GATE Privacy Policy

This policy explains what GATE does with your data, why we do it, and what you can do about it. We wrote it in plain English. If anything here is unclear, email us and we will rewrite it.

1. Who we are

GATE is operated by Gate Intelligence AB, a Swedish limited company.

• Org.nr: 559592-1395
• Postal address: Ankargränd 2, 111 29 Stockholm, Sweden
• Email for privacy questions: legal@gate.software

Gate Intelligence AB is the data controller for your account, billing and usage data, and for the processing this policy says GATE does for its own purposes. For the content an organization puts into or connects to GATE (chats, files, memory, connected mailboxes and other accounts), that organization is the controller and GATE processes it on its behalf under our Data Processing Agreement.

2. What we collect

We try to collect only what we need to run the service.

Account data. Your name, email, organization, billing address, VAT number if you give one, and language preference. You sign in with an emailed link, a passkey, or your Google or Microsoft account. GATE does not use passwords.

Chat content. The messages you send to your bots, the files you upload, the responses the bots send back, and the tool calls those bots make. Deleting a chat removes it from your view, and its messages are erased for good 60 days later. To have them erased sooner, email us.

Content from your connected accounts. When a bot works with your Gmail, Google Calendar, Drive or another connected service, it reads what the task needs at that moment. We do not copy your whole mailbox, calendar or drive into our database. What the bot reads becomes part of the chat record: the chat keeps the first 2 KB of each result, and the bot’s working transcript on our servers keeps all of it. A few integrations keep more:

• WhatsApp. When you link a WhatsApp number, its messages, with their photos and files, are stored in our database. A number or a chat you set to keep nothing is delivered to its bot and then deleted.
• Calendars. A calendar you connect for scheduling is copied every 15 minutes: the times and titles of your events from the past 7 days and the next 60.
• Slack. Messages in the Slack channels your bot is in, and the files posted there, are stored.
• Downloads. A file a bot downloads from your mail, Drive or OneDrive is saved in its workspace.

Your bots’ workspace and memory. Each bot has a workspace folder on our servers and a memory in our database. Anything you ask a bot to save stays until you ask it to remove it. Bots also save notes on their own, and copies of chat text go into memory, so they can recall past work; notes are indexed for search, some as vector embeddings. A memory entry stays when the chat it came from is deleted. Deleting a bot removes its workspace folder.

Billing data. What you bought, when, the amount, the VAT line, and the Stripe transaction ID. We do not store full card numbers. Stripe holds those.

Logs. IP address, user agent, request timestamps, and error traces. We use these to debug, to detect abuse, and to keep the service running.

Integration credentials. For Google, Microsoft and most other connected services, the access token is held by our integration provider, Composio, and we store only a reference to the connection. For Slack, GitHub, Meta Ads and WhatsApp, and for API keys you give us, we store the credential ourselves, encrypted. The Claude and Codex sign-ins your bots run on are stored as files on our servers, readable only by the bot’s own system account and our server administrators.

Voice. If you use voice features, the text is sent to the voice provider listed in section 4 to make the audio. The audio of a reply you have read aloud is kept with that message, and voice files you create are saved in your organization’s files.

3. Why we collect it (legal bases under GDPR)

4. Where your data lives

GATE runs on Hetzner in Nuremberg, Germany. Backups are stored with Hetzner in Falkenstein, Germany, and a few support servers (video meetings, DNS, restore tests) run in Helsinki, Finland. All of it is inside the EU.

The product also calls AI models and other services, most of them outside the EU:

• Anthropic (US): Claude, which serves nearly all chat and every code session, on the Claude account your organization connects or on Claude accounts GATE owns.
• OpenAI (US): Codex models when someone in your organization picks an OpenAI model, and images, video or voice when those run on OpenAI.
• z.ai (China): a fallback for chat when Claude is unavailable, only if your organization turns on providers in China.
• Moonshot (China): Kimi models, only if your organization turns on both providers in China and providers that may train on your data.
• Google (US): Gemini, which transcribes voice notes and meetings, runs live speech in GATE Meet, and makes images and video when you ask for them.
• TypeSafe (US): checks the quality of bot replies. It receives each reply and the message it answers.
• Higgsfield (US): video generation, only if your organization turns on providers that may train on your data.
• ElevenLabs (US): voice, only if you use it: text-to-speech, speech-to-text, music and sound effects.
• Decodo (Lithuania): a proxy for the bots’ web browser, only if your organization picks it.
• Stripe (Ireland for EU customers, US parent): payments.
• Cloudflare (US and global edge): DNS, CDN, WAF.
• Postmark (US): transactional email.
• Composio (US): holds the tokens for Google, Microsoft and most other integrations (see section 2).

