(b)); some records may also be needed for legal accounting duties (Art. 6(1)(c), precise periods require review). Company deletion does not erase account-level billing records.

If you use the online withdrawal form, GABO stores your name, contact email, contract identification, any partial-contract details, declaration and receipt time in Supabase. It uses these to record and review your request and provide a downloadable receipt (Art. 6(1)(c) where consumer law applies, otherwise Art. 6(1)(f) for request handling). These records are not visible to other visitors. A fixed deletion period has not yet been set; contact us for an applicable erasure request. The downloadable receipt is delivered in the browser, not automatically by email.

Emails to the operator and information you include are used to answer requests (Art. 6(1)(b) or (f), or Art. 6(1)(c) for legal requests). Vercel hosts the site and may handle IP address, device/browser and request/log data needed to serve and protect it. Server logs record bounded operational errors and IDs. Exact hosting/mailbox log content and retention settings are not controlled in this repository; we do not state a fixed period for them.

Depending on the feature, data are processed by Vercel (hosting), Supabase (authentication/database), OpenAI (AI), DataForSEO (search/SEO), Stripe (billing), X (connected/social data), Google/Gmail (OAuth/sending), public websites and the Apple iTunes API. Optional website publishing may also use Vercel. The configured Supabase project region is eu-central-1. Other provider locations and any onward transfer outside the EEA depend on actual settings and contracts. We do not assert EEA-only processing or a particular international-transfer safeguard while these remain unverified.

GABO uses necessary Supabase authentication cookies, an anonymous company handoff cookie (up to 24 hours), an identity-research session cookie (up to 30 days), and short-lived Gmail and X OAuth state cookies (up to 10 minutes). These support sign-in, safe continuation and connection security. No app-level analytics, advertising cookies or localStorage/sessionStorage were found in the audited code. No nonessential tracking is intentionally loaded by the app, so there is no preference banner to manage.

Saved workspace research, drafts and history have no fixed automatic deletion schedule. You can correct Company Brain facts and delete a company in the workspace. There is no self-service account deletion. Disconnecting X or Gmail disables GABO use but does not immediately erase the stored encrypted credential row. Billing and legal records may outlive company deletion. Contact us for account-level deletion or other privacy requests; we will verify ownership and assess any applicable retention duty.

Subject to GDPR conditions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. You may complain to the Austrian Data Protection Authority or another competent supervisory authority. Email team.reuso@gmail.com from your account address where possible; we may need further verification.