Privacy Policy
1. Who we are and how to contact us
Gary is provided by Pleso Therapy sp. z o.o. ("Pleso", "we", "us"), registered in Poland under KRS 0000980227, REGON 522652856, NIP 5783155594, with its registered office at ul. 12 Lutego 25/7, 82-300 Elbląg, Poland. Pleso is the controller of the personal data described in this notice.
- Data Protection Officer: Marta Gajewko, iod@pleso.me. Contact her with any question about your data or this notice.
- Questions about Gary: hello@pleso.me.
- Subscriptions and refunds: hq@pleso.me.
This notice explains what personal data Gary processes, why, on what legal basis, who receives it, how long we keep it and what rights you have. It applies to the Gary web app at companion.pleso.me and to your Gary account. It does not cover Pleso's therapy platform, which has its own privacy policy, or third-party websites we link to.
2. What Gary is and where it is available
Gary is a general-wellbeing companion for adults aged 18 or over. It uses artificial intelligence to respond to what you write. It is not therapy, a medical device, professional advice or an emergency service, and it does not diagnose, treat or monitor any condition.
Gary is available to people who live in a European Union member state, the United Kingdom or Ukraine.
We apply the EU General Data Protection Regulation (GDPR), the Polish Personal Data Protection Act and the Polish rules on storing and accessing information on your device. Where you live in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply. Where you live in Ukraine, the Law of Ukraine "On Personal Data Protection" also applies.
3. The short version
- You decide what is processed. Storing your reflections, AI responses, dictation, analytics, advertising measurement and marketing emails are separate choices. Accepting the Terms does not switch any of them on.
- Your reflections are stored on our servers in Google Cloud in the Netherlands, encrypted, and only while your health-data storage consent is current.
- AI replies are generated by a Google Gemini model in the EU. We do not attach your email or account ID to AI requests, and Google does not use your data to train its models.
- Gary checks your messages for signs of risk so it can show you support resources. This check is automatic and nobody at Pleso monitors your messages.
- Pleso’s staff tools have no access to your reflections. Content is encrypted on the server side; this is not end-to-end encryption.
- We never sell your data, and what you write is never used for advertising.
- You can withdraw any choice in Profile & settings > Privacy & data. Withdrawing health-data storage deletes your health content, so export a copy first if you want one.
- Gary is not an emergency service. If you are in danger, contact your local emergency number (112 in the EU and Ukraine, 999 in the UK).
4. Data we process, why and on what legal basis
Health-related content is special-category data under Article 9 GDPR. We process it only with your explicit consent (Article 9(2)(a) and Article 6(1)(a) GDPR), which you can withdraw at any time.
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email and sign-in identity (Firebase), country of residence, language | Creating and securing your account, keeping your data across sessions | Contract (Art. 6(1)(b)); legitimate interest in account security (Art. 6(1)(f)) |
| Adult confirmation: that you confirmed you are 18 or over (not your date of birth) | Keeping Gary to its adult audience | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Consent records: which choices you made, the version and wording you saw, time and platform | Demonstrating and honouring your choices | Legal obligation to demonstrate consent (Art. 6(1)(c) with Art. 7(1)) |
| Subscription and payment data: plan, status, renewal and refund history, invoices. We do not receive your full card number | Selling and managing your subscription, accounting and tax | Contract (Art. 6(1)(b)); legal obligation under tax and accounting law (Art. 6(1)(c)) |
| Health content: reflection messages and results, AI replies, saved memories, goals, topics, mood history | Storing your content so you can return to it | Explicit consent: health-data storage (Art. 9(2)(a), 6(1)(a)) |
| Content sent to AI: messages you submit, selected reflection context, memories you saved | Generating Gary's AI replies (section 6) | Explicit consent: AI (Art. 9(2)(a), 6(1)(a)) |
| Microphone audio while you dictate | Turning speech into an editable draft | Explicit consent: speech (Art. 9(2)(a), 6(1)(a)) |
| Safety signal: an acute or concern indicator derived from your messages | Showing support resources when a message suggests risk (section 7) | Explicit consent: safety check (Art. 9(2)(a), 6(1)(a)) |
