What we collect, and why.

Who is responsible

Gists AI is a product of TakeOnePiece LLC, 1 Broadway, Cambridge, MA 02142. For survey answers and employee data, your employer is the controller and TakeOnePiece LLC processes the data on its behalf under the DPA. For visitors to gists.ai and for the people who buy Gists AI, TakeOnePiece LLC is the controller.

What we collect

• From Slack: names, work emails, time zones, user groups and channel names. Never reads channels, conversations between people, or files. If someone writes to Gists AI in its own private message, we use it only to point them to /survey and do not store it.
• From your HR system, if connected: teams, managers, and start and leave dates.
• Survey answers: the numbers people pick and anything they write.
• Account and billing: the admin's name and email, and payment details, which Stripe holds; we never see full card numbers.
• Logs: who viewed which results and when, and technical logs to keep the service running.

Who sees answers

How answers are stored, who sees them, and the privacy defaults your company can change are set out, in words, on Security. Your company sets the rules; you are always told what each one means before you answer. Gists AI staff never see who wrote what.

How we use data

Only to run Gists AI: deliver surveys, show results, send the emails people ask for, bill the company, keep the service secure, and fix problems. We do not sell data, show ads, or use survey answers to train AI models.

AI

AI is optional. Surveys, results and team trends work without it. When it is on, written answers are summarized into themes by Google (Gemini), or by the AI provider the company chose in its settings, and only for groups at or above the floor.

Subprocessors

We use these companies to run Gists AI:

• Google Cloud: hosting and storage
• Google (Gemini): themes, summaries and suggestions, only when AI is on
• SendGrid: email delivery
• Stripe: payments

We email you at least 30 days before adding or replacing a subprocessor, and you may object. The full list is on Legal.

How long we keep it

• While the company uses Gists AI, we keep its data so results and trends work.
• If your company cancels, or its trial ends without a plan, its results stay readable for 30 days, and its admins can download all of its data in one file. Then everything it has in Gists AI is deleted: surveys, answers, results, people, teams, settings and connections. We email its admins 7 days before, and again when it's done.
• Backups clear within two weeks after the deletion. We keep only a record that it happened (the company's id and the date, no names). Invoices stay with Stripe, as tax law requires.

Skipping questions

Questions marked optional can be skipped. You can also leave a survey unanswered. Nobody is told. What you answered stays in team results, which never show who you are.

Your rights

You can ask to see, correct, export or delete your data. If you are an employee, your company controls your survey data, so ask your company first; we will help them answer. You may also complain to your data protection authority.

Anyone can download their own data from Gists AI, next to Delete all my data: their profile, connections, settings, consent and notice history, their check-ins, and which surveys were sent to them. Survey answers are not in it: they are stored without names, so nobody can pick out one person's answers, not HR, not Gists AI and not the person who wrote them.

An HR admin can download all of the company's data in one file from Settings: people, teams, privacy settings and their history, and each survey's questions, results, briefs and reports. Results come out as they do in the app: nothing from fewer people than the group size floor, and no one's answers next to their name. The link goes by email to the admin who asked, works for 24 hours, and the file is deleted after 7 days.

Delete all my data removes your check-ins and anything made from them. It can't remove survey answers: they're saved without your name, so nobody can find which ones are yours. Questions about your data? Write to support@gists.ai.

Where data is stored

Data is stored with Google Cloud in the United States. Transfers from the EU, EEA, UK and Switzerland are covered by the Standard Contractual Clauses in the DPA.

Security

Data is encrypted in transit and at rest. Access by our staff is limited and logged. SOC 2 in progress. See Security.

Email

Sign-in codes, notifications and leaders' summaries come from Gists AI <hello@mail.gists.ai>.

Contact

TakeOnePiece LLC, 1 Broadway, Cambridge, MA 02142. support@gists.ai.