# Privacy notice for the website gravel.chat and the "Gravel" service Last updated: October 19, 2026. This is a translation of the [German Datenschutzerklärung](datenschutz.de.md). If the two differ, the German version prevails. --- ## 1. Who is responsible? **Controller** under the General Data Protection Regulation (GDPR): Victor Gulchenko Emanuelstraße 27, 80796 München, Germany Email: victor.gulchenko@gmail.com More details: [Imprint](imprint.en.md) **Data protection officer:** we have not appointed one, as we are not required to (Art. 37 GDPR, § 38 BDSG). For data protection questions, write to victor.gulchenko@gmail.com. --- ## 2. In short - **What Gravel is.** Gravel is a personal assistant that speaks first. To do that, it reads the email and calendars you connect and the documents you send, and it writes to you on the channel you choose. - **European infrastructure.** We process your data only on infrastructure of European providers under EU law, mainly Scaleway and OVHcloud in France. The AI models run there. We use no US AI services. Only this public website, its visitor statistics and the waitlist sign-ups it collects run on Vercel (USA), see 3.1, 3.3 and 3.4. - **Two exceptions, both chosen by you:** 1. the email and calendar provider you connect (for example Google, Microsoft, Apple) 2. the messaging app you talk to Gravel on (for example WhatsApp or Telegram) Section 5 explains plainly what this means. - **No training.** We do not train AI models on your data, and neither do our providers. - **No advertising, no sale.** The website sets no cookies and loads nothing from third parties. - **You decide what Gravel may do on its own.** You choose an autonomy level for each kind of action. Anything that reaches other people or costs money asks first by default. "Pause" stops everything. - **Your rights work by message:** "export my data", "delete my account", "what do you know about me?", "forget that", "what did you look at today?" --- ## 3. Website ### 3.1 Delivery and server logs When you visit the website, your browser sends data that we process for technical reasons: - IP address - date and time - page requested - referrer - browser and operating system (user agent) - amount of data transferred and status code The website is hosted and delivered by **Vercel Inc.** (440 N Barranca Avenue #4133, Covina, CA 91723, USA) through its global network. Vercel processes the data above on our behalf under a data processing agreement. Vercel is certified under the EU-U.S. Data Privacy Framework, on which transfers to the USA are based (Art. 45 GDPR); the standard contractual clauses in Vercel's data processing agreement apply in addition. - **Purpose:** delivering the website, stability and security. - **Legal basis:** Art. 6(1)(f) GDPR. Our legitimate interest is running a secure, working website. - **Retention:** logs containing IP addresses are deleted after 7 days. ### 3.2 No cookies, no third parties, self-hosted fonts - The website sets **no cookies** and stores nothing on your device. - It loads **no third-party content**: no font services, no social plugins, no embedded videos, no maps. We serve our fonts ourselves. - That is why there is no cookie banner. ### 3.3 Visitor statistics To see how the website is used, we count page views with **Vercel Web Analytics**. It sets no cookies and stores nothing on your device, and its script is served from our own domain. For each page view, Vercel records: - the page and the time - the page you came from (referrer) - country, region and city, derived from your IP address - browser, operating system and device type Your IP address itself is not stored. To count a visit only once, Vercel forms a hash from the request, which is discarded after 24 hours. We only ever see totals, never individual visitors. - **Purpose:** understanding which pages are read and how people find the website, so we can improve it. - **Legal basis:** Art. 6(1)(f) GDPR. Our legitimate interest is improving the website with aggregated statistics. - **Processor:** Vercel Inc., as described in 3.1. - **Retention:** the hash is discarded after 24 hours; what remains are counts that cannot be traced back to you. ### 3.4 Waitlist If you join the waitlist, we store your email address, the time you signed up and the note shown under the form ("One email when your spot opens. Nothing else."). Nothing else: no IP address, no device data. To stop automated mass sign-ups, your IP address is held in memory for at most 10 minutes and never written down (Art. 6(1)(f) GDPR). - **Purpose:** telling you when your spot opens. - **Legal basis:** - Art. 6(1)(b) GDPR (pre-contractual steps at your request). - News beyond the launch notice only with your consent (Art. 6(1)(a)), given through a confirmation link (double opt-in) and revocable at any time. - **Storage:** sign-ups are kept in a private storage area (Vercel Blob) in Vercel's Frankfurt region (Germany) that only we can access. Vercel processes them on our behalf, as described in 3.1. - **Sending:** emails are sent via **Scaleway