Privacy Policy
What data Galo processes, why, with which providers, for how long, and how to revoke access or have your data deleted.
Last updated: · Version française
Who is responsible for your data?
Galo is an AI-powered marketing platform. It helps SaaS founders analyze their website, create ads and content, publish them on their social accounts and track the results.
The data controller is Teaser Software, a sole proprietorship run by Carl Ndoumbe, 556 Chaussées Jules Ferry, 80090 Amiens, France. For any question about your data: hello@trygalo.app.
Galo is meant for professionals who are of legal age. We do not knowingly collect data from minors.
The data we process
- Account: name, email address, a cryptographic hash of your password (never the password itself), your Google identifier if you sign in with Google, and sign-in sessions.
- Brand: your website address, the public pages Galo reads to understand your business, your choices of tone, audience and style, and the logos and images you add.
- Content: the ads, visuals, videos and texts created for you, their versions, your approvals and edit requests, and your conversations with Galo.
- Social connections: the access tokens that networks hand to us when you authorize them. They are encrypted and are never sent to AI providers.
- Statistics and ad data: the results of posts and campaigns read from the accounts you connect (details for Meta below).
- Product usage: usage events (screen opened, creation approved, error hit), with no free text.
- Payment: your subscription status, your invoices and payment status. Your card number stays with Stripe; Galo never sees it.
- Support: your messages and the technical information needed to reply.
We do not ask for ID documents and we do not knowingly process sensitive data. Please avoid typing it into free-text fields.
Data from Meta platforms (Facebook and Instagram)
When you connect Facebook and Instagram, you go through Meta’s own authorization dialog. You choose the Pages, Instagram professional accounts and ad accounts that Galo may use. Galo gets access to nothing else.
What Galo reads or does with these connections, and why:
- Your public profile and your Meta email address: to identify you when you connect.
- The list of your Pages, Instagram professional accounts and ad accounts: to let you choose which ones Galo manages.
- The posts of your Pages and Instagram professional accounts (text, media, date, link): to show your calendar and keep track of what was published.
- The statistics of those Pages and accounts (reach, impressions, engagement, follower count): to build your reports and improve the next suggestions.
- Your campaigns, ad sets and ads, their budgets and results: to create, pause or edit them when you ask, and to measure how they perform.
- Publishing: to send to your Page or Instagram account the content you approved, or that you allowed Galo to publish automatically.
Galo does not request access to your private messages, your list of followers, or the personal data of people who view or comment on your posts. Statistics are aggregated figures provided by Meta.
We use data received from Meta only for these functions: your publishing, your reports, your recommendations, and the niche learning described below, in aggregated and anonymized form. We do not sell it, rent it, pass it to data brokers, or use it for advertising unrelated to your use of Galo.
Retention: connection tokens are deleted as soon as you disconnect the account or delete your Galo account. Other data received from Meta is erased within 30 days after you disconnect, delete the brand or delete your account. If you remove Galo from your Facebook or Instagram settings, Galo loses access immediately, treats the connection as disconnected and applies the same 30-day period.
What you can revoke: at any time, you can disconnect an account in Galo, or remove Galo in your Facebook or Instagram settings. The Data Deletion page (/en/data-deletion) explains the steps.
Why we use this data
- To provide the service you ask for: analyze your brand, create, publish, measure and manage your ads (performance of the contract).
- To secure accounts, limit abuse and fix errors (legitimate interest).
- To understand how the product is used and improve it, with pseudonymized events and no free text (legitimate interest).
- To invoice and keep accounting records (legal obligation).
- To write to you about the service: address confirmation, approval reminders, expired-connection alerts. Marketing messages are sent only with your consent, which you can withdraw.
Galo does not use your data to show targeted advertising to third parties.
Niche learning
To advise each brand better, Galo learns from the combined results of brands in the same niche (for example, project management tools), in aggregated and anonymized form. What is learned: which formats, hooks and posting rhythms work on average.
One brand’s content and figures are never shown to another brand. When a niche has too few brands to guarantee anonymity, Galo does not use its results for the others. This learning is also stated in the terms of use.
Once aggregated and anonymized, these results can no longer be linked to you, so they cannot be removed individually. You can object: write to hello@trygalo.app and your results will no longer be included in future aggregates.
The providers involved
We use these providers to run Galo. They process your data only for this service.
- Vercel (United States): hosting of the application and website.
- Turso (European Union, Ireland): the application database.
- OpenRouter (United States) and the AI model providers it relays to: generation of text, images, video and voice, analysis of your website, dictation. They receive the text and files needed for the requested task, never your connection tokens. Depending on the model used, processing takes place in the United States, the European Union or elsewhere.
- Resend (European Union): sending the service emails.
- PostHog Cloud (European Union): product usage measurement.
- Stripe (United States and European Union): payments and invoicing.
- Zoho Mail (European Union): the hello@trygalo.app inbox, which receives your requests.
- File storage and on-demand computing: to keep your media and produce videos, Galo uses infrastructure providers for storage and computing.
For some networks, Galo may connect through a publishing aggregation provider. In that case, the provider holds the connection token on your behalf. The connection screen says so before you authorize anything.
When a provider processes data outside the European Union, the transfer relies on the European Commission’s standard contractual clauses or on the EU–US Data Privacy Framework. We update this list when a provider changes.
The networks you connect (Facebook, Instagram, TikTok, YouTube, LinkedIn, X) receive what you have them publish. Each one then processes that data under its own policy.
How long we keep your data
- Account, brands, content and conversations: as long as your account exists, then erased within 30 days after you delete it.
- Network data and tokens: see the Meta section above; the same rule applies to the other networks.
- Usage events: 90 days (30 days for technical measurements). Anonymous daily counts are kept 730 days.
- Technical security logs: 30 days.
- Support messages: 12 months after the last exchange.
- Invoices and accounting records: 10 years, as French law requires. They are not erased with the account.
- Backups: they expire on their own schedule, at the latest 90 days after the original data is erased.
Your rights
You can ask for access to your data, correction, erasure, restriction or portability, object to certain processing and withdraw consent at any time.
From your account you can edit your information, export your creations and data, and delete your account. For anything else, write to hello@trygalo.app. We may ask you to confirm your identity, and we reply within one month.
Wherever you live, we handle these requests the same way. If you are not satisfied with a reply, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.
To delete your data, follow the Data Deletion page (/en/data-deletion).
Security and changes
Connection tokens are encrypted before they are stored, access to data is restricted per account and traffic goes over HTTPS. No protection is absolute: if an incident affects your data, we tell you and notify the competent authority within the legal deadlines.
If this policy changes in a significant way, we tell you by email or in the app before the change takes effect. The date of the last update is at the top of this page.