Two switches under Settings > Organizations decide whether your data may reach providers in China and providers that may train on your data. Both are off by default, and with them off GATE never uses those providers, not even as a fallback.

If you add your own key for another model provider, your data goes to that provider for your organization only.

Keeping all data inside the EU. The setup above sends model traffic to the US, and to China only if your organization turns that on. If you need all processing to stay inside the EU/EES, we scope a local EU package with you, with AI, email, data and hosting on EU-based providers. Nothing changes for your organization until that is agreed and set up.

5. How we move data across borders

For transfers to subprocessors outside the EU we use the European Commission’s Standard Contractual Clauses (SCCs, 2021/914) plus, where the subprocessor offers them, additional safeguards like encryption in transit and at rest. The exceptions are z.ai and Moonshot (Kimi), which offer no transfer mechanism, and Higgsfield, which offers a data processing agreement and Standard Contractual Clauses only under an enterprise agreement that GATE does not have yet. They are used only when your organization’s owner turns them on. The full list of subprocessors and their locations is at gate.software/legal/subprocessors.

6. How long we keep it

• Active account data: for as long as your account exists.
• Backups: every backup rolls off within 7 days, so data we delete leaves our backups within 7 days.
• Billing records (invoices, tax data): 7 years from the end of the financial year, as required by Swedish Bokföringslagen.
• Logs: as long as we need them for security, debugging and abuse handling.
• Abuse and fraud investigation records: up to 12 months after the case is closed.

7. Your rights

Under GDPR you can:

• Access what we hold about you.
• Correct anything that is wrong.
• Delete your account and the data tied to it (subject to the legal retention windows above).
• Get a copy of your data in a portable format. We export it for you on request.
• Object to processing based on legitimate interest.
• Restrict processing while a dispute is open.
• Withdraw consent for anything we asked consent for, at any time.

You can also see what your bots did: every tool call shows in the chat, and your organization’s owner can open an access log.

Email legal@gate.software to use any of these rights. We respond within 30 days.

Deleting your account. You can delete it yourself in GATE under Settings > Account, or email legal@gate.software and we do it for you. It removes your account, your sign-ins and your seat in every organization at once, and it cannot be undone. An organization you are the only member of is deleted with it, together with its bots and their workspace files; one with a paid plan or domain must have that canceled in Billing first. Your memory notes leave search at once and are erased within 7 days, and every file you uploaded to Resources is deleted. Every account you connected is revoked at its provider, the credentials you stored in GATE’s vault are revoked, and every device signed in as you is signed out. Messages you wrote in chats of an organization that stays are kept there, shown as from a removed user; email us to have those erased as well. We confirm the deletion by email. After that we keep only the billing records we are legally required to keep (see retention above).

If you think we are not handling your data correctly, you can also complain to IMY, the Swedish data protection authority (Integritetsskyddsmyndigheten), at imy.se.

8. Subprocessors

A subprocessor is a company we use to deliver part of the service. The full list lives at gate.software/legal/subprocessors. On Stable we give 30 days notice before adding a new one; on Edge, the rapidly iterating track an organization runs on until it moves to Stable, notice comes on the day of the change, before it takes effect (DPA section 4.4).

9. Cookies

We use a small number of cookies, all listed in our Cookie Policy at gate.software/legal/cookies. Strictly necessary cookies (the login session and the sign-in steps) do not need consent. Analytics cookies, if we add them, will only run with your consent.

10. Children

GATE is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has signed up, email us and we will delete the account.