Transactional Email**. - **Retention:** until 6 months after launch, or until you ask us to remove you; an email to the address in section 1 is enough. ### 3.5 Contact If you write to us, we process what you send in order to answer. - **Legal basis:** Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f). - We handle requests in our self-hosted support desk (Zammad on Scaleway). --- ## 4. The Gravel service ### 4.1 Account, channels, settings We process: - your display name - the identifier of the channel you link (phone number, Telegram chat ID or Threema ID) - language, form of address (du/Sie) and time zones - federal state (for holidays and deadlines) - quiet hours - plan - your confirmation that you are 18 or older - your consents and settings, including autonomy levels and pause A channel is linked to your account only through a one-time code or link, so that messages on it are clearly yours. - **Legal basis:** Art. 6(1)(b) GDPR. - **Consent records:** Art. 6(1)(c) with Art. 7(1). Gravel is only for people aged 18 or older. ### 4.2 Connecting your mailbox and calendar When you connect a mailbox or calendar, Gravel keeps reading it: - **Gmail** via the Gmail API - **Outlook/Microsoft 365** via Microsoft Graph - **iCloud** and other providers via IMAP and CalDAV This lets Gravel notice what needs your attention: deadlines, train delays, price increases, official letters, urgent messages from people, unanswered mail, calendar conflicts. It also uses this to answer your questions. **What we process:** - sender and recipients, subject, the text a human would see, attachments when needed, technical headers, labels - events with attendees and locations **Credentials:** - Google and Microsoft: we receive an access token and never see your password. - iCloud: you create an app-specific password at Apple, which you can revoke there at any time. - Tokens and passwords are stored encrypted. **Minimisation:** - From email we mainly keep the facts we found (for example "ICE 597 on 19 Oct, 70 minutes late") and at most one sentence as a summary, without links. - We cache raw email content for **no more than 30 days**. Longer only when an open task or a memory needs that specific message. **Legal basis:** - For your own data: Art. 6(1)(b) GDPR, because reading is the core of the service you ordered. - For other people's data in your mailbox: see section 7. When Gravel writes to your mailbox or calendar, that data goes to your provider, and for sent mail to its recipients. This covers a draft, a label, an event, or a message you approved. ### 4.3 Documents you send We read photos and PDFs of letters, bills, contracts and utility statements (text recognition) and analyse them: - type of letter - sender - amounts - deadlines Deadlines are computed with fixed, tested rules (for example objection and termination periods), not guessed by the AI model. - **Legal basis:** Art. 6(1)(b) GDPR. For third parties see section 7; for Art. 9 see the review note in 4.2. - **Retention:** originals are deleted 30 days after analysis, unless you ask us to keep them. ### 4.4 No bank access Gravel does not connect to bank accounts. What it knows about bills and payments comes only from your email and the documents you send (4.2, 4.3). ### 4.5 Memory Gravel remembers what you tell it (for example "my sister is called Lena") and what it can safely conclude from your email. Every entry records where it came from: "you said" or "inferred from your email". - What you say always takes precedence. - "What do you know about me?" shows everything; "forget that" deletes. - **Legal basis:** Art. 6(1)(b) GDPR; special categories see 4.11. - **Retention:** until you delete the entry or your account. ### 4.6 Proactive notices: how Gravel decides when to write (profiling) For every possible notice, Gravel decides whether and when to write. It weighs three things: - **Urgency:** how much time is left? - **Importance:** money, deadlines, people? - **Confidence:** how sure are the facts? It adds how you reacted to similar notices before (acted, "later", "no", ignored, "stop"). Then it applies your quiet hours, current meetings, your daily budget of interruptions and the gap since the last message. Unimportant items go to the optional morning brief or are dropped. This is profiling within the meaning of Art. 4(4) GDPR. Its only aim is to tell you the right things at the right time. **If you ignore notices, Gravel writes less, never more.** - "Stop telling me about X" mutes a topic at once. - Proactive messages contain no advertising. - **Legal basis:** Art. 6(1)(b) GDPR. - **Retention:** possible notices until 30 days after the event or deadline, otherwise 90 days; delivery records 60 days; learned preferences per topic for the life of your account. ### 4.7 Conversations: chat, voice messages and AI processing Your messages are processed by large language models. We use open models (including Mistral, gpt-oss, Qwen) running on European infrastructure: - **Scaleway SAS (Paris, France):** Generative APIs. Requests are not logged by default. Scaleway may keep full requests for up to two weeks only when investigating errors or abuse. Data is never used for training. - **OVHcloud (France):** failover. According to OVHcloud, data is not stored or shared. **Voice:** - Voice messages you send Gravel are transcribed on these systems (Whisper). On request, Gravel answers with a voice message (German speech output). - **We do not record audio by default.