| Usage analytics and masked session replay (PostHog) | Understanding navigation, testing interface variants, fixing errors | Consent (Art. 6(1)(a)); consent to device access under Polish electronic communications law |
| Email for guides and news (the newsletter, if you sign up on the website or tick the box in Gary; sent through PostHog) | Sending new Gary guides and occasional news, about once a month, after you confirm your address | Consent (Art. 6(1)(a)); unsubscribe any time |
| Advertising measurement: whether you came from a Meta or Google ad, and when you register, start checkout or subscribe | Measuring which ads work | Consent (Art. 6(1)(a)); consent to device access under Polish electronic communications law |
| Feedback you choose to submit (ratings, exit survey) | Improving Gary | Legitimate interest (Art. 6(1)(f)); contacting you only with your separate permission (Art. 6(1)(a)) |
| Support requests sent to hello@pleso.me, hq@pleso.me or iod@pleso.me | Answering you and handling complaints and rights requests | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Technical and security data: operational logs, speech-session metadata for access checks and quotas | Running and securing the service, preventing abuse | Legitimate interest (Art. 6(1)(f)) |
We do not sell your data or use what you write for advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Your separate choices and what withdrawal does
Each choice below is optional, starts unticked and is recorded separately. Before you decide, Gary shows you the full notice for that choice. Gary may ask for health-data storage and AI responses together, because it needs both to keep your reflections and reply to them, and offer one “Allow both” action; each is still a separate choice that you can give or withdraw on its own. You can change any choice in Profile & settings > Privacy & data. Withdrawal does not affect processing that already took place.
| Choice | If you decline | If you withdraw later |
|---|---|---|
| Health-data storage | Gary does not keep your reflections on its servers; features that need saved content are unavailable | New storage stops and deletion of all your health content starts. Access ends immediately, so export a copy first. Giving consent again does not restore deleted content. Your account and subscription remain |
| AI responses | Gary does not send your content to the AI model; AI replies are unavailable | New AI processing and queued work stop. Data already sent to the provider cannot be recalled. Stored content stays readable and exportable while storage consent remains |
| Speech-to-text | You type instead | The active recording stops and new sessions are blocked. Audio already transmitted cannot be recalled |
| Guides and news emails | You don’t receive them | Use the unsubscribe link in any email, or untick the choice in Gary. We stop sending straight away |
| Advertising measurement | Gary works normally; no ad events are sent | New events stop. Events already delivered to Meta or Google cannot be recalled |
| Analytics and masked replay | Gary works normally | New collection stops. Data already delivered is not erased automatically; ask iod@pleso.me to erase it without closing your account |
The safety check (section 7) is required to use Gary, so it is not listed here. Withdrawing a consent does not cancel your subscription. To stop paying, cancel it in Profile & settings > Subscription (see the Terms).
Visitor analytics, before signup.
Visitor analytics is optional and starts only after a fresh choice in Cookie choices. A secure HttpOnly first-party cookie (gary_visitor_consent) holds a random consent token for up to 30 days. PostHog EU Cloud receives visits, bounded campaign tags and numeric ad identifiers, device categories, sessions, time, scroll, content-free clicks, loading performance and questionnaire progress. We also measure displayed subscription plans, prices, currencies, pricing groups, how the country was selected, quote readiness and checkout interactions. If the required account or checkout analytics choice is also current, server-confirmed initial subscription purchases include the actual amount and currency. Browser actions are not proof of payment. No questionnaire answers, results, name, email, full URL, raw IP or billing address are sent. This choice does not grant advertising or account analytics, and does not join identities across devices. With visitor analytics enabled, a random sample of visits includes masked recordings of approved public navigation, subscription options and order summaries in PostHog EU Cloud, for up to 30 days. Text and inputs are masked; answers, results, identity and payment fields are blocked. We measure displayed plans, prices, currencies, pricing groups and checkout interactions, never raw IP or billing address. Withdrawal stops new recording and queues deletion; provider cleanup is asynchronous.
