Privacy Policy

1. Introduction

This Privacy Policy describes how Open Curiosity, Inc. ("Open Curiosity," "we," "us," or "our"), a company based in the United States, collects, uses, discloses, and safeguards information in connection with Gini, an AI coworker your team adds to its chat that does the work you delegate to it across the apps and accounts you connect, together with our websites and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this Privacy Policy.

Open Curiosity, Inc. is the controller of the personal information described in this policy. Where Gini handles content from your connected accounts or your Gini environment solely to carry out a task you gave it, we handle that content on your behalf and on your instructions.

We review this policy periodically to keep it accurate, complete, and aligned with how Gini actually works. If you have any questions, contact us at privacy@ginicomputer.com.

2. How Gini runs

We provision and operate a dedicated Gini environment for your account. Your Gini's context, history, files, and connected-account credentials live in that environment, on infrastructure we manage. It is dedicated to your account, or to your team for a team environment, and isolated from other customers.

Your Gini environment is yours. This policy describes what we collect and where data goes.

3. Information we collect

A. Information you provide to us

• Account data. When you sign up for Gini, we collect the basic details needed to create and operate your account (your name, email address, and profile picture as provided by your sign-in provider), together with account settings and usage metering, kept in our access-controlled service datastore.
• Communications data. If you contact us by email, through a support channel, or by scheduling a call, we collect the information you include in those communications and use it to respond to you.
• Instructions and content. The tasks you give Gini, the files you upload to your Gini environment, and the outputs Gini produces for you.

B. Connected-app data

When you connect an account (for example, a Google account or a Slack workspace), Gini accesses data from that account only with the permissions you grant, app by app and scope by scope, to perform the tasks you ask it to do. Google user data is covered in detail in Sections 5 through 7, and Slack data in Section 8.

C. Credentials and tokens

OAuth tokens and secrets you provide are protected by access controls and used only to authenticate to the services you connected. We never ask you to email or paste long-lived secrets to us.

D. Task and memory data

The instructions you give Gini, what it learns from working with you, scheduled tasks you configure, and the results of its work are kept in your Gini environment so it can recall context and improve over time.

E. Data about others

Content in your connected accounts and your Gini environment may include personal information of third parties, for example the names and email addresses of people you correspond with, or contact details in a document. We process such information solely to provide the Service at your direction, as described in this policy. You are responsible for making sure you may lawfully share such information with Gini. Please do not connect accounts or share data you do not have the right to use. Content you connect or upload may also occasionally include sensitive ("special category") information, for example health details in an email. We do not seek out such data, and we process it only because, and to the extent, you direct Gini to work with content that contains it.

F. Automatic data collection

• Service and security logs. Operational records such as timestamps, request and response metadata, error logs, and usage metering (for example, how many AI-model tokens your account consumed). These logs are for running, securing, and billing the Service.
• Device and connection data. Standard technical information received when you use the Service over the network, such as IP address, browser type, and operating system.
• Website analytics and visitor identification. On our websites (including ginicomputer.com), we use analytics and visitor-identification tools, currently PostHog and Google Analytics for measurement and RB2B for identifying business visitors so we can follow up about Gini. Whether these run at all depends on where you are and what you choose: see Section 10 for the exact rules, the cookies involved, and your controls. Where they run, they collect device and connection data, pages viewed, referrers, clicks and other interactions, approximate location derived from IP address, and identifiers stored in cookies or similar technologies. Where they run, PostHog also records a session replay of your visit (the pages as they appeared and your interactions with them), with anything you type masked before the recording leaves your browser. RB2B and its partners may associate website activity with other information they or others hold about you, including a business email address, as described in Section 10. Separately from these vendors, ginicomputer.com sets 2 first-party cookies of its own: gini_visitor_id, a random identifier (400 days) that keys our consent records and connects a signup back to the campaign that first brought you, and gini_attr (90 days), which stores that first campaign or referrer. Both are readable by us alone and by no vendor, and turning measurement off on the Your Privacy Choices page removes them and stops them from being set again.
• Product usage analytics. Inside Gini itself, we use PostHog for product usage analytics: interaction signals such as which feature ran, how long it took, and clicks, scrolls, and navigation within Gini's interface. Google user data stays out of analytics entirely (Section 6), and no Slack message content, tokens, or user identifiers are sent to analytics (Section 8).