** It is processed in memory only. - Transcripts are treated like chat messages. - **Gravel makes no phone calls:** there are no voice calls with Gravel, and it never phones you or third parties. **AI disclosure:** Gravel is an AI and says so: at first contact, whenever you ask, and when it matters. See [AI transparency](ai-act.md). - **Legal basis:** Art. 6(1)(b) GDPR. - **Retention:** chat history and transcripts for 90 days rolling. ### 4.8 Actions on your behalf: autonomy levels, confirmation, pause Gravel can get things done for you: write drafts, send mail, create events, unsubscribe from newsletters, cancel contracts, claim refunds, fill in forms on websites. **For each kind of action you decide how independently Gravel may act:** | Level | Meaning | |---|---| | **auto** | Gravel acts without asking. | | **on request** | Gravel acts only when you explicitly ask for exactly that. | | **ask first** | Gravel proposes and acts only after you confirm. The confirmation is valid only for exactly the content you saw; this is secured technically by a check value. | | **hand off** | Gravel prepares everything; you do it yourself. | **The defaults are conservative:** - Anything that reaches other people or costs money asks first. - Payments and purchases are handed off to you. - Payments, cancellations, forwarding, deletions and deleting your account can never be set to "auto". - Gravel sends messages to third parties in your name only after you approved that exact text. **Additional check:** before every action, a fixed risk check runs. It can only make the level stricter, never looser. Gravel therefore asks, for example, when: - money is involved - a new recipient appears - a recipient only appeared in someone else's email - many items are affected - an unfamiliar website is involved **Fixed limits:** spending caps per action and per month. Gravel refuses patterns that look like data theft, such as "forward all mail to an outside address". **Pause:** "Pause" stops all scheduled and background work: proactive messages, automations, monitors, goals. We keep proposals, confirmations and results so that you and we can see what you approved. - **Legal basis:** Art. 6(1)(b) GDPR; for the record, Art. 6(1)(f): our legitimate interest is defending against claims. - **Retention:** 12 months. ### 4.9 Browser tasks Some things can only be done on a website, for example a rail passenger-rights claim. A browser task works like this: - Gravel uses a **short-lived browser in an isolated environment at Scaleway in the EU**, deleted after the task. - You can take over live at any time and hand back. - We do not record the session as video. It appears only as an entry in the activity log: site, steps, result. - Website credentials come from your personal vault. They are encrypted and never shown to the AI model. - Gravel identifies itself to websites as an automated agent where technically supported (Web Bot Auth, signed HTTP requests). - Gravel respects site terms and robots rules. - On CAPTCHAs, login challenges, or terms that forbid automation, Gravel hands over to you. The website receives the data you approved. The website operator is responsible for what it does with that data. - **Legal basis:** Art. 6(1)(b) GDPR. - **Retention:** vault entries until you delete them or your account. ### 4.10 Automations You can create your own routines that run on a schedule or on an event (for example "every Friday, summarise open bills"). - Automations act only within your autonomy levels. - They never write to recipients you have not dealt with. - They stop when you pause. - When you share an automation as a template, the template contains **no personal data**: we remove names, addresses, values and free text before sharing. - **Legal basis:** Art. 6(1)(b) GDPR. ### 4.11 Special categories of personal data (Art. 9 GDPR) Gravel uses health data, religious beliefs, union membership and similar data for proactive help, and stores them in memory, only if you have **explicitly allowed it**. An example is a reminder about a specialist appointment. - **Legal basis:** Art. 9(2)(a) with Art. 6(1)(b) GDPR. - **Withdrawal:** at any time, for example with "stop using health information". We then delete the related entries. Processing up to that point remains lawful. - **Limit:** what Gravel merely *infers* about such topics is never stored, even with your permission. Only what you say yourself is stored. ### 4.12 Activity log and access by our team Gravel records what it read and did: mail, events, documents, external checks, actions, blocked manipulation attempts, browser tasks. "What did you look at today?" shows you. **Our team has no access to content by default.