Use Cookie choices to withdraw at any time without restricting Gary. Withdrawal stops new collection and queues deletion of the visitor profile, events and recordings. The fixed 30-day visitor expiry and linked account deletion also queue cleanup. New recordings have a maximum 30-day retention; provider cleanup is asynchronous, can take days and is retried. Clearing cookies removes the local token but does not immediately erase provider data; expiry cleanup still applies. Contact iod@pleso.me for help.
6. How AI works in Gary
You are talking to an AI system, not a person. Gary's replies are generated by a Google Gemini model through Google Vertex AI. AI can make mistakes. It is not a clinician and cannot assess or treat your condition.
- What is sent: the messages you submit, the context from your current reflection needed to reply, and memories you chose to save. Gary suggests memories, but nothing becomes a saved memory until you review and approve it.
- What is not sent: your email, account ID or any stable identifier. What you write can still identify you or reveal health information, so free text is never anonymous.
- Where: requests go to Vertex AI's European Union multi-region endpoint, so they are processed in the EU, not in one specific country.
- Provider retention: Google may keep requests and replies in memory for up to 24 hours to speed up responses. Prompts flagged by Google's automated safety systems may be kept for up to 90 days solely to investigate abuse. We do not enable provider request logging or web-search grounding.
- No training: Google acts as our processor and does not use this data to train or fine-tune its models without our permission. We do not use your content to train AI models either; we test Gary only with made-up examples.
- No automated decisions: Gary does not make decisions about you that produce legal or similarly significant effects.
7. Safety check
When you send a message, Gary automatically checks it, together with your two previous messages, for phrases that may indicate risk to your safety. The check uses fixed phrase matching. It is not a clinical assessment and is not done by a person.
Before you start, Gary asks for your explicit consent to this check. Gary cannot be used without it, because the check is how Gary makes sure you see support resources when you may need them.
- What happens: if the check finds a possible risk, Gary shows you support resources for your country. That message does not create memories, topics or goals.
- What does not happen: nobody at Pleso monitors your messages, and Gary does not contact emergency services or anyone else on your behalf.
- Where and what is kept: the check runs on our servers in the Netherlands. When a message is routed to support resources, Gary keeps only a flag on that message saying so, with no details of what matched. The flag is deleted with the reflection or your account. Pleso staff cannot see it, and it is never sent to analytics or to the AI provider.
8. Who receives your data
We use the providers below as our processors. They act only on our instructions under data processing agreements. We may also disclose data where the law requires it, for example to a court or public authority.
| Provider | Role | Data | Location |
|---|---|---|---|
| Google Cloud | Storage of content, encryption keys (Cloud KMS) and backups; app hosting | Health content, account data | Netherlands (europe-west4) |
| Google Vertex AI (Gemini) | Generating AI replies | Content sent to AI | EU multi-region |
| Google Cloud Speech-to-Text | Turning dictation into text | Microphone audio | EU endpoint |
| Google Firebase Authentication | Sign-in | Email, sign-in identity | United States |
| PostHog (EU Cloud) | Analytics, interface experiments, masked replay; sending guides and news emails | Usage events, pseudonymous account ID; newsletter email address | Frankfurt, Germany |
| RevenueCat | Subscription management and customer portal | Subscription status, purchase history | United States |
| Stripe | Payment processing | Payment details, billing data | Ireland (Stripe Payments Europe); may transfer to the United States |
| Meta (Meta Platforms Ireland) | Measuring which Meta ads lead to sign-ups and subscriptions | Event type and time, ad click identifier; never your email, account ID, IP address or content | Ireland; may transfer to the United States |
| Google Ads (Google Ireland) | Measuring which Google ads lead to sign-ups and subscriptions | Event type and time, ad click identifier; never your email, account ID, IP address or content | Ireland; may transfer to the United States |
Stripe also acts as an independent controller for its own fraud-prevention and regulatory purposes. Its privacy policy is at stripe.com/privacy.
