App Privacy Policy

Gango is not yet incorporated. Until it is, the two founders, Adrian Siegwart and Patrik Schilter, are jointly responsible for your account data. For anything about this policy or your data, email us at hello@gango.ai.

The data you enter about your own clients (names, contacts, the work and invoices for them) is your business data. For that data you are the controller, and we process it on your behalf, only to provide the app.

• Account: your email address and name, used to sign you in with a one-time code.
• Business profile: what you add so your invoices are correct, such as your business name, address, VAT number, IBAN, logo, rates and currency.
• Your work data: clients and their contact details, projects, time entries and timers, invoices, and the emails you send with them.
• Chats with the assistant: the messages you type or dictate and the replies, plus any photos and files you attach (for example a PDF, Word or Excel timesheet to import).
• Voice: when you hold the mic button, your audio is streamed to a transcription service and turned into text. We keep the text, not the recording.
• Feedback: what you send us through the feedback screen, any screenshots you attach, and the app version, OS and device model.
• Usage analytics: a short list of events, such as "timer started" or "invoice sent", and app opens, tied to a random account id. No screen recording, no tap tracking, and never the content of your work.
• Crash reports: technical details when the app crashes or hits an error (device, OS, app version, the error itself), tied to the same account id and never your name or email.

The app asks for the microphone, camera and photo library only when you use a feature that needs them: dictating a message, taking a photo, or attaching an image. It does not read your contacts, location or calendar.

• To provide the app you signed up for: storing your data, running the assistant, creating and sending invoices (legal basis: performance of our contract with you).
• To keep the app secure and working, fix crashes and see which features are used (legal basis: our legitimate interest in a reliable, useful product).
• To answer your feedback and support requests.

We do not sell your data, show ads, or track you across other apps and websites.

When you ask the assistant something, your message, the relevant parts of your data (for example the client and project you mention) and any attached file are sent to Google's Gemini models so it can answer and act. We use Google's paid business services, under which Google does not use your prompts or data to train its models. The assistant can make mistakes, so you see and confirm what it creates before an invoice goes out.

We use the following providers. Each one only receives what it needs to do its job and may not use your data for its own purposes.

• Clerk handles sign-in and stores your account.
• Convex hosts our backend and database in the EU, including your files.
• Google Cloud (Vertex AI and Gemini API) runs the AI assistant, reads attached files, and can transcribe voice.
• Soniox transcribes voice input in real time.
• Resend delivers the invoice emails you send to your clients and tells us whether they arrived.
• PostHog processes usage analytics, hosted in the EU.
• Sentry processes crash and error reports, hosted in the EU.
• Expo delivers app updates to your device.
• Apple and Google distribute the app through their stores and TestFlight, under their own privacy policies.

Some of these providers are based in the US or may process data there. Where data leaves Switzerland or the EU/EEA, we rely on the Swiss-US and EU-US Data Privacy Framework or Standard Contractual Clauses.

We keep your data for as long as you have an account. When you delete your account, we delete your account and business data from our systems within 30 days, including the analytics tied to your account. Crash reports are deleted automatically after 90 days at most. If you need your invoices for your own bookkeeping, export them before you delete your account: keeping business records for the legally required period is your responsibility.

Under the GDPR and the Swiss FADP, you have the right to:

• Access the data we hold about you, and correct or delete it.
• Get a copy of your data in a portable format.
• Object to processing based on our legitimate interest.
• Ask us to delete your account and all its data at any time, by emailing us at hello@gango.ai.
• Lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority where you live.

Data travels encrypted between the app and our servers. Your sign-in is kept in the device's secure storage, and keys for the AI and transcription services never reach your phone in reusable form.

Gango is a business tool and is not meant for anyone under 16.

We update this policy when the app changes how it handles data, and change the date at the top. For significant changes we tell you in the app or by email.