Ganavo Privacy Policy

Version 1.10 · Effective date: October 8, 2026 · Last updated: October 8, 2026

This policy explains what Ganavo ("we", "us") collects through the Ganavo app (the "App") and our website ganavo.app — including the desktop app at ganavo.app/dashboard and the business and document pages (together, the "Services") — how we use it, who we share it with, and your choices. Ganavo is operated by GANAVO LLC, a Massachusetts limited liability company, which is responsible for the personal information about our users described in this policy (see the Terms of Service). For the information businesses add about their own clients, we act on the business's behalf — see Section 1A. This policy also supports Apple's and Google's requirement that apps collecting data publish a privacy policy and disclose their data practices; we keep the App Store "privacy label" consistent with this document.

1. What we collect

• Account identifiers — an anonymous account ID; optionally, a backup email and password (the password is stored only in hashed form by our sign-in provider, Supabase); and a record of which version of the Terms you accepted and when.
• Business profile — your name, business name, contact info, logo, license or registration numbers, document preferences, and (optional) payment instructions you enter. If you publish a public business page in the Directory (Business/Pro plans), that page is public by design (Section 8).
• Business records — your clients (names, contact info, addresses, notes), quotes, contracts, and invoices. This is private to your account (protected by row-level security) and not shared with other users. The desktop app at ganavo.app/dashboard shows and updates the same account data as the App; it does not collect other information, apart from the browser storage described in Section 1B.
• Voice & transcripts — when you use voice features, we capture an audio recording of your dictation to transcribe it, and the resulting transcript and AI-drafted quote or invoice text. With a voice request the App also sends your device's local date and time zone, so dates in the draft come out right. See Section 3 for exactly what goes to which provider and Section 5 for retention.
• Confirmations you give — when you confirm a job post or acknowledge the example contract terms, we record that you did, when, and which version of the wording you saw. When you confirm you reviewed a quote, contract, or invoice before sending, printing, or sharing it, we record that you did, when, which action, which version of the wording you saw, and a fingerprint (a code computed from the document's content) of the exact version you reviewed.
• Client acceptance evidence — when your client responds to a document through a link, we record the response: for a document that asks for a signature (such as a contract), the client's typed name, drawn signature, and the date/time, and their agreement to sign electronically — which version of our e-sign disclosure they accepted (the texts are published at ganavo.app/legal/esign), the language it was shown in, a fingerprint of its exact text, and when they agreed; for a quote that doesn't ask for a signature, a one-tap acceptance and the date/time; and, if the client declines, the reason they give. With the response we also record a keyed hash of the client's network (IP) address, their device and browser type (user agent), the language of the page, their device's time zone, and a fingerprint of the document content the page showed them, kept as anti-fraud and e-signature evidence; and, if the client signs in person on your device, that fact and the host's name (taken from your business profile). We keep a copy of the document content the client accepted (including any contract terms, license numbers, and payment schedule). This evidence is associated with your document and shared with you (the service provider who sent it). If you sign a document yourself, we store your signature and the date/time too.
• Document activity log — for quotes and contracts, we keep an append-only activity log (each entry chained to the one before it) of what happens on the document link: - your client's actions: each time they open the link (at most one entry per network every 10 minutes), their agreement to the e-sign disclosure, any "I want paper instead" request, their signature, acceptance, or decline (whether they gave a reason; the reason itself stays on the document), and each time they open or download a PDF from the link. Depending on the action, an entry carries the time, a keyed hash of their network address, their device and browser type, the page language, their device's time zone, and a fingerprint of the content shown; - your actions: when you send or re-send the document, countersign it, archive it, start in-person signing, or mark it accepted or declined yourself, each with the time and your device or browser type as your app or browser reports it (for in-person signing, also the host's name, a fingerprint of the one-time code — never the code — and when it expires); - system entries: when the document is complete, and when a signed PDF is stored (its fingerprint and size).

The log never contains raw network addresses, the in-person code, your client's email or phone, or which app you used to send the link. You (the business) can read your documents' logs; your clients see what the certificate of completion shows. For invoice links, we record only when the link was first viewed and show that to you.

