Privacy policy

Who we are

Gorila is operated by Malavar Solutions S.L., Calle Blasco de Garay, 1, 28015 Madrid, Spain (tax ID B22816920). Questions and requests about your data: hola@malavar.com. We have not appointed a data protection officer, as the law does not require one for us; that address reaches the people responsible for your data.

For your account, the waitlist, support, security logs and aggregate usage counts we are the controller. For what your organization puts in Gorila (tasks, knowledge, members, and the activity records its admins see) your organization is the controller and we are its processor, under our Data Processing Agreement.

What we store

Your account

• Your email, and your name and avatar if you sign in with Google. You sign in with Google or with a one-time code we email you; Gorila has no passwords.
• Which organizations you belong to and your role in each.
• Personal access tokens, stored only as a hash. We show a token once, when you create it.

Your organization’s content

• Tasks and projects: title, context written for the assignee’s AI, status, dates, comments and their history.
• Knowledge: distilled entries (tone, rules, processes, decisions), their versions, the proposals that changed them and who approved them. Sources are kept as pointers (for example a Notion page URL), never as copies.
• Onboarding progress, so a setup can be resumed. What onboarding finds about you from your own chats or interview stays private to you until you choose to share it.
• Agents your organization adds, and the webhook URL an agent registers.

Search

So that search finds an entry or a similar task by its meaning and not only by its words, Gorila sends a short text to an embedding model, Cohere Embed v4 on Amazon Bedrock in the EU (Ireland), which turns it into a list of numbers (a vector). The text is: for a knowledge entry, its title, summary, trigger phrases and the first 1,000 characters of its body; for an open task, its title only; and the question your AI is searching with. Private entries and private tasks are included. The model only computes the vector: Amazon does not store the text, does not log it and does not train on it. The vectors are stored in our database next to the item, and only the people who can see the item can read them.

Usage metrics

Each action records an event: which tool or page action was used, which AI client sent it (for example “Claude Code” and the browser or client user agent), whether it worked, how long it took and counts (such as how many knowledge entries were returned). Events never contain the text of your tasks, knowledge, prompts or files. They show your admins the activity in your organization, on its behalf. We also count them across organizations — totals, never content or who did what — to run and improve Gorila.

Product analytics and error reports

We use PostHog (EU Cloud) to see how gorila.la and the app are used and to find errors. On gorila.la it records page views and clicks, the site or link that sent you and, if you accept its cookie, the country your visit comes from (worked out from your IP address, which is then discarded and never stored) and whether you have visited before. It never knows who you are. If you reject the cookie, it counts your visit without one. In the app it records which pages you open (the address without search terms or filters), tied to your user and organization ids, never your name or email. When something breaks, the error report holds the error, the page or tool and those ids. Neither ever contains the text of your tasks, knowledge, prompts or files, and there is no session recording. Alerts about errors reach our team in our Slack workspace (Slack Technologies), with the error and where it happened.

Early access list

If you join the waitlist on gorila.la we store your email and where you signed up, to contact you about access. We send you one email confirming it, and our team is told in our Slack workspace (Slack Technologies, your email and where you signed up). Ask us and we remove it.

Getting help

If you write to us from Help in the app, we store your message, your email, your organization and the page you were on, so we can reply by email. Our team is told in our Slack workspace (Slack Technologies), with that same information, so a copy is stored in the United States. If your AI reports a problem for you, the same applies: we store what it sends, with your email and organization and the name of your AI tool, and our team sees it in Slack. We reply from our mailbox, hosted by Google. Keep sensitive details out of your message.

If you choose WhatsApp, we write the first message for you, with nothing about your account in it. Opening the link passes that text to WhatsApp (Meta). The message only reaches us if you send it, and then we see your phone number. For that chat WhatsApp Ireland Limited acts as our processor under its business terms; your own WhatsApp account is under the terms you agreed with WhatsApp.

Technical logs

Our hosting provider keeps short-lived request logs (IP address, user agent, URL, status) for security and debugging. To detect failures we send a copy of the app’s logs to PostHog, without IP address, user agent, search terms or filters. Every entry carries the same id, so the copy doesn’t tell visitors apart. It holds the page or endpoint requested, the status and any technical message. Entries from before November 6, 2026 can still hold the full address and an id derived from IP address, host and user agent, until they are deleted.

Why (legal bases)

• Contract (GDPR art. 6.1.b): to provide the service you or your organization signed up for — your account, your organization’s content, access tokens — and to answer you when you ask for help.
• Steps you asked for before a contract (art. 6.1.b): contacting you about access when you join the waitlist.
• Consent (art. 6.1.a): the analytics cookie on gorila.la, only if you accept it. You can change your mind at any time from “Cookies” at the bottom of every page.
• Legitimate interest (art. 6.1.f): aggregate usage counts without content, product analytics without cookies and error reports, security logs and preventing abuse (rate limits).
• Legal obligation (art. 6.1.c): records we must keep, such as invoices once billing exists.

We do not sell data, show ads, use your content to train any AI model, or send the content of your pages to any analytics provider.

You need an account (your email, and your name if you sign in with Google) to use Gorila; without it we cannot give you access. We make no decisions about you by automated means alone and do no profiling.

Where it lives and who processes it

Data is stored in the EU (Ireland) and the app runs in the EU (Dublin). The exception is our Slack workspace, in the United States, which receives Help messages, waitlist notices and error alerts. These providers process it for us:

If you write to us on WhatsApp, WhatsApp and other Meta companies process that chat, also in the United States, under the EU-US Data Privacy Framework.

Your AI client (Claude, ChatGPT, Codex, Cursor or your own agent) talks to Gorila on your behalf. What it does with what Gorila returns is governed by your agreement with that provider, not this policy.

How long we keep it

• Your organization’s content and its events: until an owner deletes the organization, which removes everything in it at once.
• Your account: until you ask us to delete it. Leaving an organization removes your membership; what you wrote for the team stays with the team.
• Waitlist: until we give you access or you ask us to remove your email.
• Help messages: until your organization is deleted or you ask us to delete them. Deleting the organization doesn’t remove the copy in Slack. Slack deletes it after a year, or sooner if you ask us. A WhatsApp chat stays in our WhatsApp account until you ask us to delete it.
• Technical logs: deleted by our hosting provider within 30 days.
• App analytics, error reports and the copy of logs in PostHog: kept for 12 months and deleted at PostHog’s next monthly cleanup, so within 13 months.
• Backups: deleted data disappears from our database provider’s backups within 7 days.

Your rights

You can access, correct, export, delete or restrict the processing of your personal data, object to processing based on legitimate interest, and take your data elsewhere.

• Export: any member can download everything they can see in Gorila (Settings → Export), as JSON plus Markdown.
• Delete: an owner can delete the whole organization (Settings → Organization). For your own account, write to hola@malavar.com.
• Correct: ask your AI to update a task or propose a knowledge change, or ask your admins.

If the data is your organization’s content, we pass your request to your organization, as its processor. We answer within one month. You can also complain to the Agencia Española de Protección de Datos (AEPD).

Security

Every table is isolated per organization in the database itself (row-level security); private items are enforced there too, not only in our code. Connections are encrypted, tokens are hashed, secrets live only in our hosting provider’s encrypted settings, and every knowledge change keeps an audit trail.

Cookies

In the app we only use the cookies needed to keep you signed in. They expire when your session does, and the app’s analytics stores nothing on your device: identity lives only in the open page.

On gorila.la we ask first. If you accept, PostHog keeps a random visitor id in a cookie and in your browser’s storage on gorila.la (for up to a year) so we can see how visitors find and use the site and whether they come back. If you reject it, PostHog counts your visit without a cookie, with a daily hash computed on its servers. Either way your browser keeps your choice, and “Cookies” at the bottom of the page lets you change it. We use no advertising or third-party cookies.

Changes

We will post changes here and update the date above. If a change affects your organization’s data, we tell its owners first.