** There are three exceptions: 1. You ask for help with specific content in a support case and agree. 2. Access is necessary to investigate a security incident or abuse. 3. The law requires it. Every such access is logged with name and reason and **shown to you**. - **Legal basis:** Art. 6(1)(b) GDPR (transparency is part of the service); Art. 5(2). - **Retention:** 12 months. ### 4.13 Payments The paid plan is handled by **Mollie B.V.** (Amsterdam, Netherlands), via SEPA direct debit mandate or card. We process: - name and email address - plan - mandate or payment reference - amounts and payment status Mollie processes some payment data under its own responsibility (for example its legal duties as a payment service provider). - **Legal basis:** Art. 6(1)(b) and (c) GDPR (with §147 AO, §257 HGB). - **Retention:** accounting vouchers 8 years, books 10 years, business letters 6 years. ### 4.14 Support Support requests are handled in our self-hosted Zammad (on Scaleway). - **Legal basis:** Art. 6(1)(b) GDPR. - **Retention:** 24 months after the request is closed. ### 4.15 Security and error analysis We check content that does not come from you for manipulation attempts, for example hidden instructions in emails meant to trick the AI. Gravel treats such content as a quote only. For error analysis we use self-hosted GlitchTip. Content, tokens and credential headers are removed before an error report is stored. - **Legal basis:** Art. 6(1)(f) GDPR. Our legitimate interest is the security of the service and your data. - **Retention:** error reports 30 days, server logs 7 days. --- ## 5. Messaging channels and transfers to third countries You choose how Gravel talks to you. Depending on the channel, the messages we exchange go to the providers below. These messages can include, for example, deadlines, senders or the summary of an email. | Channel | Provider | Where data is processed | |---|---|---| | **Threema** | Threema AG, Switzerland | End-to-end encrypted: we encrypt on our server, and Threema sees no content. Switzerland has an EU adequacy decision. | | **SMS** | seven.io (Kiel) or Sinch (Sweden region), provider under verification | EU. SMS travels unencrypted through mobile networks. | | **WhatsApp** | WhatsApp Ireland Limited, which passes data on to WhatsApp LLC and Meta Platforms, Inc. (USA) under the EU-U.S. Data Privacy Framework | We use storage in Germany ("Local Storage DE"), so content at rest stays in Germany. **While it is being processed, content can be handled in Meta data centres anywhere in the world for up to 60 minutes**, including outside the EU. Metadata is only tokenised. | | **Telegram** | Telegram Messenger Inc., not an EU company; it stores EEA users' data in the Netherlands | Outside the EU, with no adequacy decision. Chats with bots are not end-to-end encrypted. | | **iMessage** (later) | Apple, through a messaging service provider in the EU | Not available yet. We are applying to Apple Messages for Business. Messages will then pass through Apple and the provider; We will name Apple's data locations here before iMessage becomes available. We **never** use unofficial relay services. | You chose your **email and calendar provider** (for example Google, Microsoft) yourself, and your data already sits there under your own contract with that provider. When Gravel writes there, the data goes to that provider (see 4.2). **You keep the choice:** - If you do not want any transfer outside the EU, use Threema or SMS. - You can switch channels at any time with one message. - When you choose a channel, we point out the providers outside the EU explicitly. --- ## 6. Recipients We use the following processors. All are bound under Art. 28 GDPR. | Provider | Seat | Purpose | |---|---|---| | Scaleway SAS | Paris, France | Hosting, database, storage, key management, AI models, speech recognition, email sending, isolated browsers | | OVHcloud | France | Failover AI and speech output, encrypted backups, memory search (planned) | | Vercel Inc. | Covina, USA (EU-U.S. Data Privacy Framework) | Hosting and delivery of the website; visitor statistics; storing waitlist sign-ups (Frankfurt region) | | Threema AG | Switzerland | Threema channel (if chosen) | | SMS provider (under verification) | EU | SMS channel (if chosen) | | Messaging service provider for Apple Messages for Business | EU (planned) | iMessage channel (later) | **Other recipients acting under their own responsibility:** - Mollie B.V. (payments) - the messaging providers in section 5 - your email and calendar provider - recipients and websites you have Gravel send something to **External queries without your identity:** - Timetables are queried at Deutsche Bahn (DB Timetables API) with station names only, no name or booking data. - Parcel tracking at DHL and GLS (planned) is queried with the tracking number only. Tracking data is deleted 30 days after delivery. The full, current list with legal entities and safeguards: [sub-processors](../sovereignty/subprocessors.md). --- ## 7. Information for people whose data