4. How we use information

We use the information described above to:

• Provide and operate the Service. Authenticate you, run your Gini environment, execute the tasks you delegate, maintain the integrations you enable, and remember context between sessions.
• Generate responses with AI models. Relevant portions of your data are processed by AI models to produce the responses, drafts, and other outputs you ask for, as described in Section 6.
• Maintain security and integrity. Detect and prevent fraud, abuse, and unauthorized access, and investigate incidents.
• Support and communicate with you. Respond to your requests and send service-related announcements such as security notices and administrative messages. Unless you opt out, we also send occasional product updates and marketing communications (see Section 14).
• Improve the Service. Understand reliability and usage patterns using service logs and masked, aggregated, or de-identified signals that cannot reasonably identify you.
• Comply and protect. Comply with applicable law and lawful requests, enforce our terms, and protect the rights, safety, and property of our users and Open Curiosity.

We do not sell your personal information for money, and we do not use Google user data, Slack data, or the contents of your Gini environment to serve advertisements. On our websites, where you are in a region that permits it or you have consented, we use the analytics and visitor-identification tools described in Sections 3 and 10 to understand site usage and to identify business visitors for our own outreach about Gini. Where we rely on aggregated or de-identified data, we maintain and use it only in that form and do not attempt to re-identify it, except as permitted by law to confirm that our de-identification measures work. Our use of Google user data is further limited by Sections 5 through 7, which control over anything else in this policy.

Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal information under the following legal bases of the GDPR and UK GDPR:

• Performance of a contract. To create and operate your account, run your Gini environment, execute the tasks you delegate, provide support, and send essential service communications.
• Consent. To connect your Google account and process Google user data through the scopes you approve on Google's consent screen; to send you marketing or product-update email; and to use non-essential analytics and visitor-identification cookies on our websites where the law requires consent (in those regions, nothing optional loads until you accept). You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal: for Google data, by revoking Gini's access in your Google Account settings; for marketing email, by unsubscribing; for website cookies, on our privacy choices page.
• Legitimate interests. To keep the Service secure and prevent fraud and abuse; to understand reliability and improve the Service using aggregated or de-identified signals; to enforce our agreements and defend legal claims; and to carry out corporate transactions. Where we rely on legitimate interests, we balance them against your rights, and you may object as described in Section 14.
• Legal obligation. To comply with applicable law, respond to valid legal process, and keep records the law requires us to keep, such as tax and accounting records.

5. How Gini accesses and uses Google user data

If you connect a Google account, Gini requests access to Google Workspace services through OAuth scopes that you explicitly approve on Google's consent screen: Gmail, Google Calendar, Google Drive (including Google Docs, Sheets, and Forms), and Google Meet. Depending on the scopes you approve, this data may include: email message content (body text, subject lines, and attachments), sender and recipient information, and other email metadata; calendar events and calendar settings; the contents and metadata of your Drive files and documents; meeting spaces, conference details, and settings associated with Google Meet; and basic account information (your name, email address, and profile picture), used to identify which account you connected and to sign you in.

Gini uses this access solely to provide and improve user-facing features you invoke inside Gini: as you direct it, Gini reads, searches, creates, edits, organizes, sends, shares, and deletes content in these services on your behalf, for example summarizing an email thread, scheduling a meeting, or editing a document you describe. Gini accesses this data only in service of a task you gave it, whether a one-off request or a recurring task you configured, like watching your inbox. Access is granted scope by scope, and you can revoke it at any time from your Google Account settings.