• Certificate of completion — when your client accepts or signs a quote or contract through the link, the document gets a certificate of completion. It shows the document's ID, title and language; your business name, owner name, license numbers, phone, and email; the client's typed name and signature; when the document was sent and first opened (with the device type and time zone) and how many times it was opened; how the client got access (the link, or in person on your device, with the host's name); the e-sign disclosure accepted (time, version, language, its fingerprint, and its full text); when the client signed or accepted, with the first 12 characters of the keyed network hash, the device type, and the time zone; your countersignature and any status you set; and the content and signed-PDF fingerprints, with the number of log entries and whether the log is intact. The certificate is visible to anyone who has the document link, and it is printed in the signed PDF (and may also be printed in PDFs of the signed document you make in the App), so anyone given those can see it. The data sent with the document page also includes the device and browser description recorded for the first view and the signature. A certificate never shows a full network hash or an older unkeyed one.
• Stored signed PDFs — after your client signs or accepts through the link (and again after you countersign), we make a PDF of the document with its certificate and store it in private file storage. It contains what the document and its certificate show, including the client's name and signature (Section 6 explains how long it is kept).
• Payment information — if you accept in-app card payments, your client's card details are entered on Stripe's hosted payment page and go directly to Stripe — we never receive or store card numbers. We store the payment status and amounts on your invoices (part of your business records) and your Stripe Connect account identifier and onboarding status. If a client appears to pay the same invoice twice, we email ourselves an internal alert that includes the payer's email address and the payment details, so the duplicate can be sorted out, and we keep a record of the alert (without the payer's email). If you subscribe to a paid plan on our website (ganavo.app), you also enter your card on Stripe's checkout page; we store your subscription status and Stripe customer and subscription identifiers, never your card number.
• Usage & abuse signals — counts of certain actions (e.g., AI usage, new client links per day) for plan limits and billing; rate-limit counters; and, for abuse prevention, coarse signals such as a hash of your network address.
• Website & QR-code statistics — when you use the sign-up pages on ganavo.app or scan a Ganavo QR code, we log basic usage events (for example, which step was viewed, language, referring page (with links to private documents removed), a creator or promo code if one was used, and your account ID if you are signed in; for QR scans, the device type and a hashed browser identifier). We collect these statistics ourselves — no third-party analytics service is involved — and they do not store IP addresses.
• Referral codes — if you sign up or subscribe through a creator's link or code, we record that code with your account and subscription so we can credit and pay the creator. Creators see totals (such as subscription counts and their earnings), not your identity or business records.
• Creator-program applicants — if you apply to our creator program on ganavo.app, we collect your name, email, phone number, how you'd like to be contacted (email, call, text, or WhatsApp), languages, social-media handles, and your message, your account ID if you are signed in, and a hash of your network address to stop spam. A copy of the application is emailed to our creator-program inbox.
• Android waitlist — if you joined the waitlist for the Android app on ganavo.app, we hold your email, language, any referral code, the page you signed up from, and a hash of your network address.
• Listing reports — if you report a listing in the App, we store the reason you give, the listing, and a hashed form of your account ID (not your name or email), and we email the report to our team inbox. Reports sent by email stay in our support inbox.
• Directory searches — Directory searches use place granularity (city/county), never GPS coordinates, and power the current search only.

Network addresses. Our sign-in system and hosting providers (Supabase, Cloudflare, and Vercel — Section 7) record network (IP) addresses in their standard sign-in, security, and server logs. Apart from those logs, where we keep a network address — for signatures, document activity logs, abuse prevention, or spam control — we store only a hash of it, never the address itself. Records created from October 2026 use a keyed hash (some older records use an unkeyed hash). We treat these hashes as personal information. When a client opens or downloads a PDF from a document link, our website server passes the client's network address to our server function only so it can be hashed for the activity log and used for rate limits. A certificate of completion shows only the first 12 characters of a keyed hash, never an older unkeyed one.

