Legal

Privacy Policy

Effective date: October 13, 2026

Ganymedus is provided by Lingua Intellegens (“Lingua Intellegens”, “we”, “us”), contact privacy@ganymedus.com. This policy explains what personal data Ganymedus handles, why, where it goes and what you can do about it.

1. Our two roles

• Controller for your account (name, email, sign-in methods, preferences), our website, billing and the security records we keep to protect the service.
• Processor for everything a customer puts into a workspace: people, work, KPIs, conversations, transcripts, files and data from connected services. Here the organization that owns the workspace is the controller and decides why the data is used; we process it on its behalf under our Data Processing Agreement. Questions about workspace data are best sent to that organization first.

2. What we process

• Account: name, email addresses, a hashed password or a Google sign-in, the workspaces you belong to and your settings.
• Workspace content: people and their responsibilities, strategic directions, work items and their results, messages and notes, end-of-day check-ins, time spent on work cards, availability and time off, KPI values, meeting transcripts and voice notes, uploaded files, and conversations with Ganymedus and AI team agents.
• Connected services, only when someone in the workspace connects them and only within the access they grant: Google Workspace (the Drive files a person chooses for Ganymedus and the files its agents make, Calendar events, Meet transcripts, sending the Gmail messages a person approves and, when an administrator allows it, the domain's audit logs and directory; Ganymedus never reads whole Drives or mailboxes), a mailbox a person connects for their own agents with an app password (searched only for what the agent's task needs, read only), Slack, Jira, Fathom, CRM and outreach tools.
• Email sent to Ganymedus: replies to Ganymedus emails, and messages a person sends, copies or forwards to their own or a team agent's Ganymedus address, with their attachments.
• Technical data: IP address, browser, timestamps, request logs and security events. When something fails, an error report (what failed and where in the code, the browser and the page address without its parameters) goes to Sentry; names, email addresses, message content and request details are removed first.

3. Why we use it

• To provide the service a workspace asked for: planning, delegation, reminders, verification of delivered work, KPI measurement, transcription, search and AI assistance (contract; for workspace data, the customer's instructions).
• To keep accounts and the service secure, prevent abuse and fix faults (legitimate interest).
• To see whether each workspace uses the service and to support it: the days each person opened Ganymedus, and counts of work and AI cost per workspace, never the content of work or conversations (legitimate interest).
• To send the service messages and notifications a workspace chose (contract).
• To meet legal obligations (legal obligation).

We do not sell personal data, we do not use it for advertising, and we do not use workspace content to train AI models.

4. AI processing

To answer requests, Ganymedus sends the content a feature needs to OpenAI, our AI provider, through OpenAI's business API. Under OpenAI's API terms this data is not used to train their models. Ganymedus asks OpenAI not to store requests or answers; OpenAI may keep them for up to 30 days only to detect abuse and then deletes them. AI output can be wrong and is shown as a proposal: changes to people's commitments, anything sent outside the company and payments always wait for a person's approval.

5. Work and people data

Ganymedus helps a company organize work, so it records facts about work: who was given what, when it was started and delivered, the time spent on work cards, end-of-day notes and KPI results. It does not make decisions with legal or similarly significant effects on people, does not score personal traits and does not recognize emotions. The employer that uses Ganymedus must tell its people how it uses these records; we give customers a notice template for this.

6. Google user data

Ganymedus's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features the user turned on, is shared with OpenAI only to produce those features' output, is not used for advertising, is not read by people except with the user's permission, for security or as required by law, and is not used to develop, improve or train generalized AI or machine-learning models.

7. Who receives data

Our processors (sub-processors for workspace data) are listed with their purpose and location on the Sub-processors page. Inside a workspace, people see data according to the workspace's own permissions. We disclose data to authorities only when the law requires it.

8. Where data is kept and transfers

Ganymedus runs on servers of Hetzner Online GmbH in Germany (EU), where the database, files and backups are stored. AI requests are processed by OpenAI in the United States, error reports go to Sentry in its EU data region in Germany, and Cloudflare's network delivers the website worldwide; these transfers rely on the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

9. How long we keep it

• Account data: until you delete your account. Deleting it removes your name, email and sign-in methods at once; what you did in workspaces stays with those teams, shown as “Former user”.
• Workspace data: until the workspace owner deletes the workspace or a person in it, or until our agreement ends. A deleted workspace closes at once and is removed for good after 30 days, so a mistake can be undone.
• Removed data leaves our backups as they are rotated, within five weeks (we keep seven daily and four weekly copies).
• Workspace exports: 7 days. Password-reset requests: 30 days. AI debugging records: 7 days. Sign-in sessions: 30 days. Error reports: up to 90 days. The days a person opened Ganymedus: 13 months.

10. Security

Connections are encrypted (TLS). Passwords are stored only as salted hashes, and keys for connected services are encrypted. Access inside workspaces follows roles and permissions, sign-in attempts are limited, ownership of an email address is confirmed before it unlocks invitations, and backups are tested by restoring them.

11. Your rights

You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent where processing relies on it. In the app: Settings → You → Download your account data or Delete your account; a workspace owner can export or delete the whole workspace in Settings → Workspace, and an owner or administrator can erase one person from a workspace. For anything else write to privacy@ganymedus.com. You may also complain to a data protection authority, in Lithuania the State Data Protection Inspectorate (vdai.lrv.lt).

12. Cookies

We use only cookies the service needs: a session cookie that keeps you signed in and a short-lived cookie that protects Google sign-in. We do not use analytics or advertising cookies.

13. Children

Ganymedus is a business service and is not meant for children.

14. Changes and contact

We will tell workspace owners about material changes before they take effect. Questions: privacy@ganymedus.com.