Privacy Policy

GiborAI ("we", "our", "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect information about you when you use our website and SaaS platform (the "Service").

This policy is compliant with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable data protection laws. If you are located in the EU/EEA, you have specific rights under GDPR outlined in this policy.

We collect the following categories of personal data:

Account & Identity Data: Full name, email address, company name, job title, phone number.

Usage Data: Pages visited, features used, session duration, IP address, browser type, device information, referring URLs.

Business Data: Data you input into our SaaS products (e.g., customer records, documents, analytics data). This data is processed on your behalf.

Payment Data: Billing address, payment method (we do not store full card numbers; payments are processed by PCI-DSS compliant third parties).

Communication Data: Messages sent to our support team, demo requests, and contact form submissions.

Cookies & Tracking: See our Cookie Policy section below.

Under GDPR, we process personal data only when we have a lawful basis to do so:

• Contractual Necessity: Processing required to provide the Service you subscribed to.
• Legitimate Interests: Analytics to improve our Service, fraud prevention, security.
• Legal Obligation: Compliance with applicable laws and regulations.
• Consent: Where you have provided explicit consent (e.g., marketing emails). You may withdraw consent at any time.

We use collected data for:

• Providing, operating, and maintaining the Service.
• Processing transactions and sending related communications.
• Sending administrative information (account updates, security alerts).
• Responding to inquiries and providing customer support.
• Analyzing usage patterns to improve and develop new features.
• Complying with legal obligations and enforcing our Terms.
• Sending marketing communications (only with your consent; you may opt out anytime).

We do not sell your personal data. We may share data with:

Service Providers: Cloud hosting, payment processors, analytics tools, email service providers — all bound by data processing agreements.

Platform Infrastructure: Our platform operates on infrastructure that adheres to GDPR standards. Data is stored in secure, compliant environments.

Legal Compliance: We may disclose data when required by law, court order, or governmental authority.

Business Transfers: In the event of a merger or acquisition, your data may be transferred as a business asset with appropriate notice.

All third-party processors are vetted to ensure GDPR compliance and have signed appropriate Data Processing Agreements (DPAs).

We retain personal data for as long as necessary to provide the Service and fulfill the purposes outlined in this policy:

• Active account data: Retained for the duration of your subscription plus 90 days.
• Financial records: Retained for 7 years as required by applicable tax and accounting laws.
• Support communications: Retained for 2 years after resolution.
• Marketing data: Retained until you unsubscribe or request deletion.

Upon account termination, you may request an export of your data within 30 days. After this period, we will delete or anonymize your data.

If you are in the EU/EEA, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("Right to be Forgotten").
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Restrict Processing (Art. 18): Request we limit how we use your data.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw any previously given consent at any time.

To exercise any right, contact us at privacy@giborai.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority).

We use cookies and similar tracking technologies to improve your experience. Types of cookies we use:

• Essential Cookies: Required for the Service to function. Cannot be disabled.
• Analytics Cookies: Help us understand how the Service is used (e.g., page visits, session length). Used only with consent.
• Preference Cookies: Remember your settings and preferences.
• Marketing Cookies: Used to deliver relevant advertisements (only with consent).

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to use the core Service.

GiborAI operates globally. If you are in the EU/EEA, your data may be processed in countries outside the EU/EEA. When this occurs, we ensure adequate protection through:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission.
• Adequacy decisions by the European Commission.
• Other appropriate safeguards as required by GDPR.

We will never transfer your data to a third country without appropriate safeguards in place.

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest (AES-256).
• Access controls and role-based permissions.
• Regular security audits and penetration testing.
• Employee data protection training.
• Incident response procedures with breach notification within 72 hours as required by GDPR.

No method of transmission or storage is 100% secure. We encourage you to use strong passwords and notify us immediately of any suspected unauthorized access.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us at privacy@giborai.com and we will take steps to delete such data.

We may update this Privacy Policy periodically. We will notify you of significant changes by email and/or a prominent notice on our website at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

For any privacy-related questions, requests, or concerns, please contact:

GiborAI Data Protection
Email: privacy@giborai.com
General: info@giborai.com

You have the right to lodge a complaint with your national Data Protection Authority (DPA) if you believe your rights have been violated.