1A. Your clients' information

When a business adds information about its clients (names, contact details, addresses, job notes, voice recordings that mention them, signatures), we process it on that business's behalf and under its instructions, as its service provider (Terms Section 8A). The business decides what to collect and is responsible for any notice or consent the law requires. We never sell it, never market to these clients, and never contact them for our own purposes. Clients: to access, correct, or delete your information, contact the business that sent you the document. If you contact us, we may forward your request to them.

Two kinds of records we keep for our own purposes, not on the business's instructions: the security and fraud-prevention records described in Section 1 (for example, network-address hashes and duplicate-payment alerts), and the signed-record archive — after a signed or accepted document or the business's account is deleted, we keep a copy of the signed record and its evidence, including the document's activity log and any stored signed PDF, to establish or defend legal claims about the agreement (Section 6).

The activity log can't be changed. A document's activity log (Section 1) is append-only: its entries can't be corrected or deleted while the document exists. It is deleted with a document that was never signed or accepted, and copied into the signed-record archive when a signed or accepted document is deleted (Section 6).

If a business chooses "Email with Gmail" in the desktop app, its browser opens Gmail with the client's email address, a subject, and the document link filled in. That message is written and sent from the business's own Google account, under Google's terms.

1B. Cookies & browser storage

ganavo.app uses a small number of cookies and browser-storage items, all set by us and all needed for the site to work:

| Name / item | What it does | How long | |---|---|---| | ganavo_code (cookie) and a copy in browser storage | Remembers a creator's code when you arrive through a creator's link, so the creator gets credit if you subscribe | Used for 30 days | | ganavo_lang (cookie) and a copy in browser storage | Remembers the language you chose | Cookie: 1 year; browser copy: until you clear it | | Sign-in session (browser storage) | Keeps you signed in to the desktop app and your account pages | Until you sign out | | Sign-up progress (browser storage) | Lets you finish signing up: your email address (never your password) and your sign-up choices, such as plan and language | Used for up to 2 days |

• No advertising or analytics cookies. We don't use ad networks, third-party analytics services, tracking pixels, or other third-party trackers on ganavo.app or in the App. The basic usage statistics described in Section 1 are collected by us, on our own systems.
• Stripe's checkout and billing pages are run by Stripe and use Stripe's own cookies, under its privacy policy (Section 7).
• Global Privacy Control (GPC). If your browser sends a GPC signal, we honor it as a request to opt out of the sale or sharing of your personal information. We don't sell or share personal information, so there is nothing further to switch off.
• The App keeps some data on your phone, such as your sign-in, settings, your last Directory search area, and a temporary copy of a recording until your quote is saved (Sections 2 and 5).

2. Location

Location is used only when you take an action that needs it (e.g., "search near me" in the Directory), as a one-time read snapped to a city/county area on your device. We do not track your location in the background and do not store your location as a history on our servers; the App remembers your last search area on your phone so the next search starts there.

3. How AI processing works (named providers)

What each feature sends

• Voice quote. Your audio goes to ElevenLabs to turn speech into text. The transcript, your saved line items (names and prices), and your device's local date and time zone go to Anthropic (Claude) to draft the quote.
• Voice invoice. The same as a voice quote, plus a short list of up to 60 of your recent quotes — for each, the quote number, the client's name, the title, the total, the status and dates, the deposit setting, the amount already paid, and the total of any open invoices — so the AI can match the invoice to the right job.
• Translation. The document text and contract terms you ask to translate go to Anthropic.
• Directory. The text of a published listing (for example, your description and job posts, but not your business name) goes to Anthropic to translate it for visitors who read another language. When someone reports a listing, the reason they give and the listing's name and description go to Anthropic for a quick automated safety review that helps us prioritize the report.
• Backup provider. If ElevenLabs or Anthropic is unavailable or too slow, the same audio, transcript, or text is sent instead to OpenAI for the same task.

We don't send your password, card details, or bank details to AI providers.

Training

Ganavo does not use your content to train AI models. What each provider's own terms say about training is summarized below.

How each provider handles it

This is our summary of each provider's current published terms for business and API customers, checked on October 7–8, 2026. Their policies govern how they handle the data, and they may change — follow the links for the current version.

