Gomi Privacy Policy

Technical version effective November 3, 2026.

1. What Gomi is and how we protect your business

Gomi is an operating system built for One-Person Companies (OPCs). Our foundational commitment is privacy by isolation: your company data, clients, tasks, and business memory reside within strictly isolated tenant boundaries. Your information is never mixed with other organizations or exposed to competitors.

2. Data we process

To establish and run your digital office, we process:

• Account data: Name, email address, verification status, role, and operational preferences.
• Company data: Business name, objectives, departments, team members, and business context placed in your Inbox or Memory.
• Operational records: Tasks, instructions given to Gomis, drafts, approved artifacts, and usage metrics. Payments are securely processed via Stripe; Gomi never stores full card numbers.
• Site usage measurement: Which screens are opened, for how long, which main buttons you tap and how far you scroll on the home and pricing pages, when your office takes its first steps (confirming your business details, saving your business profile and catalog, your first request, and your first accepted result), the device type, which site or link brought you, and your approximate location (country, state, and city). We use a random identifier stored in your browser, with no cookies or third-party services; our server keeps it only as an irreversible hash. Your IP address is used only at that moment to estimate location, with the DB-IP database (CC BY 4.0) hosted on our own server, and it is not stored; nor is anything you type. These records are kept to understand how the service is used; those linked to your account are deleted if you delete it. If your browser sends Do Not Track or Global Privacy Control, nothing is measured.
• Invoicing your customers (CFDI): If you invoice from Gomi, you are the issuer of each invoice. To stamp them, Gomi transmits to Facturapi, a service that stamps through a certification provider authorized by Mexico's SAT, your tax details (RFC, name or business name, tax regime, and postal code), your customers' tax details, and your digital seal certificate (CSD: the .cer and .key files and their password). Gomi does not store your CSD or its password: they go to Facturapi at the moment you upload them. Gomi keeps your tax details, the date you uploaded your seal and its expiry, and the access keys of your Facturapi organization, encrypted. We never ask for your e.firma: you sign the letter that authorizes stamping directly with Facturapi.
• Customer chat for a business: If you write to a business through its Gomi chat link, your messages are stored in that business's office and only that business sees them; the business decides what to do with them. We do not ask for an account, name, or phone number; if you give them so the business can contact you, they stay in that conversation. A technical cookie, limited to that page, lets you see your conversation when you return; it is not used for measurement or advertising. The one replying is the business's office, an artificial intelligence system that uses only what the business authorized it to say (its catalog, hours, and public details); for that, the recent conversation is sent to the AI provider, which does not keep it for training. If the office does not know something or you want to buy, a person from the business continues the conversation in the same chat; if you ask whether you are talking to a person, it will tell you the truth.

3. Human oversight, auditability, and AI usage

Gomi integrates deterministic utilities with artificial intelligence models to coordinate your digital specialists (El Gerente, Distribution, Construction, and Operations):

• Deterministic first: Utilities such as list filtering, formatting, and calculations execute locally in the browser or on secure servers without calling external language models.
• Language models: When a mission requires reasoning or drafting, only the minimum context strictly necessary is transmitted to vetted providers (such as Groq, OpenAI, or OpenRouter) over encrypted channels.
• Audit trail: To preserve your business continuity and organizational memory, Gomi privately retains operational logs, including the full text of questions, instructions, and answers. Operational data is protected to improve or train Gomi systems and proprietary models without compromising confidentiality or selling data.

4. Data ownership and confidentiality

All documents, contacts, facts, and artifacts generated within your workspace remain your exclusive property. We do not sell personal or business data. Your proprietary business context is never used to train external public models.

5. Retention, export, and deletion

You maintain full control over your business assets. You can export your office data in standard readable formats from Settings at any time, or request complete account deletion, triggering the permanent and irreversible removal of your private operational records.

6. Data controller and your rights

The provider's details are published when sales open. To process payments, Stripe receives your card details directly; Gomi only stores your Stripe customer and subscription identifiers.

You may request access to, correction or deletion of your data, object to its use (ARCO rights under Mexican law), or withdraw your consent by writing to our support email, published when sales open, from your account email. We reply within 20 business days.