Privacy Policy

Last updated: 11 October 2026

This policy explains what information Aaley collects, why, how we protect it and the choices you have. Aaley is an AI operator for business teams: it connects to the work accounts your company chooses, reads business information to answer questions and carry out tasks, and takes actions in those accounts only after a person reviews and approves each one.

In this policy, “Aaley”, “we” and “us” mean the Aaley service at aaley.ai and its founder, who operates it. The details of the operating company will be published on this page when the company is registered. You can contact us at gaber@aaley.ai.

1. Our role

When a company uses Aaley, that company decides which accounts to connect and what work Aaley does. For business information read from those accounts, we act on the company’s instructions as its service provider (a “processor” under data-protection law). For the account details we need to run the service, such as your sign-in identity, we act as a controller.

2. Information we collect

Account and workspace information

Your name, work email address and sign-in identity (provided through our sign-in provider), the company workspace you belong to, your role and department, and the invitations and permissions set by your company’s administrators.

Information from accounts you connect

Aaley reads only from accounts that you or your company’s administrator connect, and only what the connected account itself is allowed to see. Depending on what your company connects, this can include:

• Gmail (read-only): messages and threads that Aaley searches for or opens to complete a task you asked for, including sender, recipients, subject, date, text and attachment names.
• Google Calendar (read-only): the list of calendars your account can see, busy and free times, and events in a time range a task needs. Private events on calendars you do not own are reduced to busy times.
• Google Drive and Google Sheets: only the specific files or spreadsheets that you choose with Google’s file picker or that an administrator selects, and, where your company enables it, writing results to a spreadsheet you selected.
• Slack (connected through our integration provider Nango): your Slack identity, the channels you choose, and messages Aaley prepares for you to review before posting.
• Help desk tools such as Zendesk (connected through Nango), where offered: the tickets and comments a task needs to read.

We store the access credentials for these accounts in encrypted form so Aaley can act for you. We do not receive your Google or Slack password.

Information you give Aaley

Questions and instructions you type, procedures your team teaches Aaley, documents you upload, your reviews and approvals of proposed actions, and feedback.

Work records

Records of each task: what was asked, which information was used as evidence, which actions were proposed, who approved them, and whether the result was checked. These records let your team see and audit what Aaley did.

Technical information

Security and operational logs such as request times, error codes and service health. We design these logs to exclude message content, document content, search terms and access tokens.

3. How we use information

• To answer your questions and carry out the tasks you or your team request.
• To show you the evidence behind an answer and the record of what was done.
• To prepare actions for your review and, once approved, to perform and verify them.
• To remember procedures and corrections your team teaches Aaley, for use within your company’s own workspace only.
• To keep the service secure, prevent abuse, investigate incidents and fix problems.
• To provide support when you contact us, and to meet legal obligations.

We do not sell personal information. We do not use information from your connected accounts for advertising. We do not use it to train AI models that are shared outside your company’s workspace.

Where data-protection law requires a legal basis, we rely on performing our contract with your company, our legitimate interest in keeping the service secure and working, your consent where we ask for it (for example, when you connect an account or join the waitlist), and compliance with legal obligations.

4. Google user data

Aaley’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive through Gmail, Google Calendar, Google Drive and Google Sheets:

• We use it only to provide and improve the user-facing features you use in Aaley: answering your questions, carrying out the tasks you request, and showing their evidence.
• We transfer it to others only as needed to provide those features (for example, to our AI processing provider to produce an answer for your task), to comply with law, or as part of a merger or acquisition with notice to you.
• We do not use it to serve advertisements, including retargeting, personalised or interest-based advertising.
• We do not sell it, and we do not use it to determine creditworthiness or for lending.
• We do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models.
• People at Aaley do not read it unless you give us permission for a specific item (for example, in a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with law, or it has been aggregated and anonymised for internal operations.

Aaley asks Google only for read-only access to Gmail and Calendar. It cannot send email or change calendar events through those permissions. Drive access is limited to files you or your administrator pick. You can remove Aaley’s access at any time in Aaley or in your Google Account permissions.

5. Actions in your accounts

Aaley does not change anything in a connected account on its own. Before an action such as posting a message or updating a record, Aaley shows the exact action, its target and its content to a person with permission to approve it. The action happens only after that approval, and Aaley records who approved it and checks the result.

6. AI processing

Aaley uses large language models provided by OpenAI to understand requests, read the information a task needs, and draft answers and proposed actions. OpenAI processes this content for us as a service provider. We send it only the information a task needs, and we instruct OpenAI not to store responses for later retrieval. Under OpenAI’s business terms, data sent through its API is not used to train OpenAI’s models by default.

Content from emails, documents, tickets and websites is treated as information, not as instructions. It cannot change who Aaley works for, what it is allowed to do or who receives a message.

7. Who we share information with

We share information only with service providers that help us run Aaley, under contracts that limit their use of it, and with the services you connect.

We will update this list before we start using a new provider that processes your information.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different policy.

8. Storage and security

• Business data is stored in a PostgreSQL database. Each company’s data is kept separate by row-level security in the database, so one company’s requests cannot read another company’s records.
• Connection credentials are encrypted with industry-standard encryption (RSA-OAEP and AES-GCM) and can be opened only by the background service that performs the approved work, not by the website or the AI model.
• Connections to Aaley and to the services it uses are encrypted in transit.
• The database is encrypted at rest by our database provider.
• Access to production systems is limited to the founder and any personnel we authorise for operating the service, using accounts protected by strong authentication.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify you and the relevant authorities as the law requires.

9. How long we keep information

• Gmail and Calendar content read for a task is kept in that task’s private record only briefly. Its content is cleared about one day after it was read or after the task finishes or stops, whichever comes first, and as soon as the connection is disconnected or reconnected. A minimal record that a read happened (without its content) remains for audit.
• Connection credentials are deleted from Aaley when the connection is disconnected.
• Account, workspace and work records are kept while your company’s workspace is active, then deleted or anonymised within 30 days after the company closes its account, unless the law requires us to keep them longer.
• Backups are kept for up to 30 days and then overwritten.

10. Your choices and rights

• You can disconnect a Google, Slack or other account in Aaley at any time. For Google, you can also remove access in your Google Account permissions.
• Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to complain to a data-protection authority.
• If your company provides your Aaley account, we may need to refer some requests to your company, which controls that business data.

To make a request, email gaber@aaley.ai. We will respond within 30 days.

11. This website and the waitlist

This website (aaley.ai) does not use advertising or analytics cookies or third-party tracking scripts. If you join the early-access waitlist, we store your email address, the time you signed up and the version of the notice you saw. We use your email address only to contact you about early access. We do not send automated email from the waitlist. You can ask us to delete your address at any time by emailing gaber@aaley.ai.

The Aaley application uses essential cookies to keep you signed in. They are not used for advertising.

12. Children, international transfers and changes

Aaley is a business service and is not intended for anyone under 18. We do not knowingly collect information from children.

Our providers may process information outside your country. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We may update this policy. If a change is significant, we will tell you in Aaley or by email before it takes effect. The date at the top shows when it last changed.

13. Contact

Questions or requests about privacy: gaber@aaley.ai.