• ElevenLabs (speech to text). On October 8, 2026 we turned off the setting in our ElevenLabs account that lets ElevenLabs use what we send it to improve and train its AI models. ElevenLabs' terms say that choice applies only to content sent after ElevenLabs processes the request, does not undo any earlier use, and still allows the use ElevenLabs needs to provide the service, for trust and safety, and to comply with the law. Audio sent before that date may already have been used under ElevenLabs' terms. ElevenLabs may still store the audio and transcripts it receives: by default its API keeps request logs and transcripts (a zero-retention mode is offered to enterprise customers); its privacy policy says it keeps data it generates about a person's voice for up to 3 years after the last interaction, unless the law requires longer, and that personal data is transferred to the United States for storage. We can't see or control what ElevenLabs does on its side — its own policies govern. See ElevenLabs' privacy policy, terms, and zero-retention notes.
• Anthropic (drafting, translation, report review). Anthropic's commercial terms say it may not train its models on content sent through its API, and Anthropic says it automatically deletes API inputs and outputs within 30 days, except that content its systems flag for a usage-policy violation may be kept for up to 2 years (and safety classification scores for up to 7 years), and data may be kept longer where the law requires. See Anthropic's commercial terms, data retention, and privacy policy.
• OpenAI (backup only). OpenAI says it does not use data sent to its API to train its models unless the customer opts in to sharing it, and that it keeps API inputs and outputs in abuse-monitoring logs for up to 30 days. We set `store: false` on our requests, which tells OpenAI not to keep the response for later retrieval (by default, it would). OpenAI's published data controls don't state a separate retention period for audio sent to its transcription service, so it may keep that audio under its own policies. See OpenAI's API data controls and privacy policy.

We chose these providers for their business API terms, but we do not control and cannot guarantee how a third-party provider handles data.

4. How we use what we collect

To: provide and maintain the Services (create/send quotes, invoices, documents, acceptance links); transcribe and draft from your voice; translate documents; record client acceptance as e-sign evidence for you, with each document's activity log, certificate of completion, and signed PDF; keep signed records as evidence of agreements (Section 6); operate the public Directory you choose to participate in; run the creator program; enforce plan limits and prevent abuse/fraud; secure the Services; comply with law; and communicate with you about the Services (for example, account, welcome, and trial-reminder emails). We do not sell or share your personal information (as "sell" and "share" are used in state privacy laws), and we do not use it for targeted advertising.

5. How your voice audio is handled (retention)

Your voice recording is processed to create the transcript and is not stored by us as a saved recording — it is handled transiently in our server function and passed to the transcription provider (or, if needed, the backup provider in Section 3), then discarded on our side. Those providers may keep it under their own policies (Section 3). Until your quote is saved or you discard the recording, the App keeps a temporary copy on your device so you can retry if something fails. The transcript is used to draft your quote and is not saved by us; the drafted quote or invoice (items, prices, and notes) becomes part of your document and is retained as your business data if you save it (you can edit or delete it like any document content). We keep an aggregate count of voice usage (e.g., seconds) for plan limits and billing, not the audio.

No voiceprints. We use your audio only to turn speech into text. We do not create voiceprints or other voice profiles, and we do not identify who is speaking. Our requests don't ask our providers to identify speakers; what a provider does with audio it receives is governed by its own policy (Section 3).

