Privacy Policy

1. Information we collect

We collect only what we need to provide the Service:

Information you provide

• Account details — your name and email address when you register or sign in.
• Content you create — prompts, chats, documents, workflows, video projects, knowledge-base files, and other content you upload or generate inside the Service.
• Billing information — if you subscribe to a paid plan, payment is handled by our payment processor; we receive subscription status and invoices, not your full card number.

Information collected automatically

• Usage and device data — log records such as IP address, browser type, pages visited, and timestamps, used to operate, secure, and improve the Service.
• Cookies — a session cookie to keep you signed in and remember preferences. We do not use third-party advertising cookies.
• Approximate location (from your IP address) — your country, and sometimes your city, derived from your connecting IP address. We use this to default your language, currency, tax region, and any local features (e.g. weather, nearby places) that our AI assistant needs to answer “where am I?”-style questions. Country-from-IP is public at the network edge and is not linked to your identity in any AI prompt. You can override the country we detect at any time on your profile page.
• Precise location (GPS) — only if you opt in — if you enable “Share precise location with AI” in Settings, your browser will ask for permission before we ever read the GPS/Wi-Fi position. When granted, the position is attached to the AI chat request you send next (so the assistant can answer things like “nearest merchant” or “weather here”), and is stored only for the length of that request. You can revoke the permission at any time in your browser’s site settings or by turning the toggle off; a record of when you opted in and out is kept for our own compliance log.

Information from connected accounts

• Google account — if you choose to connect Google, we receive the data described in Section 3. Connecting Google is optional and only happens when you click “Connect”.

2. How we use information

• To provide, maintain, and operate the Service and its features.
• To authenticate you and keep your account secure.
• To send transactional and account messages you request or that are needed to run the Service.
• To respond to support requests.
• To detect, prevent, and address abuse, fraud, and security incidents.
• To comply with legal obligations.

3. Google user data

When you connect your Google account to GME AI, Google asks for your explicit consent on a Google-hosted screen before any access is granted. We request the minimum scopes needed:

What we do — and do not — do with this access

• The gmail.send scope cannot read, search, delete, or modify your emails. It can only send messages you initiate through GME AI. We never request read access to your inbox.
• We send a message only when you trigger it (you compose or approve it in the Service). We do not send email autonomously without your action.
• We store the content of messages you send through the Service only as needed to deliver them and to show you your own sending history.
• No humans read your Google data, except: with your explicit consent; where needed for security or to investigate abuse or a support request you raised; or where required by law.
• We request no restricted Google scopes. GME AI does not request full mailbox access (mail.google.com), Gmail read access (gmail.readonly), or full Drive access (drive). Every scope listed above is limited to a specific action you take in the Service.

AI processing of Google user data

Some features of the Service let you direct content into an AI model — for example asking an AI agent to summarise spreadsheet rows you imported, or drafting an email an assistant will send from your connected account. When Google user data is processed this way:

• No AI training. Google user data (raw, aggregated, anonymised, or derived) is never used by us to create, train, improve, or fine-tune any AI/ML model — neither ours nor anyone else’s — in line with the Limited Use requirements above.
• Third-party AI providers as processors. Google user data may be sent only to providers on a fixed allow-list, each under paid commercial API terms that prohibit the provider from training on customer content: OpenAI, Anthropic, Google (Gemini API), xAI, Mistral and Groq — together with models we host ourselves. Data is sent only to fulfil the specific request you made.
• Enforced in code, not only by policy. Once a conversation has read data from a Google API it is flagged for the rest of its life, and model routing is then restricted to the allow-list above. Every other provider we offer — including free tiers, and any newly added vendor that has not been assessed — is blocked from receiving Google user data by default.
• Self-hosted models. Certain AI features (for example speech-to-text transcription) run on models hosted entirely on our own servers. Data processed by these self-hosted models is handled locally and is never transmitted to the model’s original provider for training or any other purpose.

Revoking Google access

You can disconnect Google at any time inside the Service (Integrations → Disconnect), or revoke access directly from your Google Account at myaccount.google.com/permissions. Revoking immediately stops all further access and invalidates the stored tokens.

4. How we share information

We share personal information only in these limited cases:

• Service providers (subprocessors) — vetted vendors who host our infrastructure, process payments, or deliver email on our behalf, bound by contract to protect your data and use it only to provide their service to us.
• Legal and safety — when required by law, regulation, legal process, or to protect the rights, property, or safety of GME AI, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice to you and continued protection under this policy.

We never sell your personal information or your Google user data.

5. Data storage & security

• Connections are encrypted in transit using TLS/HTTPS.
• OAuth tokens and other sensitive secrets are encrypted at rest (AES-256-GCM) and isolated per account; they are never exposed in logs or to other users.
• Access to production systems is restricted, authenticated, and logged.
• While no system is perfectly secure, we work to protect your information and to promptly address any issues. You can report a security concern to security@gme-ai.com.

6. Data retention & deletion

• We keep your account data while your account is active and as needed to provide the Service.
• You may delete your content within the app at any time.
• On account closure, or on a verified deletion request, we delete or de-identify your personal data and revoke connected-account tokens, except where we must retain limited records to meet legal, accounting, or security obligations.
• To request deletion of your account or specific data, email hello@gme-ai.com.

7. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact us at hello@gme-ai.com; we respond within a reasonable period and in line with applicable law.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

International transfers

We are based in Singapore and may process data in other countries. Where data is transferred across borders, we apply appropriate safeguards consistent with applicable law.

Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with a new “Last updated” date and, where appropriate, notified to you in the Service.

8. Contact us