Privacy Policy

This Privacy Policy describes how Green Union Capital Inc. ("we", "us", "our", or "Geb AI") collects, uses, and discloses personal information when you use the Geb AI service at gebai.ca, chat.gebai.ca, and related surfaces (collectively, the "Service").

1. Who we are

Geb AI is operated by Green Union Capital Inc., a corporation existing under the laws of Canada. For any privacy question, contact [email protected].

Privacy Officer. Our Privacy Officer is the Founder of Green Union Capital Inc., reachable at [email protected]. The Privacy Officer is accountable for our compliance with applicable privacy laws including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector(Law 25), Alberta's and British Columbia's PIPA, the EU and UK GDPR, and Egypt's Personal Data Protection Law 151/2020.

2. Information we collect

• Account information: email address, display name, authentication provider (Google or email/password), account creation date.
• Conversation content: messages you send to Geb, AI-generated responses, chat titles and folders you create.
• Usage and telemetry: API call metadata (timestamps, token counts, model identifiers), request IPs, device and browser information.
• Billing information: subscription status and plan. Payment card details are handled exclusively by our payment processor (Stripe) and are never stored on our servers.
• Uploaded files: two distinct kinds. (a) Chat attachments you add to a conversation for one-off AI analysis; these are subject to the temporary-retention limits described in our Data Handling Policy. (b) Key of Life documents you upload to your private memory so Geb can recall their contents later; these are not auto-purged — they are retained until you delete them, or purged within 30 days if you delete your account (see section 6).

3. How we use your information

We use your information to:

• Provide the Service, including routing your messages to our AI models and returning responses.
• Maintain your chat history so you can resume prior conversations.
• Process subscription payments and send billing receipts.
• Diagnose, debug, and improve the Service (including model quality and reliability).
• Detect fraud, abuse, and violations of our Terms of Service.
• Communicate service announcements, security notices, and product updates.
• Comply with legal obligations in jurisdictions where we operate.

4. Legal bases (for users in the EEA / UK)

We process personal data under one or more of these lawful bases: (a) performance of our contract with you; (b) our legitimate interests in operating and improving the Service; (c) your consent where required; and (d) legal compliance.

5. How we share your information

We do not sell your personal information. We share it only with the sub-processors listed below, and with regulators or law enforcement where required by valid legal process or to protect the rights, property, or safety of users or the public.

We update this list as sub-processors change and notify affected users where legally required.

5A. What we don't train on

Geb AI does not train the weights of its language models on your conversations, attachments, or personal data. Our proprietary model, Geb, is fine-tuned from an open-source foundation model only on (a) curated synthetic examples that teach it how to use tools — web search, prospecting, document generation, code execution, and similar — and (b) publicly licensed corpora. Your chats stay yours.

5A.1. How Geb gets smarter without training on you

Geb uses a private memory layer called Key of Life (KoL). KoL stores facts, preferences, and prior context that you explicitly share with Geb during conversations, encrypted at rest in our Canadian data centre (Edmonton, Alberta). You can view, edit, or wipe your KoL memory at any time from the in-app memory panel. KoL is per-account and never shared with other users.

5A.2. Service learning

Separately from model training, Geb improves its skills and knowledge— for example, learning better ways to use its tools, or correcting a factual gap — by analyzing patterns in conversations from consenting accounts. This never adds your personal data, your identity, or the content of your documents to the model's weights, and improvements derived this way never expose one user's data to another.

Whether your account participates in service learning depends on your plan:

• Free plan: included by default, as part of what makes the free plan free. You can opt out at any time in Settings → Privacy, with no loss of functionality.
• Paid plans: excluded by default. You can opt in at any time in Settings → Privacy.
• API / BYOK: requests you pay for with your own key may be cached and re-served to you for a short period to reduce cost and latency; they do not participate in service learning unless the account opts in.

Your current choice, and the version of the Terms of Service you accepted, are recorded on your account. See Terms of Service section 6A for the corresponding contractual terms.

5B. Browser-as-egress for Tier 2 deep research

If you opt in, the Service may use your browser as a transient egress point to fetch public web pages on your behalf during deep research. The fetched HTML is sent to the Geb backend solely for parsing and inclusion in the research result. We do not read, copy, or transmit your cookies, tokens, autofill data, browsing history, bookmarks, saved passwords, or content from other tabs. We log only the request URL, fetch timestamp, response size, and HTTP status code for diagnostics. See Terms of Service section 6B for full scope, and the warnings about restricted networks (corporate, school, government).

6. Data retention

7. How to exercise your rights

You may request access to or correction of your personal information at any time. Email [email protected] with the subject line "Privacy Request" and we will respond within 30 days.

If you are not satisfied with our response, you may file a complaint with the appropriate supervisory authority for your region:

• Canada (federal): Office of the Privacy Commissioner of Canada — priv.gc.ca
• Alberta: Office of the Information and Privacy Commissioner — oipc.ab.ca
• British Columbia: Office of the Information and Privacy Commissioner — oipc.bc.ca
• Quebec: Commission d'accès à l'information — cai.gouv.qc.ca
• Egypt: Personal Data Protection Center — المركز المصري لحماية البيانات الشخصية

Geb AI is not currently offered in the European Economic Area, the United Kingdom, or Switzerland.

8. International data transfers

We are a Canadian company. Personal information may be transferred to, stored in, and processed in Canada (where our team and Edmonton data centre are located), the Netherlands (where our backend is hosted on Google Cloud europe-west4), the United States (where some sub-processors operate), and Qatar (for the MENA-region SearXNG search egress proxy on Google Cloud me-central1). Where required, we rely on standard contractual clauses or equivalent safeguards.