6. With whom we share, transfer, or disclose Google user data

We do not sell Google user data, or any of your personal information, to anyone. Google user data is shared, transferred, or disclosed only in the following circumstances, and in each case only the minimum data needed:

• AI model providers. Gini generates its responses with large language models. When you give Gini a task that involves your Google data (say, summarizing an email or editing a document in Drive), the portions of that data needed for the task are included in the request sent to the AI model provider so it can produce Gini's response. That provider is Microsoft Azure (Azure OpenAI Service), a Microsoft product; no data goes to OpenAI's consumer API. It processes the data only to return the response, is prohibited from using it to train AI models, and retains it for a limited period, if at all, for abuse monitoring under its API terms. The current list of sub-processors is published in our Trust Center.
• Infrastructure service providers. Gini runs on infrastructure operated by a third-party hosting provider acting on our behalf. That provider stores and transmits data solely to host your environment, is bound by confidentiality and data-protection obligations, and is not permitted to use your data for any purpose of its own.
• Recipients you direct. When you instruct Gini to send data somewhere (share a Drive file with a teammate, email a document, post a summary to another app you connected), Gini transfers that data as your agent, at your explicit direction, to the destination you chose. If you set up a shared team environment, accounts and data you connect to it are usable by your team's members.
• Security and legal. We may disclose data where necessary for security purposes (for example, investigating abuse) or to comply with applicable law or valid legal process.
• Change of ownership. If Open Curiosity is involved in a merger, acquisition, or sale of assets, Google user data would be transferred only after obtaining your explicit prior consent.

And to be explicit about who does not receive your Google user data:

• No advertising platforms, ad networks, data brokers, or information resellers. Gini integrates with none of these.
• No Google user data in analytics. Where product usage analytics runs (see Section 3), an analytics service receives interaction signals only, never message bodies, file contents, calendar details, or any other Google user data. Website analytics on ginicomputer.com is separate and does not receive Google user data from a connected Google account.
• No AI training pipelines. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models, and our model provider is contractually prohibited from doing the same with data we send it.

7. Limited Use of Google user data

Gini's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve user-facing features that are prominent in Gini's interface.
• We do not transfer Google user data to third parties except as described in Section 6: to provide or improve those user-facing features with your consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
• We do not sell Google user data, and we do not use or transfer it for serving advertisements (including retargeting, personalized, or interest-based advertising), or to determine credit-worthiness or for lending purposes.
• We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.
• We do not allow humans to read your Google user data, except: with your affirmative agreement for specific messages or files; where necessary for security purposes (such as investigating abuse); to comply with applicable law; or where the data has been aggregated and anonymized for internal operations.

8. How Gini accesses and uses Slack data

If you add Gini to a Slack workspace, Gini connects through Slack's OAuth consent flow as a bot, and its access is limited to the permissions granted when it is installed:

• Messages. Depending on the permissions granted when Gini is installed, Gini can read direct messages sent to it, messages in public channels, and messages in channels it has been added to. It posts its replies back to the conversation and adds emoji reactions to acknowledge requests. Gini uses this content to understand and carry out your team's requests and to maintain conversation context.
• Workspace and member information. The workspace's ID and name, Gini's own bot user ID, and member identifiers: Slack user IDs and, depending on the permissions granted, member profile details such as names and email addresses. We use these to route each member's messages to the right Gini environment, to set up or link Gini accounts for workspace members, and to personalize what Gini knows about your team.
• Connection credentials. The bot token Slack issues when Gini is installed is kept under access controls and used only to operate the integration.

Messages you send Gini in Slack are instructions like any other: they are used to generate Gini's response (see Section 6), answered in the same conversation, and kept in your Gini environment's history like any other conversation with Gini. Workspace and member information used to operate the integration and set up accounts is kept under access controls. Installing Gini in a workspace sets up a team environment; each member who connects Gini gets their own connection, and direct messages with Gini are handled in that member's own environment.

Our commitments for Slack data are the same as above:

• We use Slack data only to provide and operate Gini. We do not sell it, and we do not use or transfer it for advertising.
• We affirm that Slack APIs and Slack data are not used to develop, improve, or train generalized AI or machine-learning models.
• No Slack message content, tokens, or user identifiers are sent to analytics.

