Privacy Policy

Last updated October 6, 2026

Who we are

GaiaOS is a CRM and GTM operating system operated by Vessel Investment Group, LLC (“Vessel,” “we,” “us”). Our platform is available at leangaia.com and its subdomains.

What data we collect

When you use GaiaOS, we collect the information you provide directly: your name, email address, and any CRM data you enter (contacts, organizations, deals, notes, and activities). We also collect standard usage data such as pages visited, features used, and session information through PostHog analytics.

Google Workspace integration

GaiaOS offers an optional Google Workspace integration that, with your explicit consent, accesses the following Google user data:

• Gmail (read) — We read email message metadata (sender, recipients, subject, date) and message content to display email activity on matching CRM contacts, organizations, and deals. We do not modify or delete any emails. Scope: gmail.readonly.
• Gmail (send) — If you turn on sequence sending for your connected account, we send the sequence emails you or your team configure from your mailbox to CRM contacts enrolled in that sequence. Sending is off until you enable it and can be turned off at any time. Scope: gmail.send.
• Google Calendar — We read calendar events (title, time, attendees, description) and your free/busy availability, and can create events on your behalf when a meeting is booked through GaiaOS scheduling. Meeting data is displayed as activity on matching CRM records. Scopes: calendar.readonly, calendar.events.
• Profile information — We read your Google email address and display name to identify your connected account. Scopes: userinfo.email, userinfo.profile.

Google data is accessed only after you explicitly authorize the connection. On initial connection, we sync up to the past 90 days of email and calendar activity. After that, we sync new activity periodically and recover activity missed during an outage. You can disconnect your Google account at any time from Settings > Integrations, which immediately deletes the stored Google authorization so we can no longer access your account. You can also remove GaiaOS from the third-party access page of your Google Account.

How we store and protect your data

CRM data is stored in a Supabase-hosted PostgreSQL database with row-level security enforcing tenant isolation. Each customer workspace is fully isolated — users in one workspace cannot access data from another.

Google OAuth tokens (access tokens and refresh tokens) are held by Nango, our OAuth broker, which stores them encrypted and calls Google on our behalf. GaiaOS never stores raw Google tokens; our database holds only an opaque connection identifier and connection status. Google API calls are logged to an audit trail.

All data is transmitted over HTTPS. The application is hosted on Vercel with TLS termination at the edge.

How we use your data

We use your data solely to provide the GaiaOS CRM service: displaying contact and deal information, surfacing email and meeting activity on relevant records, and powering AI-assisted features like enrichment and daily briefs. We use PostHog for product analytics to understand feature usage and improve the product.

GaiaOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to provide and improve the user-facing features described above. We do not use it for advertising, we do not sell it, and we do not use it to train or improve generalized AI or machine learning models. Google-derived activity may be processed by our AI model provider only to generate features you use, such as summaries and daily briefs. People at GaiaOS do not read your Google data unless you ask us to, it is needed for security, or the law requires it.

Third-party sharing

We do not sell your data. We share data only with the infrastructure providers necessary to operate the service: Supabase (database), Vercel (hosting), Nango (Google OAuth and API access), PostHog (analytics), and Resend (transactional email). We share data with our AI model provider (Anthropic) to power agent and summary features. This can include CRM activity derived from Google data, which is processed only to provide those features and is not used to train models.

Data retention and deletion

We retain your CRM data for as long as your workspace is active. Synced Google data (email and calendar activity entries) is stored as CRM activity records and follows the same retention policy. If you disconnect your Google account, the connection and its stored Google authorization are deleted. Activity records previously synced from Google remain in your CRM unless you delete them.

To request deletion of your account or workspace data, contact us at the address below.

Your rights

You can disconnect your Google account at any time from Settings > Integrations. You can export your CRM data or request account deletion by contacting us. If you are located in the EU, California, or another jurisdiction with data protection laws, you may have additional rights including access, correction, and erasure — contact us to exercise them.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the application or email. Continued use after changes constitutes acceptance.

Contact

For privacy inquiries or data requests, email privacy@leangaia.com.

Vessel Investment Group, LLC
Columbus, Ohio