9. Where your data is stored and international transfers
Your health content, its encryption keys and backups are stored in Google Cloud in the Netherlands. AI and speech requests are processed in the EU. Analytics are hosted in Frankfurt. None of this content leaves the European Economic Area.
Some account and payment data is transferred outside the EEA: sign-in data held by Google Firebase Authentication and subscription records held by RevenueCat are stored in the United States, and Stripe, Meta and Google may transfer data there. For transfers to the United States we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask iod@pleso.me for a copy of the relevant safeguards.
If you live in the United Kingdom, transfers of your data from the UK rely on the UK adequacy regulations for the EEA and, for the United States, on the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum.
10. How long we keep your data
We keep data only as long as needed for the purpose it was collected for.
| Data | How long |
|---|---|
| Health content | Until you withdraw health-data storage consent or delete your account |
| Backups of health content | 7-day point-in-time recovery window and 14 daily backups; normally no backup copy remains after 15 days |
| Account data | Until you delete your account |
| Consent records | For the life of your account plus 3 years |
| Subscription, payment and invoice records | 5 years from the end of the calendar year in which the tax became due (Polish tax law) |
| Data exports you request | 24 hours |
| Analytics events | 24 months |
| Masked session replays | 30 days |
| Newsletter email address | Until you unsubscribe |
| Feedback | 90 days |
| Speech-session metadata | Removed by daily cleanup, normally within 48 hours |
| Operational logs | 30 days |
| Evidence of deletion requests | 90 days |
| Support and rights requests | 3 years after we close your request |
| Advertising click identifier in your browser | 30 days |
| Advertising event records | 30 days |
Expiry at a provider can take additional time after the period ends. If a backup is ever restored, recorded deletions are applied again before restored data becomes available.
11. Deleting your account
You can delete your account in Profile & settings > Privacy & data at any time. Deletion removes your account and its content from Gary's active systems, including your sign-in, and asks our providers to erase related data, including analytics. Gary shows you the status of the deletion until it is complete.
- Backups expire on the schedule in section 10.
- Records we must keep by law, such as invoices and consent records, are kept for the periods in section 10 and used only for that purpose.
- Your subscription is cancelled. Deleting your account automatically cancels renewal of your subscription.
12. Your rights and how to complain
You have the right to access your data and get a copy, correct it, have it erased, restrict its processing, receive it in a portable format, object to processing based on our legitimate interests, and withdraw any consent at any time.
- How: use Profile & settings > Privacy & data, where export, withdrawal and deletion are available, or write to iod@pleso.me.
- When: we reply within one month. For complex requests we may extend this by up to two more months and will tell you why.
- Complaints: you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. You can also complain to the authority where you live or work: in the UK, the Information Commissioner's Office (ico.org.uk); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua); in another EU country, its national data protection authority.
13. Security, age, emergencies and changes
Security. We encrypt data in transit and at rest, with keys held in Google Cloud Key Management Service in the Netherlands. Pleso’s staff tools have no access to your reflections, and access to our systems is limited to authorised staff. This is server-side encryption, not end-to-end encryption. If a breach is likely to put you at risk, we will notify you and the supervisory authority as the law requires.
Age. Gary is only for people aged 18 or over, and we ask you to confirm your age before you start. If you believe someone under 18 is using Gary, contact iod@pleso.me.
Emergencies. Gary is not an emergency or crisis service and nobody monitors your messages. If you or someone else is in immediate danger, call your local emergency number. Support lines for your country are listed at companion.pleso.me/support.
Changes. If we change this notice, we will update the date and version at the top. If a change affects a choice you made, Gary will ask you to decide again; your silence is never treated as consent.