Privacy policy

This policy explains what Gathen does with personal information when you use www.trygathen.com or the workspace. Read it with the Terms of use.

Gathen is the controller for the account and workspace information described here. The service is published at www.trygathen.com.

It covers the owner of a Gathen account, and anyone who visits the public site. The workspace is an owner account. It is not a service for children. You must be at least 18 to create an account.

Account. When you sign in, Clerk processes your name, email address, sign-in identifiers, and session. We receive the account identity needed to open your workspace.

Workspace. You and the agents you authorise create the record of work. That includes projects, tasks, schedules, conversations, knowledge documents and folders, roles and instructions, imports, and the activity record of actions. Project, task, conversation, knowledge, schedule, and agent-instruction text is encrypted at rest.

Connections. You can mint a bearer token for an agent, or connect an agent with OAuth. We store a hash of a bearer token and a short hint of its last characters, not the token itself. The token is shown once, when you create it. You can revoke a token, which blocks it immediately. OAuth connections store the client details needed to recognise that agent and to apply the permissions and project access you set.

Imports. If you or an agent ingest a file, a URL, or an agent payload, we store that material as a context document.

Technical data. Hosting and application logs can include an IP address, browser, time, and the URL requested. We use that to run and protect the service. The public site does not use advertising, and it does not load a separate analytics product.

A preference cookie. The dashboard stores a cookie named sidebar_state so it can remember whether the sidebar is open.

We use this information to:

• provide the workspace, including projects, tasks, conversations, knowledge, and schedules
• authenticate you and the agents you connect, and enforce the permissions you set
• keep an activity record of actions in the workspace
• index knowledge documents so search can find a passage
• protect the service, investigate abuse, and fix faults
• reply when you contact us

Under UK GDPR, we rely on these lawful bases:

• Contract — to provide the workspace you sign in to use
• Legitimate interests — to keep the service secure, to keep an activity record, and to understand faults. We do not use your workspace to advertise to you
• Legal obligation — where a law requires us to keep or disclose information

We do not sell personal information. We do not use your workspace content to train a Gathen model.

When a knowledge document is indexed, passages from it are sent to OpenAI. OpenAI returns an embedding, which is a numeric vector, and a short label of a few words. We store the vector and the label so search can work. The passage is sent for that purpose only.

OpenAI processes those passages under its own API terms. That processing can take place outside the United Kingdom.

If you connect Instinct, ChatGPT, Claude, Gemini, or a custom agent, that agent can read and write only where you have allowed it. Information the agent requests is sent to that agent so it can do the work.

Those providers are services you choose. Their privacy terms cover what they do with information on their own side. Approving a role does not widen an agent’s access. Access stays within both the permissions you set and the scopes on that connection.

We use these providers to run Gathen:

• Clerk — sign-in, sessions, and OAuth for connected agents
• Supabase — the database that stores the workspace
• Vercel — hosting for the site and the application
• OpenAI — embeddings and short labels for knowledge search

They process information for those purposes. They may do so in the United Kingdom, the United States, or another country where they operate. Where personal information leaves the UK, we use a provider that offers a lawful transfer mechanism, such as the UK International Data Transfer Addendum or an adequacy regulation.

We use cookies that the service needs in order to work:

• Clerk session cookies — keep you signed in. Clerk sets how long they last.
• sidebar_state — remembers whether the dashboard sidebar is open. It lasts 7 days.

We do not set advertising cookies, and we do not load optional tracking cookies.

We keep workspace information while the account is open, because it is the record of the work. Activity records stay with that record so actions can be audited.

Hosting logs are kept for as long as the host retains them for security and operation.

If you ask us to close the account, we delete or irreversibly anonymise personal information we no longer need for security, for a dispute, or for a legal obligation. Encrypted workspace content is removed with the account once it is no longer needed for those reasons.

Workspace text is encrypted at rest. Private data is available to the signed-in owner, and to an agent only inside the permissions and scopes you set. Bearer tokens are stored as hashes. No method of storage or transmission is completely secure.

If UK GDPR applies, you can ask us to:

• tell you what personal information we hold about you
• correct it
• delete it
• restrict how we use it
• provide a copy in a portable form
• consider an objection to processing that is based on legitimate interests

You can complain to the Information Commissioner’s Office at ico.org.uk. If you live elsewhere, you can complain to your local data protection authority.

To make a request, email privacy@trygathen.com from the email address on your account. We may need to confirm that the request is yours before we act.

We may update this policy. The date at the top of this page will change, and the new policy applies from that date.

Questions about this policy, or a request about your information: privacy@trygathen.com.