Your use of Slack itself is subject to Slack's own terms and privacy policy. You can remove Gini from a workspace at any time through Slack's app management. When Gini is uninstalled or its token is revoked, the connection stops and we delete the stored bot token. Conversations already in your Gini environment remain yours, handled as described in Section 13.

9. How we share other information

Beyond Google user data (covered exclusively by Section 6), we share other personal information only with:

• Service providers. Vendors that host and operate the Service on our behalf, bound by contracts that limit their use of your data to providing services to us. These include our hosting and AI infrastructure on Microsoft Azure, model and run observability (which may receive prompts, tool arguments and results, and related run payloads needed to operate and debug the Service), and an analytics provider that receives the product interaction signals described in Section 3. The current list is in our Trust Center. Our Data Processing Addendum covers processing of Customer Content on your behalf.
• Website analytics and visitor-identification vendors. On our websites, and only in the consent states Section 10 describes, we use PostHog and Google Analytics for measurement and RB2B for business-visitor identification. These vendors process the website data described in Section 3 under their own terms and privacy policies, on our instructions or as independent controllers of the identifiers they maintain. See Section 10 for the cookies involved and our privacy choices page for your controls.
• Professional advisors. Lawyers, auditors, and insurers, where necessary in the course of the professional services they render to us.
• Authorities. Law enforcement or government authorities where we believe in good faith that disclosure is required by law or necessary to protect rights, safety, or the integrity of the Service.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be disclosed to the parties and advisors involved, subject to confidentiality protections and, for Google user data, only as described in Section 6.
• Parties you direct. Anyone you instruct Gini or us to share information with.

We do not sell personal information for money, and we do not share Google user data, Slack data, or Customer Content with advertising networks, data brokers, or information resellers. Website visitor identification (Section 10) may associate a site visit with business contact information so we can send our own outreach about Gini; that is separate from how we handle data inside your Gini environment, and you can switch it off.

10. Cookies and similar technologies

Signed-in parts of the Service use cookies that are necessary for it to function, for example to keep you signed in to your Gini environment. On our websites, everything beyond that runs under a consent system, and what happens depends on where you are:

• Where the law requires consent first (the EEA, UK and every other region outside the United States), no analytics or visitor-identification tool loads, and no optional cookie is set, until you accept. Declining is one click, and the site works identically either way.
• In the United States, measurement and visitor identification run by default, with notice, and you can switch them off at any time on our privacy choices page. Opting out also clears the identifier cookies these tools set on our domain.
• Global Privacy Control. We honor the GPC signal as a valid opt-out: a browser that sends it gets analytics and visitor identification switched off automatically, in every region, and we record having done so.

The tables below are generated from the same declaration our consent system enforces in the browser, and an automated check drives a real browser through these states against this site to verify the declaration holds, so this section cannot silently drift from what the site actually does. When you visit our websites, RB2B and its partners may use cookies and similar technologies to associate your visit with other information they or others hold about you, including a business email address, and we may then send our own communications to that address. You can opt out of that advertising through Retention.com's opt-out, opt out of collection under the GDPR through RB2B's opt-out, or simply switch visitor identification off on our privacy choices page, which stops it on this site regardless of the vendor-side settings. California law requires us to say how we respond to browser "Do Not Track" signals: there is no consistent industry standard for DNT, and the Service does not respond to it; we honor Global Privacy Control instead, as described above. Most browsers also let you remove or reject cookies; if you disable necessary cookies, signed-in parts of the Service may not work.

11. When data leaves your environment

Some features, most notably generating a response with an AI model, send task data outside your Gini environment to the parties described in Section 6 (for Google user data) and Section 9 (for other information).

12. How your data is stored and protected

Any Google user data Gini works with is kept in an environment dedicated to your account, and the Google OAuth credential needed to maintain your connection is stored in our access-controlled service datastore. No other customer can access your environment; if you set up a shared team environment, it is shared with your team's members. Data is encrypted in transit over public networks, operational access is restricted to what is needed to run the service, and human access to your Google user data is governed by the Limited Use rules in Section 7.