Foreign government access. Personal information stored in the Netherlands, the United States, Egypt, Qatar, or other jurisdictions may be subject to lawful access requests by foreign governments under applicable local law (for example, U.S. CLOUD Act or FISA process for data held by U.S.-headquartered providers). We disclose information only when required by valid legal process and we publish a transparency report on request.

8A. Responsible AI

Geb AI is a generative AI service. Outputs are AI-generated and may be inaccurate, incomplete, or biased. They are not a substitute for professional advice in any field (legal, medical, financial, tax, safety-critical, or otherwise). Do not input information you would not share with a third party. We do not perform automated decision-making with legal or similarly significant effects on you; account-protective decisions (anti-abuse enforcement, payment-fraud blocking, rate-limit enforcement) may involve automated processing — you may request human review at [email protected]. Our generative AI practices are aligned with the Office of the Privacy Commissioner of Canada's Principles for responsible, trustworthy and privacy-protective generative AI technologies (December 2023).

9. Security

We employ administrative, technical, and physical safeguards designed to protect personal data. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9A. Biometric information

Geb AI does not perform facial recognition or biometric identification on uploaded images. Image content sent to AI models for analysis is processed only for the requested task and not retained beyond the conversation. We do not build, use, or share biometric profiles. Where Quebec Law 25 applies, image attachments depicting a person's face are treated as sensitive personal information and rely on your express consent given when you upload the file.

10. Minors and Child Mode

You must be at least 18 years of age to hold a Geb AI account. We do not knowingly create separate accounts for anyone under 18; if we discover an under-18 account it will be terminated and the associated personal information deleted. If you believe a minor has provided personal data to us, please contact our Privacy Officer at [email protected].

Children using Geb under adult supervision. If you allow a child or minor in your household to use Geb under your direct supervision, please enable Child Mode in your account settings before handing them the device. While Child Mode is active:

• Geb operates in a restricted educational mode (homework help, science, math, vocabulary, age-appropriate creative writing).
• Tools that are not age-appropriate (deep research, prospecting, payments, document/connector creation, image-of-real-persons) are unavailable.
• The child's session writes to a separate, parent-controlled memory namespace called KoLc (Key of Life — Child). You can view what your child has learned by asking Geb in your own session ("What did [child name] learn today?") and you can wipe KoLc at any time.
• We do not run analytics on Child Mode sessions and do not retain them beyond the standard conversation retention.

You remain the account holder and are responsible for all activity under your account, including activity by minors you have authorized.

11. Cookies and similar technologies

We use the following cookies and similar technologies:

• Strictly necessary (always loaded): session authentication, CSRF protection, language and locale preferences. These cannot be disabled — without them you cannot use the service.
• Analytics and product improvement (loaded only after you accept): PostHog (aggregated session-level usage patterns) and Microsoft Clarity (heatmaps and session recordings of how users interact with the interface). These help us understand how Geb is used so we can improve it.

Where required by law in your region, analytics cookies load only after you click "Accept" on our cookie banner. You may opt out at any time in your account settings under "Privacy → Analytics."

11A. New 2026 features and the data they process

As we add capabilities, this section describes the additional processing each one performs. These features are opt-in or tied to a specific action you take, and none of them change our core commitment: we do not train our language models on your conversations, attachments, or personal data (see section 5A).

• Quality verification (verifier shadow). To measure and improve answer quality, a sample of AI responses may be sent — together with the prompt that produced them — to a separate large language model acting as an automated judge (currently Google's Gemini, via the Google sub-processor already listed in section 5). The judge returns only a quality score and short rationale; its output is used for aggregate quality monitoring and is not shown to you or other users. This is a shadow evaluation: it runs alongside the response you already received and does not change it. Content sent to the judge is processed transiently for scoring and is not used to train any model.
• Connectors that write to your other accounts.When you connect a third-party app (for example a calendar, email, project tracker, or cloud-storage account) and ask Geb to perform an action there, Geb sends the data needed to complete that action to that third party using the access you authorized. Write actions (creating, editing, sending, or deleting items in your connected account) run only when you request them, and — for sensitive actions — only after you confirm. Credentials for connectors are stored encrypted; you can review and revoke any connection at any time from the integrations panel. The third-party provider's own privacy policy governs the data once it reaches them.
• Session memory and journal. For longer, multi-step tasks, Geb may keep a short-lived working memory and an activity journal for the current task or session — what it has done, what it learned, and what it plans next — so it can pick up where it left off. This session memory is per-account, is used only to continue your own task, is not shared with other users, and is deleted when the session ends or when you delete the associated conversation. It is never used to train a model.
• Conversation embeddings for memory recall.So Geb can recall relevant earlier context within your own account, we generate numeric vector representations ("embeddings") of your messages and store them in our database in Canada (Edmonton, Alberta). Embeddings are derived from your content and are used solely to retrieve your own relevant context; they are per-account, never shared across users, and never used to train a model. They are deleted when you delete the underlying conversation or your account.

Updated sub-processor note. Google (already listed in section 5) additionally acts as the automated quality-judge model described above. Where you enable a connector, the corresponding third-party provider acts as an independent controller of the data you direct Geb to send it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or a prominent notice in the Service. Continued use after changes take effect constitutes acceptance.

13. Contact

Green Union Capital Inc.
Privacy Officer (Founder) — [email protected]
General support — [email protected]