is in a user's mailbox (Art. 14 GDPR) If you write to a Gravel user, or share a calendar event with one, Gravel processes your details on that user's behalf: - name, address - message content - event **Purpose:** helping the user manage their own correspondence. **Legal basis:** Art. 6(1)(f) GDPR. The legitimate interest is organising and answering mail addressed to the user. Anyone who writes to someone can expect the recipient to use tools to organise their mail. **What we do not do with your data:** - We build **no profile** of you. - We do not combine your data across users. - We use it for nothing else. - Raw content is kept for at most 30 days. **Objection:** you can object (Art. 21) at victor.gulchenko@gmail.com. We can then block your address so that Gravel creates no notices about you and stores nothing about you in memory. **Access:** your data sits only, encrypted, in individual users' accounts. Without further information we often cannot attribute it to you (Art. 11(2)). --- ## 8. How long we keep data We keep data only as long as its purpose requires. The main periods: | Data | Retention | |---|---| | Raw email content | at most 30 days (longer only for an open task or memory that needs that specific message) | | Activity log | 12 months | | Memory, settings, autonomy levels, automations | until you delete them or your account | | Chat history and transcripts | 90 days | | Audio | not stored | | Document originals | 30 days after analysis | | Action proposals and confirmations | 12 months | | Backups | 30 days | | Accounting records | statutory periods (8 or 10 years) | **When you delete your account:** - We destroy your personal key immediately, which makes every encrypted copy of your data unreadable, including in backups. - We then delete all records and revoke access at Google and Microsoft. - Unencrypted technical metadata in backups is gone within 30 days. - Accounting records we must keep are the exception. The chat history inside your messaging app is not in our hands: delete it there. --- ## 9. No automated individual decisions Gravel makes no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Actions with external effect run only within the autonomy levels you set yourself and can change at any time. Section 4.6 explains how Gravel decides on proactive notices. --- ## 10. Do you have to provide data? Without a linked channel, Gravel cannot talk to you. Without connected sources (mailbox, calendar, documents), it cannot tell you anything proactively. Everything else is optional: special categories, the morning brief, automations, voice messages. --- ## 11. Your rights You have the right to: - **access** (Art. 15 GDPR) - **rectification** (Art. 16) - **erasure** (Art. 17) - **restriction** (Art. 18) - **data portability** (Art. 20) - **withdraw consent** with effect for the future (Art. 7(3)) The easiest way is to write to Gravel: | You write | Gravel does | |---|---| | "What do you know about me?" | shows every stored fact | | "What did you look at today?" | summarises the activity log | | "Export my data" | prepares a complete copy as a download (machine-readable and readable), with an extra confirmation through a second route | | "Forget that" / "Forget everything about X" | deletes the entries | | "Delete my account" | deletes the whole account after your confirmation | | "Pause" | stops all background work | You can also write to victor.gulchenko@gmail.com. We answer without undue delay, at the latest within one month (Art. 12(3) GDPR). > **Right to object (Art. 21 GDPR):** where we process data based on legitimate interests (Art. 6(1)(f)), you may object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can end proactive notices about a topic at any time with "stop telling me about X". --- ## 12. Right to complain You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany https://www.lda.bayern.de --- ## 13. Google and Microsoft user data **Google:** Gravel's use and transfer to any other app of information received from Google APIs will adhere to the *Google API Services User Data Policy*, including the Limited Use requirements. Specifically: - We use Gmail data only for the features you see in Gravel. - We transfer it only as needed for those features: - to our processors - to the channel you chose - to recipients you approved - We do not use it for advertising. - We do not sell it. - We do not use it to train AI models. - People on our team read it only with your agreement for specific messages, to investigate security incidents or abuse, or when the law requires it. **Microsoft:** for Outlook and Microsoft 365, we receive only delegated permissions on your behalf, never access to a whole organisation. Permissions are limited to what the features you use need. You can revoke access at any time in your Microsoft account or with us. --- ## 14. Changes When our processing changes, we update this notice. That includes new features and new providers. We tell you about material changes in the chat beforehand. New sub-processors are announced at least 30 days in advance.