11. Security

We use TLS in transit, and we encrypt the API keys and integration tokens we store with AES-256-GCM. Google and Microsoft tokens are not stored on our servers at all; our integration provider holds them. The Claude and Codex sign-ins your bots run on are the exception described in section 2. We use scoped tokens for bots, rate limiting, and audit logs. No system is perfectly secure. If we have a personal data breach that meets the GDPR threshold, we notify IMY within 72 hours and notify affected users without undue delay.

11a. Who can see your data

The bots you run process your content to do the work you ask. Who else can read it depends on where your organization runs.

Edge. Edge is GATE’s rapidly iterating release track. Your organization runs on GATE’s servers alongside other organizations. Named Gate Intelligence staff, and the bots they run to operate GATE, can open your chats, your bots’ workspace files and their memory, and we use what we see to make GATE better. This cannot be switched off while your organization is on Edge. Other organizations’ bots cannot reach your content.

Stable. Your organization runs on a Stable server. No GATE staff member, and no bot we run, holds standing access to your chats, your bots’ workspace files or their memory: our tools on a Stable server reach its health, logs and services, not your content. We open your content only when you ask us to, case by case, and that access ends when the work does. Nothing we see on Stable is used to improve GATE. Other organizations’ bots cannot reach your content.

Dedicated infrastructure. Your organization runs on a server of its own. We hold no standing access to it. We look only when you ask us to for support, and that access ends when the work does.

Unless your organization has moved to Stable or you have an agreement with us for a dedicated server, it runs on Edge. You can ask to move to Stable at any time at legal@gate.software.

GATE is licensed for your own internal use. It is not a tool to resell or operate on behalf of your own customers without a separate agreement.

12. The GATE iPhone app

The app is GATE Intelligence (it shows as GATE on your home screen), published by Gate Intelligence AB. Everything above applies to it. This section adds what is specific to the phone.

Where the app connects. Only to GATE’s own servers, and to GATE’s meeting server for meeting audio and video. The app contains no analytics, advertising or tracking code and no crash reporter, and it declares no tracking to Apple. The two third-party components inside it, the meeting client and the drawing library that renders your bots’ avatars, run on the phone and send nothing of their own.

Signing in. You sign in with your GATE account. The sign-in tokens are held in the iOS Keychain on your phone. The name your phone gives itself, which you can change in iOS, is sent to GATE and shown as the signed-in device so you can recognise and revoke it.

Voice mode. Your speech is turned into text by Apple’s speech recognition on the phone. The audio never leaves it. Only the resulting text is sent to GATE, as a message you can see. Replies are spoken by Apple’s speech synthesis on the phone, and shortening a reply for speaking also runs on the phone.

Meetings. Your microphone, and your camera when you turn it on or point it at a device-move QR code, stream to GATE’s meeting server. What you type in a room’s chat is stored like any other chat content. When a bot is in the room, what is said is transcribed and written into that bot’s chat, where it is stored like any other message, and a summary of the meeting is written there when it ends. The transcription is done by Google Gemini, or by Whisper if your organization has pinned that (section 4). The “Notetaker on” badge is a notice that a notetaker is intended; it is the bot in the room that produces text.

Notifications. The app registers Apple push tokens with GATE, one each for alerts, background updates, meeting rings and lock-screen activities, together with Apple’s per-vendor identifier for your phone as the device id. Your notification preferences are stored in GATE so they follow you. Lock-screen activities show the progress of code sessions and builds and carry the same text as the notification.

What stays on the phone. Recent conversations, messages you wrote while offline, your meeting list, avatar images and your app preferences are cached on the phone. Conversation titles are added to Apple’s on-device Spotlight and Siri index, which stays on the phone. If you turn it on, Siri can send a message while the phone is locked.

Leaving. Deleting the app removes everything it stored on the phone. Signing out ends the app’s access and unregisters its push tokens. Neither deletes your GATE account or its content: section 7 covers that.

13. Changes to this policy

When we change this policy we update the “Last updated” date at the top and, for material changes, email account holders at least 30 days before the new version takes effect.

14. Contact

Gate Intelligence AB Ankargränd 2, 111 29 Stockholm, Sweden Email: legal@gate.software