Privacy Policy

1Introduction

Samōsya is a self-hosted artificial intelligence workspace and agent orchestration platform developed and published by gCapital Sp. z o.o.

This Privacy Policy explains how personal information and data obtained through third-party integrations, including Google APIs, may be accessed, processed, stored, transferred, retained, and deleted when using Samōsya.

We are committed to transparency, user control, data minimization, and protecting information entrusted to Samōsya.

This Policy applies to the official Samōsya websites, services operated by gCapital Sp. z o.o., and the Google integration functionality provided through the Samōsya application. Independently operated self-hosted deployments may have additional privacy arrangements established by their operators.

2Identity of the Publisher and Data Controller

Samōsya is developed and published by:

gCapital Sp. z o.o. acts as the data controller for personal information it processes for its own websites, services, and operational purposes.

Where Samōsya is deployed and administered independently by another individual or organization, that deployment operator may act as the controller of personal information processed within the deployment. The respective roles of gCapital and the deployment operator depend on the actual processing arrangements.

3What Samōsya Does

Samōsya enables users to organize projects, coordinate AI agents, work with files and documents, manage tasks, build knowledge resources, and connect external services.

Samōsya may integrate with Google Drive, Google Docs, Google Sheets, Google Slides, Google Calendar, and other Google services where supported by the installed version of the application.

Google integrations are optional. Users must explicitly authorize the relevant access through Google's OAuth authorization process.

Samōsya does not require access to unrelated Google services merely because a user connects one Google service.

4Categories of Personal Data

Depending on the functionality used and the configuration of the relevant deployment, Samōsya may process the following categories of information.

4.1 Account and Identity Information

This may include names, email addresses, account identifiers, profile information, and authentication-related metadata.

4.2 Workspace and Project Information

This may include project descriptions, tasks, documents, conversations, instructions, knowledge resources, execution results, and other content provided or generated within the workspace.

4.3 Integration and Authorization Information

This may include connected account identifiers, granted authorization scopes, OAuth access tokens, refresh tokens, token expiration metadata, and integration configuration.

4.4 Technical and Security Information

This may include application logs, execution records, security events, error information, and technical metadata necessary for operation, troubleshooting, and security.

4.5 Google User Data

Where expressly authorized, Samōsya may access data made available by Google APIs within the permissions granted by the user.

The specific data accessed depends on the enabled integration, requested task, and authorized OAuth scopes.

5Google API Data Access

Samōsya uses Google's OAuth 2.0 authorization framework to request permission to access supported Google services.

Users authenticate through Google's authorization interface and can review the permissions requested before granting access.

5.1 Google Drive

Depending on granted permissions, Samōsya may access selected files, folders, document content, and file metadata.

This information may be used to locate, read, create, organize, or update files as part of user-authorized workflows.

5.2 Google Docs

Samōsya may read, create, or modify Google Docs documents where the user has granted the required permissions.

This may include retrieving document content for analysis, generating document drafts, and applying user-authorized changes.

5.3 Google Sheets

Samōsya may access spreadsheet content and metadata within the granted authorization scope.

This may support reading spreadsheet data, performing analysis, and creating or modifying spreadsheets in response to authorized tasks.

5.4 Google Slides

Samōsya may access presentation content and metadata within the granted authorization scope.

This may support preparing, reading, or modifying presentations in response to authorized tasks.

5.5 Google Calendar

Samōsya may access calendar lists, event information, scheduling details, and other calendar data permitted by the granted authorization scopes.

This may support retrieving events, analyzing schedules, creating meetings, or modifying calendar entries as authorized by the user.

5.6 Additional Google Services

Additional integrations may be introduced in future versions.

Samōsya will request the relevant permissions and provide appropriate disclosures before accessing additional categories of Google user data.

Samōsya does not request access to Google user data solely for speculative future functionality.

6How Google User Data Is Used

Information obtained through Google APIs is used to deliver user-facing features that the user has enabled or authorized.

Permitted purposes include:

• Retrieving requested information from connected Google services.
• Reading and analyzing documents, spreadsheets, presentations, and calendar information.
• Creating or updating content in response to authorized user instructions.
• Providing relevant task context to AI agents.
• Coordinating user-authorized workflows across connected services.
• Maintaining connection state and necessary operational or security records.

Samōsya does not use Google user data for targeted advertising, advertising profiling, determining creditworthiness, or selling information to third parties.

Samōsya does not access Google user data for unrelated purposes without appropriate disclosure and authorization.

7AI Agents and External Model Providers

Samōsya supports AI-assisted workflows using models selected or configured by users or deployment administrators.

Depending on the configuration, AI processing may occur locally or through external AI model providers.

When an authorized workflow requires information obtained through Google APIs, relevant portions of that information may be included in requests sent to the selected AI model provider.

Such information may include document content, file metadata, spreadsheet data, calendar details, or other information necessary for the requested task.

The categories and volume of information transmitted depend on the task, model configuration, available tools, and granted permissions.

External AI providers may process transmitted information according to their applicable agreements and privacy practices, subject to Google API Services User Data Policy restrictions.

Google user data must not be used to develop, improve, or train generalized AI or machine-learning models where prohibited by Google's applicable Limited Use requirements.

Samōsya does not sell Google user data to AI model providers.

Users and deployment administrators should review the data-handling conditions of external providers before enabling them.

8Google API Services User Data Policy and Limited Use

Samōsya's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Google user data obtained through applicable sensitive or restricted scopes is used only to provide or improve user-facing features of Samōsya that are visible and relevant to users.

Transfers of such data are limited to those permitted by Google's policies, including transfers necessary to provide authorized functionality with user consent, maintain security, comply with applicable law, or other expressly permitted circumstances.

Samōsya does not transfer Google user data to advertising networks, data brokers, or information resellers.

