Privacy policy
Last updated Oct 28, 2026
Gorila keeps a team’s tasks and distilled company knowledge so that every AI the team uses can read and write them. It is built to hold as little as possible: your AI does the reading and reasoning with its own connectors, and sends Gorila only short, structured text. Gorila never receives your files, emails or chat logs, and runs no AI model that reasons over or writes about your data. The only model it uses is a search model in the EU that turns short text into numbers, so search understands what you mean.
Who we are
Gorila is operated by Malavar Solutions S.L., Calle Blasco de Garay, 1, 28015 Madrid, Spain (tax ID B22816920). Questions and requests about your data: hola@malavar.com. We have not appointed a data protection officer, as the law does not require one for us; that address reaches the people responsible for your data.
For your account, the waitlist, security logs and aggregate usage counts we are the controller. For what your organization puts in Gorila (tasks, knowledge, members, and the activity records its admins see) your organization is the controller and we are its processor, under our Data Processing Agreement.
What we store
Your account
- Your email, and your name and avatar if you sign in with Google. You sign in with Google or with a one-time code we email you; Gorila has no passwords.
- Which organizations you belong to and your role in each.
- Personal access tokens, stored only as a hash. We show a token once, when you create it.
Your organization’s content
- Tasks and projects: title, context written for the assignee’s AI, status, dates, comments and their history.
- Knowledge: distilled entries (tone, rules, processes, decisions), their versions, the proposals that changed them and who approved them. Sources are kept as pointers (for example a Notion page URL), never as copies.
- Onboarding progress, so a setup can be resumed. What onboarding finds about you from your own chats or interview stays private to you until you choose to share it.
- Agents your organization adds, and the webhook URL an agent registers.
Search
So that search finds an entry or a similar task by its meaning and not only by its words, Gorila sends a short text to an embedding model, Cohere Embed v4 on Amazon Bedrock in the EU (Ireland), which turns it into a list of numbers (a vector). The text is: for a knowledge entry, its title, summary, trigger phrases and the first 1,000 characters of its body; for an open task, its title only; and the question your AI is searching with. Private entries and private tasks are included. The model only computes the vector: Amazon does not store the text, does not log it and does not train on it. The vectors are stored in our database next to the item, and only the people who can see the item can read them.
Usage metrics
Each action records an event: which tool or page action was used, which AI client sent it (for example “Claude Code” and the browser or client user agent), whether it worked, how long it took and counts (such as how many knowledge entries were returned). Events never contain the text of your tasks, knowledge, prompts or files. They show your admins the activity in your organization, on its behalf. We also count them across organizations — totals, never content or who did what — to run and improve Gorila.
Product analytics and error reports
We use PostHog (EU Cloud) to see how gorila.la and the app are used and to find errors. On gorila.la it records page views and clicks without identifying you. In the app it records which pages you open (the address without search terms or filters), tied to your user and organization ids, never your name or email. When something breaks, the error report holds the error, the page or tool and those ids. Neither ever contains the text of your tasks, knowledge, prompts or files, and there is no session recording.
Early access list
If you join the waitlist on gorila.la we store your email and where you signed up, to contact you about access. Ask us and we remove it.
Technical logs
Our hosting provider keeps short-lived request logs (IP address, user agent, URL, status) for security and debugging.
Why (legal bases)
- Contract (GDPR art. 6.1.b): to provide the service you or your organization signed up for — your account, your organization’s content, access tokens.
- Steps you asked for before a contract (art. 6.1.b): contacting you about access when you join the waitlist.
- Legitimate interest (art. 6.1.f): aggregate usage counts without content, product analytics and error reports, security logs and preventing abuse (rate limits).
- Legal obligation (art. 6.1.c): records we must keep, such as invoices once billing exists.
We do not sell data, show ads, use your content to train any AI model, or send the content of your pages to any analytics provider.
You need an account (your email, and your name if you sign in with Google) to use Gorila; without it we cannot give you access. We make no decisions about you by automated means alone and do no profiling.
Where it lives and who processes it
Data is stored in the EU (Ireland) and the app runs in the EU (Dublin). These providers process it for us:
| Subprocessor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database and authentication | EU — AWS eu-west-1 (Ireland) | Data stored in the EU; Supabase DPA with Standard Contractual Clauses |
| Vercel, Inc. | Hosting of the web app, API and MCP server; request logs | EU — functions in Dublin (dub1); global edge network for static files | Vercel DPA with Standard Contractual Clauses and the EU-US Data Privacy Framework |
| Amazon Web Services EMEA SARL | Search: Amazon Bedrock (Cohere Embed v4) turns the distilled text of knowledge entries, task titles and search queries into vectors, private ones included; it does not store or log them or train on them | EU — AWS eu-west-1 (Ireland) | Processed in the EU; AWS GDPR DPA with Standard Contractual Clauses |
| PostHog, Inc. | Product analytics and error tracking: page views, user and organization ids and error reports, never content | EU — PostHog EU Cloud (Frankfurt, Germany) | Processed in the EU; PostHog DPA with Standard Contractual Clauses |
| Resend, Inc. | Sends Gorila's emails: sign-in codes and invitations (recipient address, inviter and organization names) | EU — sending region eu-west-1 (Ireland) | Resend DPA with Standard Contractual Clauses |
Your AI client (Claude, ChatGPT, Codex, Cursor or your own agent) talks to Gorila on your behalf. What it does with what Gorila returns is governed by your agreement with that provider, not this policy.
How long we keep it
- Your organization’s content and its events: until an owner deletes the organization, which removes everything in it at once.
- Your account: until you ask us to delete it. Leaving an organization removes your membership; what you wrote for the team stays with the team.
- Waitlist: until we give you access or you ask us to remove your email.
- Technical logs: deleted by our hosting provider within 30 days.
- Backups: deleted data disappears from our database provider’s backups within 7 days.
Your rights
You can access, correct, export, delete or restrict the processing of your personal data, object to processing based on legitimate interest, and take your data elsewhere.
- Export: any member can download everything they can see in Gorila (Settings → Export), as JSON plus Markdown.
- Delete: an owner can delete the whole organization (Settings → Organization). For your own account, write to hola@malavar.com.
- Correct: ask your AI to update a task or propose a knowledge change, or ask your admins.
If the data is your organization’s content, we pass your request to your organization, as its processor. We answer within one month. You can also complain to the Agencia Española de Protección de Datos (AEPD).
Security
Every table is isolated per organization in the database itself (row-level security); private items are enforced there too, not only in our code. Connections are encrypted, tokens are hashed, secrets live only in our hosting provider’s encrypted settings, and every knowledge change keeps an audit trail.
Cookies
We only use the cookies needed to keep you signed in to the app. They expire when your session does. We use no analytics, advertising or third-party cookies, on gorila.la or in the app: our analytics stores nothing on your device (on gorila.la, PostHog counts visitors with a daily hash computed on its servers; in the app, identity lives only in the open page).
Changes
We will post changes here and update the date above. If a change affects your organization’s data, we tell its owners first.