Privacy Policy

Gablura ("we," "our," or "us") is a productivity and collaboration SaaS platform. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our website or use the Gablura platform (collectively, the "Service").

We are committed to data minimisation — we collect only what we need, retain it only as long as necessary, and never sell your personal data to third parties.

We collect different types of information depending on how you interact with the Service. The table below summarises the categories of personal data we collect, why we collect it, and how long we keep it.

* Retention periods may be extended where required by law or for the resolution of disputes and enforcement of agreements.

We process your personal data only when we have a lawful basis to do so. The legal bases we rely on are:

• Contract performance — to create your account, provide the Service, and handle billing.
• Legitimate interests — to improve the platform, ensure security, and prevent fraud, provided these interests are not overridden by your rights.
• Consent — for optional features such as marketing emails and analytics cookies. You may withdraw consent at any time.
• Legal obligation — to comply with applicable laws, court orders, or regulatory requests.

Specifically, we use your data to:

• Provide, operate, and maintain the Gablura platform and its features.
• Process transactions and manage your subscription.
• Send transactional emails such as account verification, password resets, and billing receipts.
• Detect, investigate, and prevent fraudulent transactions and other illegal activities.
• Personalise and improve your experience through product analytics.
• Respond to your support requests, comments, and questions.
• Send product updates, changelogs, and marketing communications (only with your consent).
• Comply with legal obligations and resolve disputes.

We may share your data with the following categories of recipients:

• Service Providers — trusted vendors who help us operate the Service. These include Paddle (payment processing), Google (OAuth sign-in, the AI assistant powered by Google Gemini, and Google Analytics), Cloudinary (file storage), Vercel (frontend hosting), Render (backend hosting), Supabase (database), Upstash (Redis caching), and Sentry (error monitoring). These parties are bound by Data Processing Agreements (DPAs) and may only use data to perform services for us.
• Workspace Members — your name, avatar, and activity within a shared workspace are visible to other members of that workspace as necessary for collaboration.
• Legal Requirements — when disclosure is required by law, subpoena, or court order, or to protect the rights, property, or safety of Gablura, its users, or others.
• Business Transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Gablura is operated globally and your data may be transferred to, and processed in, countries other than your own. Where we transfer personal data outside the European Economic Area (EEA) or the UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions recognising the destination country's data protection standards.
• Binding Corporate Rules where applicable.

You may request details of the specific safeguards applied to your data transfers by contacting us at privacy@gablura.app.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction:

• All data is encrypted in transit using TLS 1.2+ and at rest using AES-256.
• Passwords are hashed using Argon2id — we never store plaintext passwords.
• Authentication uses RS256-signed JWTs with short-lived access tokens and secure refresh rotation.
• Access to production systems is restricted to authorised personnel on a need-to-know basis.
• We conduct regular security reviews and dependency audits.
• Security events are logged and monitored with automated alerting.

We use cookies and similar tracking technologies to operate the Service and understand how you use it. The types of cookies we use:

• Strictly Necessary — required for authentication sessions and core platform functionality. Cannot be disabled.
• Functional — remember your preferences (theme, language, sidebar state) to personalise your experience.
• Analytics — collect aggregated, anonymised usage data via Google Analytics to help us improve the product. You can opt out via your browser settings or Google's opt-out browser add-on.

You can manage non-essential cookies through your browser settings and block analytics tracking with Google's opt-out browser add-on. Blocking non-essential cookies will not affect your ability to use core features.

For full details, see our Cookie Policy.

Depending on your location, you may have the following rights regarding your personal data. We honour all of these requests within 30 days (or sooner where required by law):

To exercise any of these rights, email us at privacy@gablura.app with the subject line "Privacy Request". We may ask you to verify your identity before processing the request. We will not discriminate against you for exercising your rights.

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information without parental consent, please contact us immediately at privacy@gablura.app and we will take steps to delete such data promptly.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

1. 1We will update the "Last Updated" date at the top of this page.
2. 2We will notify you via email or an in-app banner at least 14 days before the change takes effect.
3. 3For significant changes to how we use your data, we will seek fresh consent where required.

We encourage you to review this policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests relating to this Privacy Policy or how we handle your data, please reach out to us:

You also have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national DPA within the EU) if you believe we have not handled your data lawfully.

Last Updated: August 11, 2026 · Version 1.1