Human access to Google user data is restricted to circumstances permitted by Google's Limited Use requirements, including specific user authorization, legitimate security needs, or legal obligations.

These restrictions also apply to employees, contractors, service providers, and other parties acting on behalf of the publisher.

9Legal Bases for Processing

Where the General Data Protection Regulation (GDPR) applies, personal data may be processed on the following legal bases, as appropriate to the specific processing activity:

• Article 6(1)(b): Processing necessary to provide services requested by the data subject or perform a contract.
• Article 6(1)(a): Consent, where consent is the appropriate legal basis.
• Article 6(1)(f): Legitimate interests, including maintaining service security, preventing abuse, and operating the service, subject to applicable balancing requirements.
• Article 6(1)(c): Compliance with applicable legal obligations.

OAuth authorization is a technical authorization to access Google services and does not, by itself, establish GDPR consent as the legal basis for every related processing activity.

The applicable legal basis depends on the particular service, processing purpose, and relationship between the user, deployment operator, and publisher.

10Self-Hosted Storage and Data Location

Samōsya is designed to support self-hosted deployments.

In such deployments, project data, integration records, documents, and other information may be stored within infrastructure selected by the deployment operator.

The location and configuration of this infrastructure are determined by the relevant deployment arrangements.

Self-hosting does not necessarily mean that all information remains within the deployment. External integrations, model providers, and supporting services may receive information where configured and necessary for authorized functionality.

gCapital Sp. z o.o. does not automatically obtain access to all information stored within independently operated Samōsya deployments.

11Security of Personal Data

Samōsya is designed to support controlled access to connected services and user information.

Appropriate technical and organizational measures must be applied to protect information against unauthorized access, disclosure, alteration, or loss.

Depending on the deployment, such measures may include:

• Encrypted communication channels.
• Restricted access to integration credentials.
• Credential storage protections.
• User and project permissions.
• Authorization controls for agent actions.
• Security logging and monitoring.
• Backup and recovery procedures.

The deployment operator is responsible for configuring and maintaining the security of its infrastructure.

No information system can guarantee absolute protection against all security risks.

12Data Sharing and Third-Party Recipients

Personal data may be disclosed or transferred only where there is an appropriate purpose and legal basis.

Potential recipients include:

• Google, when executing authorized Google API operations.
• External AI model providers selected for authorized processing.
• Infrastructure and technical service providers necessary for operating the relevant service.
• Authorized deployment administrators and users, within applicable permissions.
• Public authorities where disclosure is legally required.

Google user data is not sold.

Google user data is not disclosed for advertising, unrelated commercial profiling, or other prohibited purposes.

Where third parties act as processors, appropriate contractual and security arrangements must be established when legally required.

13International Transfers

Samōsya may be used in different countries and may connect to service providers operating internationally.

Personal data may therefore be processed outside the country in which the user resides, depending on deployment and provider configuration.

Where GDPR applies and a transfer of personal data outside the European Economic Area requires safeguards, appropriate transfer mechanisms must be used, such as applicable adequacy decisions or Standard Contractual Clauses.

The deployment operator is responsible for assessing transfers arising from independently selected infrastructure and services.

14Data Retention

Personal data is retained only for as long as reasonably necessary for the applicable processing purpose, subject to legal requirements and the relevant deployment's retention configuration.

Google user data may be temporarily processed or stored as part of authorized tasks, project records, generated outputs, or operational histories.

OAuth credentials may be retained while a connection remains active and may be deleted or invalidated when the connection is removed, subject to the implementation and applicable retention requirements.

Information incorporated into documents, task outputs, execution histories, or backups may require separate deletion procedures.

Retention periods and deletion mechanisms may differ between independently operated deployments.

15Disconnecting Google Services

Users may revoke Samōsya's access to their Google Account at any time through Google's third-party connections interface: myaccount.google.com/connections.

Where supported by the installed application version, users may also disconnect integrations directly within Samōsya.

Revoking Google authorization prevents continued access through the revoked authorization but does not automatically delete information previously stored or incorporated into user-created content.

Users may request deletion of applicable information from the operator responsible for the relevant deployment.

16Data Deletion Requests

Users may request access to, correction of, or deletion of personal information where applicable law provides such rights.

For personal information processed by gCapital Sp. z o.o. as controller, requests may be directed to dawid@gcapital.pl.

For independently operated deployments, requests concerning data held within the deployment should be addressed to the relevant deployment operator.

Deletion may be subject to lawful retention obligations, technical backup cycles, and other legally permitted limitations.

17Rights Under the GDPR

Where the GDPR applies, individuals may have the right to:

• Obtain information about the processing of their personal data.
• Access their personal data.
• Request correction of inaccurate data.
• Request erasure of personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive portable personal data where applicable.
• Withdraw consent where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.

Individuals may also lodge a complaint with a competent supervisory authority.

In Poland, the relevant authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

18Children's Privacy

Samōsya is designed primarily for professional, technical, and organizational use.

It is not intended to be directed to children.

Where use by minors is permitted, the relevant deployment operator must ensure compliance with applicable age, consent, and data protection requirements.

19Cookies and Website Technologies

The official Samōsya websites may use technologies necessary for website operation, security, and user preferences.

Where optional analytics or other non-essential tracking technologies are introduced, appropriate information and consent mechanisms will be provided as required by applicable law.

The specific technologies used may differ between the official websites and independently operated deployments.

20Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in Samōsya, its integrations, applicable law, or data processing practices.

The current version will be made available at https://samosya.com/privacy.

Where a material change introduces a new purpose for using Google user data, appropriate notice and any required user authorization or consent will be obtained before the new processing begins.

21Contact

For privacy questions, data protection requests, or concerns regarding Google integrations, contact: