1Data Controller

Company

Gammatica Kft.

Registered office

1123 Budapest, Nagyenyed utca 5., basement level, Hungary

Postal address

1123 Budapest, Nagyenyed utca 5., basement level, Hungary

Company reg. no.

01-09-434270

Court of registration

Budapest-Capital Regional Court

Tax number

32628186-2-43

EU VAT number

HU32628186

Represented by

Viktor Dániel Várhegyi, Managing Director

Email

help@gammatica.com updated 2.1

2Data Processing During the Use of the Software

2.1Contact by Email

Purpose

To communicate with the User and reply to information sent by email.

Legal basis

The User’s prior, informed and voluntary consent (Article 6(1)(a) GDPR).

Data processed

Email address, other personal data provided by the User (typically name).

Retention

3 months from the date of the last communication.

Access

Employees or agents responsible for contact and enquiries.

2.2Registration and User Account Management

By clicking “Registration”, the User declares that they have read the Terms of Service and this Privacy Policy, understand their contents, and accept the terms of data processing.

Purpose

Registration, granting access, and sending reports.

Legal basis

Performance of a contract (Article 6(1)(b) GDPR).

Registration data

First name, last name, email address.

Account data

First name, last name, password, email, language. Optionally: position, profile picture.

Retention

5 years after the termination of the contract.

After registration, Users can log in via email/password or Google Account. Organisation heads can invite team members by email.

Users may upload various content (client data, comments, ratings, calendar links). Gammatica provides the platform and data security but excludes responsibility for user-uploaded content.

2.3Billing

Purpose

Billing for services used.

Legal basis

Legal obligation (Article 6(1)(c) GDPR; Act C of 2000 on Accounting; Act CL of 2017 on Taxation).

Data processed

Name/company name, billing address, tax number, bank account number (if applicable).

Retention

8 years after the relevant financial year.

2.4Artificial Intelligence (AI) Features

Gammatica uses AI features to enhance the user experience:

• AI-powered chatbot (lead qualification, customer support)
• Automated text generation and content suggestions
• AI-assisted CRM features (lead scoring, notifications, workflow automation)
• Summary and report generation
• AI-powered email reply (analysing incoming emails and generating reply suggestions)
• AI Meeting Notetaker — transcription and summary of video meetings, described in detail in Section 5.2 new in 2.1

Purpose

Operating AI features to provide intelligent responses, suggestions, and automations based on User-provided data.

Legal basis

Performance of a contract (Article 6(1)(b) GDPR) — AI features are integral to the Software; and legitimate interest (Article 6(1)(f) GDPR) for service quality improvement.

Data processed

Text data entered into chat, CRM, and other fields; client data (name, email, phone, company); incoming and outgoing email content (when using AI email reply); behavioural data (interactions, clicks); uploaded document content insofar as processed by AI.

Retention

OpenRouter is configured with prompt/response logging disabled, so it does not retain prompt or response content, and requests are not routed to providers that use the data to train AI models. AI model providers may process the data only to deliver the requested feature and may retain it transiently under their own terms (for example to prevent abuse), but do not use it to train generalised AI/ML models. AI-generated content stored in the CRM is retained until the User’s account is deleted.

2.5Third-Party Integrations

Gammatica integrates with the following third-party services, activated only with the User’s explicit permission:

Legal basis

Performance of a contract (Article 6(1)(b) GDPR). Integrations only operate after the User’s activation and OAuth consent.

Retention

Until the integration is deactivated or the User’s account is deleted. Third-party providers’ own retention policies also apply.

2.6Automated Decision-Making and Profiling

In accordance with Article 22 of the GDPR, the Controller informs Users that Gammatica performs the following automated processing activities:

Data Subject’s right: The User may at any time request human intervention, express their view, and contest an automated decision by contacting help@gammatica.com. updated 2.1

3Recipients, Data Transfers, Data Processors

Users’ personal data may be transferred or made available to:

3.1AI Service Data Processors

Gammatica’s AI features operate through OpenRouter, Inc., which routes requests to AI model providers.

Sub-processors: Anthropic (Claude), OpenAI, Google (Gemini), Meta (Llama). Current list: openrouter.ai/docs/guides/privacy/logging

4Data Transfers to Third Countries (Outside the EEA)

Personal data may be transferred outside the European Economic Area (EEA) with the following safeguards:

Data Subject’s right: A copy of the safeguards can be requested at help@gammatica.com. updated 2.1

5Cookies and Web Tracking

The gammatica.com website uses the following cookies and tracking technologies:

PostHog EU Cloud: Analytics data is stored within the EU in Frankfurt (AWS eu-central-1). IP address capture is disabled by default.

Managing cookies: Users can accept or reject non-essential cookies via the cookie banner on first visit. Settings can be changed at any time.

5.1.1Data Protection Mechanisms for Google User Data

Gammatica implements the following technical and organizational measures to protect Google user data accessed through Google Workspace APIs. These measures are in addition to the general data security measures described elsewhere in this Privacy Policy:

Encryption: All data transmitted between Gammatica and Google services is encrypted using TLS 1.2 or higher (HTTPS). Google OAuth tokens and refresh tokens are encrypted at rest using AES-256 encryption and are stored separately from other application data.

Access Control: Access to Google user data within the Gammatica platform is governed by role-based access control (RBAC). Only authenticated and authorized users within a workspace can access data obtained through Google integrations. Internal staff access to production systems containing Google user data is restricted to essential personnel only and is logged.

Token Security: Google OAuth access tokens and refresh tokens are never:

• logged in application logs or error reports;
• displayed in user interfaces;
• transmitted to third parties;
• stored in client-side code or browser storage.

Tokens are stored server-side in encrypted form and are automatically revoked when the user disconnects the Google integration from their Gammatica account.

Data Isolation: Each workspace’s Google integration data is logically isolated. Users in one workspace cannot access Google data belonging to another workspace.

Monitoring and Incident Response: Gammatica maintains system monitoring to detect unauthorized access attempts to Google user data. In the event of a data breach involving Google user data, Gammatica will notify affected users and Google within 72 hours in accordance with GDPR Article 33.

Data Minimization: Gammatica requests only the minimum OAuth scopes necessary for functionality — the four scopes listed in Section 5.1 and no others. Gammatica does not request or store full Gmail mailbox access beyond what is necessary for the features activated by the user. Calendar write access is used solely to create and delete the events generated by your own Gammatica booking page; no other events are modified or deleted. updated 2.1

Data Retention and Deletion: Google OAuth tokens are retained only while the user’s Google integration is active. When a user disconnects their Google account or deletes their Gammatica workspace, all associated Google tokens and cached Google data are permanently and immediately deleted from Gammatica’s systems.

Regular Security Reviews: Gammatica conducts periodic security reviews of its integration with Google APIs to ensure continued compliance with the Google API Services User Data Policy and applicable data protection regulations.

5.1.2Google API Services Limited Use Disclosure

Gammatica’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Gammatica will only use access to Google user data to provide and improve user-facing features that are prominent in the application’s user interface.
• Gammatica will not transfer Google user data to third parties unless necessary to provide or improve user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior user notice.
• Gammatica will not use Google user data for serving advertisements.
• Gammatica will not allow humans to read Google user data unless the user has provided affirmative consent, it is necessary for security purposes, to comply with applicable law, or the data is aggregated and anonymized for internal operations.

6Data Subject’s Rights

6.1Right of Access

Data Subjects may request information on whether their data is processed, what data, on what basis, for what purpose, for how long, and whether automated decision-making applies. The first copy is free.

6.2Right to Rectification

The Data Subject may request rectification of inaccurate data. The Controller shall comply within one month.

6.3Right to Restriction of Processing

The Data Subject may request restriction where: accuracy is contested; processing is unlawful; the Controller no longer needs the data; or the Data Subject has objected.

6.4Right to Object

The Data Subject may object to processing if they consider the Controller is handling data inappropriately.

6.5Right to Erasure (“Right to Be Forgotten”)

The Data Subject may request erasure where: consent is withdrawn; the purpose has ceased; processing is unlawful.

6.6Right to Data Portability

The Data Subject may request their data in a structured, machine-readable format where processing is consent-based and automated.

6.7Right to Legal Remedy

If you believe your rights have been infringed, contact us at help@gammatica.com. updated 2.1

If your complaint cannot be resolved, you may lodge a complaint with:

Authority

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

Address

1055 Budapest, Falk Miksa utca 9–11, Hungary

Postal address

1363 Budapest, Pf.: 9.

Phone

+36 (1) 391-1400

Email

ugyfelszolgalat@naih.hu

The Data Subject may also seek judicial remedy before the court of their habitual residence or domicile.