Ganavo Privacy Policy

Version 1.3 · Effective date: July 29, 2026 · Last updated: July 29, 2026

This policy explains what Ganavo ("we", "us", the "App") collects, how we use it, who we share it with, and your choices. Ganavo is operated by Ganavo LLC, a limited liability company organized under the laws of the Commonwealth of Massachusetts, United States (see the Terms of Service). This policy also supports Apple's and Google's requirement that apps collecting data publish a privacy policy and disclose their data practices; we keep the App Store "privacy label" consistent with this document.

1. What we collect

• Account identifiers — an anonymous account ID; optionally, a backup email; for certain features, a phone number (stored for verification).
• Business profile — your name, business name, contact info, logo, document preferences, and (optional) payment instructions you enter. If you publish a public business page in the Directory (Business/Pro plans), that page is public by design (Section 8).
• Business records — your clients (names, contact info, addresses, notes), quotes, and invoices. This is private to your account (protected by row-level security) and not shared with other users.
• Voice & transcripts — when you use voice features, we capture an audio recording of your dictation to transcribe it, and the resulting transcript and AI-drafted quote text. See Section 3 for how audio is processed and Section 5 for retention.
• Client acceptance evidence — when your client accepts a quote via a link, we record the client's typed name, drawn signature, and date/time, plus a hashed IP address and browser user-agent (kept as anti-fraud/e-sign evidence — we store a one-way hash of the IP, not the raw IP). This evidence is associated with your quote and shared with you (the service provider who sent it).
• Payment information — if you accept in-app card payments, your client's card details are entered on Stripe's hosted payment page and go directly to Stripe — we never receive or store card numbers. We store the payment status and amounts on your invoices (part of your business records) and your Stripe Connect account identifier and onboarding status.
• Usage & abuse signals — counts of certain actions (e.g., AI usage) for plan limits and billing; rate-limit counters; and, for abuse prevention, coarse signals such as a hashed IP or device identifier.
• Directory searches — Directory searches use place granularity (city/county), never GPS coordinates, and power the current search only.

2. Location

Location is used only when you take an action that needs it (e.g., "search near me" in the Directory), as a one-time read snapped to a city/county area. We do not track your location in the background and do not store your location as a history.

3. How AI processing works (named providers)

To provide voice and AI features, your content is processed by third-party AI providers:

• Transcription — your voice audio is sent to ElevenLabs to produce a text transcript.
• Quote structuring & translation — the transcript (and quote text you translate) is sent to Anthropic (Claude) to draft a structured quote or translate it.
• Directory content safety — if you publish listing content/photos, they may be sent to Anthropic for automated safety screening.

We send only what's needed for the feature. We do not use your business records or voice content to train our own models. Provider handling of data sent to them is governed by their own terms; we aim to select providers that offer business or API data protections, but we do not control and cannot guarantee how a third-party provider handles data.

4. How we use what we collect

To: provide and maintain the App (create/send quotes, invoices, documents, acceptance links); transcribe and draft from your voice; translate documents; record client acceptance as e-sign evidence for you; operate the public Directory you choose to participate in; enforce plan limits and prevent abuse/fraud; secure the service; comply with law; and communicate with you about the service. We do not sell your personal information.

5. How your voice audio is handled (retention)

Your voice recording is processed to create the transcript and is not stored by us as a saved recording — it is handled transiently in our server function and passed to the transcription provider, then discarded on our side. The transcript becomes part of your quote draft and is retained as your business data if you save the quote (you can edit or delete it like any quote content). We keep an aggregate count of voice usage (e.g., seconds) for plan limits and billing, not the audio.

6. Retention & deletion

• You can delete your account in the App. Deleting removes your profile, business records, and (if present) your public listing, subject to limited retention required by law, accounting, or security/anti-abuse.
• Client acceptance evidence (name, signature, timestamp, hashed IP) is retained with the associated quote as a record of the agreement between you and your client; it is deleted with the quote/account, subject to the same limited exceptions.
• We retain limited records as required for legal, tax, or security purposes.

7. Who we share with (processors)

We share data with service providers that help us run the App, under contracts limiting their use to providing services to us. Current processors:

• Supabase — hosting, database, authentication, storage.
• ElevenLabs — voice transcription.
• Anthropic (Claude) — quote structuring, translation, Directory content safety.
• Vercel — hosting of the public site, business pages, and client quote pages (ganavo.app).
• Apple / Google — app distribution and in-app subscription billing.
• RevenueCat — subscription management (links your App Store/Play subscription status to your account).
• Stripe — in-app card payments (Stripe Connect): you, the service provider, are the merchant of record; card details go directly to Stripe and Ganavo never holds funds.

Planned (named here before they ship): Twilio (SMS phone verification), Google Web Risk (link safety), an email provider (e.g., Resend/SES) for notifications, and a push-notification provider (Expo). We update this list as features ship. We may also disclose information to comply with law or protect rights, users, and safety.

8. Public information (Directory) & your controls

If you publish a public business page, the information on it (business name, service area, the contact surfaces you choose to show, photos, job posts, and languages) is public to anyone — that is the point of the feature. Display toggles let you choose what's shown; think before publishing your phone or email. Hiring posts are public bulletin-board content — applications happen off-platform, directly between applicants and your business. Your private business records are never made public.

9. Security

We protect data with row-level security (each account can access only its own records), server-side handling of sensitive keys (never shipped in the app), a curated/minimal data surface on public pages, and hashed (not raw) IP storage for acceptance evidence. We never hold your funds. No system is perfectly secure; we describe our measures honestly and do not promise absolute security.

10. Children

The App is for adults (18+). We do not knowingly collect personal information from children. If you believe a minor has provided us data, contact us and we will address it.

11. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to opt out of certain processing. We honor in-App account deletion for everyone. To make other requests, contact us (Section 13). We will verify and respond as required by applicable law.

12. International & where data is processed

The App is intended for users in the United States; data is processed in the U.S. by us and our providers.

13. Contact & changes

• Privacy questions / requests: support@ganavo.app
• We may update this policy; we'll post the new version with an updated date and, for material changes, notice in-App (and by email where available).

This policy is published in English. Translations may be provided for convenience; the English version controls.