6. Retention & deletion

• You can delete your account in the App. Deleting removes your account, profile, business records, and (if present) your public listing and its photos, subject to limited retention required by law, accounting, or security/anti-abuse, and the signed client records we keep as evidence of an agreement, including their activity logs and stored signed PDFs (see below). Deletion cannot be undone.
• Subscriptions. Deleting your account stops a subscription you bought on ganavo.app from renewing (the current period is not refunded — see Terms Section 13). It does not cancel an Apple App Store or Google Play subscription; cancel those in your store account settings.
• Records of your agreements with us. We keep a record of each time you accept our Terms of Service (which version, when, your account ID, and whether you had finished signing up) and of the confirmations you give in the App (for example, for a job post, the example contract terms, or that you reviewed a document before sending it). We keep these records after your account is deleted, as evidence of what you agreed to — with your email address replaced by a keyed one-way code (we don't keep the address itself, but we can match it if you or a court later give it to us) — and we delete them 7 years after your account is deleted.
• Client acceptance evidence (name, signature, consent, timestamps, network-address hash, device and browser details, time zone, and the accepted document content) and the document's activity log are retained with the associated document as a record of the agreement between you and your client. Archiving a document in the App deletes nothing. If a signed or accepted document, or your account, is deleted, we keep a copy of the signed record — including its whole activity log — in a restricted archive that only Ganavo can access, as evidence of the agreement for you, your client, and legal or dispute purposes; your client's link stops working. We delete archived signed records, with their activity logs, 7 years after the deletion that put them in the archive.
• Activity logs of other documents. If you delete a document that was never signed or accepted, its activity log is deleted with it.
• Stored signed PDFs (Section 1) are kept in private storage that only our server function can access, and a stored file is never overwritten. They are kept with the signed record: they are not deleted when the document or your account is deleted. A nightly job deletes a stored signed PDF once its signed record is gone: after the document has been deleted and the 7-year period for its archived signed record has ended. While the business keeps the document, its signed PDFs are kept too.
• Automatic cleanup. A nightly job deletes or trims data on a fixed schedule: - anti-abuse rate-limit counters after about 3 days; - internal background-job logs after 90 days; - website and QR-code statistics (Section 1) after 400 days; - records of payment events we receive from Stripe (kept so the same event is never processed twice) after 400 days; - for emails we send (for example, welcome and billing emails) and internal report notifications, the message body is erased 30 days after sending; the remaining delivery record (recipient, subject, and send time) is deleted after 400 days; emails that could not be delivered are deleted 90 days after we stop retrying; - creator-program applications after 2 years; - listing reports and other listing moderation records after 3 years (they are kept even if the listing or the account is deleted, with the listing's web address and owner account ID); - records of duplicate-payment alerts after 2 years; - records of your agreements with us (Terms acceptances and in-App confirmations), 7 years after your account is deleted (above); and - archived signed records, with their activity logs and stored signed PDFs, after 7 years (above).
• Our email inboxes. Emails in our team inboxes — support requests, listing reports, payment alerts, and creator applications — are kept until we delete them.
• Android waitlist. Waitlist entries are kept until we delete them.
• Inactive accounts. We do not currently delete inactive guest (anonymous) accounts automatically; their data stays until the account is deleted.
• Records that may outlast your account. Some records are kept for accounting, tax, legal, or security purposes after you delete your account, for no longer than the periods above where one applies: billing and creator-commission records for subscription purchases, the email delivery records described above, usage statistics until their cleanup window ends, the signed-record archive (with its activity logs), stored signed PDFs, and the records of your agreements with us and of the confirmations you give (Section 6). Our providers (for example, Stripe, Apple, Google, and RevenueCat) keep their own payment and subscription records under their own policies.
• We retain limited records as required for legal, tax, or security purposes.

7. Who we share with (processors)

We share data with service providers that help us run the Services. Each provider's own terms and privacy policy (linked) govern how it handles the data; for our AI providers, Section 3 summarizes what their terms allow. Those policies may change. Current providers:

• Supabase — hosting, database, sign-in, file storage (including the private storage of signed PDFs, Section 6), and our server functions; Supabase's network runs through Cloudflare, which carries traffic to and from it. Supabase privacy policy · Cloudflare privacy policy
• Vercel — hosting of ganavo.app (the public site, business pages, the client document pages, and the desktop app), and turning documents into PDFs on our website server there: when you save or share a PDF; when a client opens the PDF copy of a document from its link (made each time it is opened); and when the signed PDF is made after a client signs or accepts (made once for each signed version). The document — including your client's details and, where present, the signatures and the certificate of completion — is rendered on Vercel and is not stored there; signed PDFs are then stored in Supabase file storage (above). Vercel privacy policy
• Expo — delivers App updates; when the App starts, it checks Expo's servers for an update, which shares basic technical details such as your device's operating system. Expo privacy policy
• ElevenLabs — voice transcription (Section 3). ElevenLabs privacy policy
• Anthropic (Claude) — quote and invoice drafting, translation, and review of listing reports (Section 3). Anthropic privacy policy
• OpenAI — backup for transcription, drafting, and translation when our primary providers are unavailable (Section 3). OpenAI privacy policy
• Stripe — in-app card payments (Stripe Connect): you, the service provider, are the merchant of record; card details go directly to Stripe and Ganavo never holds funds. Stripe also processes payments for subscriptions bought on ganavo.app. Stripe privacy policy
• RevenueCat — subscription management (links your subscription status — App Store, Google Play, or website — to your account ID). RevenueCat privacy policy
• Resend — sending our emails (for example, email confirmations, password resets, welcome and trial-reminder emails, and our internal alerts). Resend privacy policy
• Google Web Risk — when you save a public business page, we may send the web addresses of the links on it (for example, your website and job-application links) to Google's Web Risk service to check them against Google's lists of unsafe sites; a link Google lists as unsafe can't be saved. Only the link addresses are sent. Google's own terms and policies govern what it does with them. Google Web Risk · Google privacy policy
• Apple / Google — app distribution and in-app subscription billing. Apple privacy policy · Google privacy policy

Gmail is not our provider: it is involved only when you choose "Email with Gmail" in the desktop app, and then it is your own email account (Section 1A).

Planned (named here before they ship): Twilio (SMS phone verification) and Google Web Risk (link safety). We update this list as features ship. We may also disclose information to comply with law or protect rights, users, and safety.

8. Public information (Directory) & your controls

If you publish a public business page, the information on it (business name, service area, the contact surfaces you choose to show, photos, job posts, languages, and any license or registration numbers you add — some categories require one) is public to anyone — that is the point of the feature. Display toggles let you choose what's shown; think before publishing your phone or email. Hiring posts are public bulletin-board content — applications happen off-platform, directly between applicants and your business. Your private business records are never made public.

9. Security

We protect data with row-level security (each account can access only its own records), server-side handling of sensitive keys (never shipped in the App), a curated/minimal data surface on public pages, hashed (not raw) network addresses in the records we create (Section 1; keyed hashes for new records), append-only activity logs whose entries are chained to each other, and private storage for signed PDFs. We never hold your funds. No system is perfectly secure; we describe our measures honestly and do not promise absolute security. If a security breach affects your personal information, we will notify you and the authorities as the law requires (including Massachusetts law).

10. Children

The Services are for adults (18+). We do not knowingly collect personal information from children. If you believe a minor has provided us data, contact us and we will address it.

11. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to opt out of certain processing. We honor in-App account deletion for everyone. To make other requests, see Section 11A.

11A. Your rights (U.S. states)

• How to ask. Email support@ganavo.app and tell us what you'd like (for example, a copy of your information, a correction, or deletion). If you have an account, write from the email on your account or include your account email.
• Verification. We confirm a request comes from you before acting on it — usually by replying to the email on your account, or by asking for details that match our records. We use the information you give us for verification only for that purpose.
• Authorized agents. Someone can make a request for you if they show us your signed permission. We may still ask you to confirm your identity with us directly, unless the law says otherwise.
• Timing. We answer within 45 days. If we need more time, where the law allows it, we'll tell you why within those 45 days and may take up to 45 more.
• Appeal. If we decline your request, you can appeal by replying with "Appeal" in the subject. We'll answer within the time your state's law sets (no later than 60 days). If you disagree with the outcome, you can contact your state attorney general.
• No discrimination. We won't treat you differently — in price, service, or access — for using your privacy rights.
• Clients of a business. If your information is in a business's account (for example, a quote a business sent you), send your request to that business; we will help it respond (Section 1A).

12. International & where data is processed

The Services are intended for users in the United States. Our database and server functions are hosted in the U.S. Some of our providers (Section 7) may process data in other countries under their own policies.

13. Contact & changes

• Privacy questions / requests: support@ganavo.app
• We may update this policy; we'll post the new version with an updated date and, for material changes, give notice in the App or on ganavo.app (and by email where available).

This policy is published in English. Translations may be provided for convenience; the English version controls.