Gini keeps a record of the actions it takes, and you can configure it to require your explicit approval before it acts. No internet service is perfectly secure, but Gini is designed to keep as little of your data as possible in shared, centralized stores.

13. Data retention

• Your Gini environment. Your environment and its data persist while your account is active, so Gini can keep its context and continue your recurring tasks. When your account is closed or you make a verified deletion request, we delete your environment and its data, including stored Google OAuth tokens and any Google user data, from active systems, typically within 30 days; copies in backups are deleted as those backups expire.
• Service records. We retain account records and service logs only as long as needed to operate the Service, meet legal and accounting obligations, resolve disputes, and enforce agreements. Retention depends on the data, its purpose, and legal requirements; tax and accounting laws may require us to keep billing records for several years.

14. Your rights and choices

Access, correction, deletion, and portability

Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccuracies, request deletion, receive a machine-readable copy, or object to or restrict certain processing. You can exercise these rights by emailing privacy@ginicomputer.com. We may need to verify your identity before acting on a request. You may also use an authorized agent to submit a request on your behalf by having the agent write to the same address; we will ask the agent for written proof of their authority and may verify your identity directly with you. We will respond within the timeframe required by applicable law, and we will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying with "Privacy Appeal" in the subject line, and you may lodge a complaint with your state Attorney General or, outside the United States, your local data protection authority.

Opt-out rights

Depending on your state, you may also have the right to opt out of the sale of personal information, of its processing for targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects, and, in California, to limit the use of sensitive personal information. We do not sell personal information for money, and we do not use Google user data, Slack data, or Customer Content for targeted advertising or such profiling. Our websites do use visitor identification (RB2B), which may associate your visit with a business email for our own outreach; if your state's law treats that as a "sale" or "share," the opt-out is our privacy choices page, one click, no account needed, and a browser that sends Global Privacy Control is opted out automatically. You can additionally use the vendor-side opt-outs from Retention.com and RB2B, or email privacy@ginicomputer.com. We do not use or disclose sensitive personal information for purposes other than providing the Service you request and as applicable law permits, so there is nothing to limit.

Additional rights for EEA and UK users

If you are in the European Economic Area or the United Kingdom, you have the following rights under the GDPR or UK GDPR, which you can exercise by emailing privacy@ginicomputer.com: to access your personal data; to have inaccurate data rectified; to erasure; to restriction of processing; to data portability; to object to processing we base on legitimate interests; and to object at any time to direct marketing, in which case we will stop. Where processing is based on your consent, such as your Google account connection, marketing email, or non-essential website cookies (withdraw on our privacy choices page), you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with a supervisory authority: in the EEA, the authority of the member state where you live, work, or where the issue occurred; in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first, but you may contact them at any time.

Revoking Gini's access to your Google account

You can revoke Gini's access to a connected account at any time. For Google accounts, use your Google Account connections page, which immediately cuts off Gini's ability to access your Google data going forward. Revocation does not by itself delete data already in your Gini environment; you can delete that data through Gini, or request deletion of your environment as described in Section 13.

Automated decision-making

Gini acts on your instructions: it performs the tasks you delegate. We do not use your personal information to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the GDPR and UK GDPR. If that ever changes, we will update this policy and provide the information and choices the law requires.

Communications

If you receive marketing or product-update email from us, you can opt out at any time via the unsubscribe link or by contacting us. You will still receive essential service communications, such as security notices.

15. International data transfers

We are based in the United States, and Gini environments are operated on infrastructure in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where applicable law requires safeguards for such transfers, we rely on appropriate mechanisms such as standard contractual clauses.

16. Children's privacy

Gini is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us at privacy@ginicomputer.com and we will delete it.

17. Changes to this policy

We may update this policy as Gini evolves. When we do, we will revise the "Last updated" date above, and for material changes we will provide additional notice as required by law. If we change how Gini uses Google user data, we will update this policy and prompt you to consent before using your Google user data in a new way.

18. Contact us

Questions about this policy or your data? Email privacy@ginicomputer.com.