Privacy Policy

Effective date: July 14, 2026

Gadaa Solutions LLC ("Gadaa," "we," "us"), a Massachusetts limited liability company, operates the Gadaa /ask service at gadaa.ai/ask (the "Service"). Gadaa /ask sends your question to several independent AI models and returns a synthesized, deliberated answer. Because of that design, your input is shared with third-party AI providers as described below. This policy explains what we collect, how it is used, and your choices.

Information we collect

• Account data: your email address and authentication data, to create and secure your account.
• Your inputs: the questions, prompts, and any text you submit to /ask.
• Service-generated data: the AI models' responses, the deliberation record of which models were consulted, confidence information generated for your session, and related metadata.
• Technical data: IP address, device and browser information, and usage logs needed to operate and secure the Service.

We collect only what is needed to operate /ask. Please do not submit sensitive personal data (for example health, financial-account, government-ID, biometric, or precise-location data), or other people's personal data without a lawful basis. We do not request it and ask that you not include it in your questions.

How your inputs are processed by AI providers

To produce a deliberated answer, /ask transmits your input to multiple third-party AI providers through a routing service (OpenRouter). These currently include providers such as Anthropic, OpenAI, Google, and xAI, together with providers that host open-weight models. Each provider processes your data under its own privacy and data-retention terms. Specifically:

• On the paths we use, inputs sent to these providers are not used to train their models, and are retained only briefly for abuse-monitoring before deletion.
• We configure our AI-model routing to exclude model providers that would train on your data, to prefer zero- or low-retention processing, and not to route your inputs to model hosts located in jurisdictions we consider to lack adequate data-protection safeguards. These settings apply to the AI model providers described in this section. They do not apply to our web-search provider — see "Live web search" below, which is governed by different terms.
• All model inference runs on third-party providers reached through OpenRouter; we do not self-host any model.

Live web search

For some questions — typically those asking about current or time-sensitive information — /ask sends the text of your question to a third-party web-search provider (Tavily) to retrieve up-to-date results, which are then given to the AI models to inform their answers. Questions that do not require current information are not sent to the search provider.

Please read this carefully, because it differs from how the AI model providers handle your data. Under the search provider's own terms, it may retain the text of your question and use it to improve its own services. We do not control that retention, and it is not covered by the no-training and low-retention settings we apply to the AI model providers.

Because of this, do not include personal, confidential, or sensitive details in questions about current events or other time-sensitive topics.

Sharing your answers by link

When you open or share the link to a specific deliberation (a URL of the form gadaa.ai/ask/d/…), that deliberation is accessible to anyone who has the link, without signing in — similar to an "anyone with the link" share. Do not share the link to a deliberation whose question or answer you consider private. We do not publish a public directory of deliberations, and links are only discoverable if you or someone you shared with distributes them.

Where your data is stored, and for how long

• Your account data, chat history, and the /ask deliberation record are stored in our database (Supabase, us-west-1 region) and with our hosting providers (Vercel for the web app; Railway for the deliberation backend).
• We retain your chat history and deliberation record until you delete them. We may delete inactive accounts and associated data after a prolonged period of inactivity in accordance with our retention practices, except where longer retention is required by law, or reasonably necessary to establish, exercise, or defend legal claims, prevent fraud or abuse, enforce our agreements, or protect the security and integrity of the Service.
• Provider-side retention is governed by each provider's own terms, as described above.

On account deletion: when you delete your account, we permanently delete your account, chat history, and deliberation records — including the per-model deliberation record — within 30 days (in practice, immediately on request). We retain data beyond this only where required to comply with law, to establish or defend a legal claim, or to investigate abuse; in those cases we keep only the minimum necessary, isolated from active use, and delete it once that basis no longer applies.

The one record we keep as a matter of course is a minimal record that you accepted these terms and affirmed you are 18 or older — limited to that fact, the version you accepted, and the date, kept isolated from active use so we can establish that agreement if a dispute arises. It contains none of your questions or answers, and we remove technical identifiers (such as your IP address) from it when you delete your account.

Your choices and rights

At any time, you can:

• access and export your data (download a copy from your account settings),
• delete your entire account and all associated data,
• request correction of your account information.

Use the in-app controls or contact privacy@gadaa.ai. Depending on where you live — for example California under the CCPA/CPRA, or the EU/UK under the GDPR — you may have additional rights, including rights to access, deletion, correction, and to opt out of certain processing. We honor verified requests as required by applicable law, and we do not sell your personal information.

Minors

The Service is intended only for adults 18 and over. It is not directed to children or teenagers, and we do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18, we will delete it and terminate the account. If you believe a minor has provided us data, contact privacy@gadaa.ai.

Security

We use access controls, encryption in transit and at rest, per-user data isolation, and data-minimization practices. Our error-monitoring provider (Sentry) is configured to exclude the text of your questions and answers and other personal data from the diagnostic reports it receives. No system is perfectly secure. In the event of a breach affecting the personal information of Massachusetts or other affected-state residents, we will notify affected individuals and the appropriate authorities as required by law.

Service providers (sub-processors)

We rely on service providers to operate the Service, currently including: Vercel (web-app hosting), Railway (backend hosting), Supabase (database, authentication, storage), OpenRouter (AI-model routing), the AI providers described above, Tavily (web search for current-events questions — may retain and use your question to improve its services; see "Live web search"), Stripe (payment processing for paid plans), and Sentry (error monitoring). We maintain data-processing terms with these providers where applicable.

Changes

We will post changes on this page and update the effective date. We will communicate material changes in-app.

Contact

Questions or requests: privacy@gadaa.ai.