Gouzi Privacy Policy

No company form is required to download. When creating a team in the App, you consent to sending company/team name, contact name, role, primary business, contact method and value, team size and consent record to the Gouzi operator’s inbox, encrypted, for activation and support.

Covers the Gouzi macOS app, gouzi.me, the standalone sign-in page, accounts, teams and online services. Team representatives must have authority and give required member notices. Users and teams are responsible for their content. Local-first does not mean every feature is offline.

We process email, verification records, account/session identifiers, consent records, and device identifiers, IP addresses or digests, timestamps, failure counts and versions for security. Team data includes submitted names, contacts, roles, seats, devices and service status. Legacy account credentials and submitted support messages may remain. The verification database stores keyed code digests, not usable plaintext codes; the mail provider necessarily receives the code in the message.

Code expiry is not record deletion. Subsequent requests batch-delete challenges older than 48 hours; low traffic and backups may retain them longer. Account/team records remain as needed for service, security and legal duties. Resend standard-plan email/log retention is generally 30 days, subject to the actual plan and current policy. Local deletion does not erase team, shared or provider copies.

Unless you choose cloud AI, sharing, team transfer, or backup, projects, images, text, video, audio, candidates, private intelligence, and semantic indexes are not uploaded. On-device indexing may analyze names and metadata, OCR, image content, video frames and subtitles, audio transcripts, descriptions, color, and mood. You can pause, rebuild, or delete it.

My Assets aggregates local assets from projects you open or allow access to, and files you add. Files, sources, thumbnails, favorites and indexes live outside the app bundle, consume disk and processing memory, and are not a cloud backup. Projects retain their own assets; aggregation does not share them with a team. Team sharing has separate access controls. Removing a project, a listing, library copies and backups are different actions; uninstalling the app does not necessarily remove them.

When you start a cloud task, only the required prompt, selected assets, settings, and context go to your chosen provider. The provider may process and retain data in other regions; cancelling in the interface may not instantly delete a received request. Gouzi does not send the entire project, index, or API key as task content.

The local-network gateway authenticates members and uses administrator-approved models without distributing keys. Eligible learning events and selected assets may be encrypted to the administrator's Mac for search, backup, and management. The organization generally determines this processing and is responsible for lawful basis, notice, access, retention, and member requests.

Server data supports accounts and security, trials and licenses, device and seat management, requests, sharing, updates, abuse prevention, diagnosis, contracts, and legal duties. Depending on law, the basis is consent, contract, legal obligation, or a balanced security interest. We do not train a general Gouzi model on projects without a clear, withdrawable choice and required authorization.

Necessary recipients may include infrastructure processors, your chosen model provider, your team administrator, and lawful authorities. We do not sell personal information, share it for cross-context behavioral advertising, or build advertising profiles from projects. Creative-assistance AI does not by itself make decisions with legal or similarly significant effects.

Resend (Plus Five Five, Inc.) sends verification mail from verify@auth.gouzi.me. It receives the recipient, message including the code, delivery metadata and relevant anti-abuse records, not project attachments. The sending region is Tokyo, not a promise of Japan-only processing. Policies: https://resend.com/legal/privacy-policy and https://resend.com/legal/dpa. Verification is not consent to marketing.

Account, trial, licensing, and security services may currently enter through Hong Kong and be processed in Singapore. Model data may go to a provider's published regions. We will use required contracts, assessments, certifications, recipient details, rights channels, and separate consent. If a mandatory regional notice is not presented, do not submit the data and contact us.

Local data remains until you delete it. Server data is kept only for the shortest period needed for accounts, services, security, disputes, contracts, and law, then deleted or anonymized.

In addition to Hong Kong access and Singapore services, email involves Resend and overseas subprocessors. Model recipients depend on your configuration. Where required, recipient identities, locations, contacts, rights channels, safeguards and separate transfer consent must be provided; accepting this policy does not replace those steps.

Controls include encryption in transit, access control, rate limits, least privilege, macOS Keychain, team certificates, and encrypted recovery packages. No system is perfectly secure. Qualifying incidents will be assessed, contained, and notified as required by law. Keep an offline recovery key separate from its backup.

Depending on your location, you may request notice, access, copy or portability, correction, completion, deletion, restriction or cessation, withdrawal, account closure, objection, complaint, and overseas-recipient information. Delete local data and API keys directly; submit server requests through WeChat gouzi-me. Team members should normally contact their organization first.

For account, security, privacy, deletion or closure requests, contact WeChat gouzi-me and describe the request. Do not send codes, passwords, API keys or unnecessary projects. We verify identity and reply within applicable legal periods; team requests may also go to the administrator. No unimplemented one-click closure or immediate backup erasure is promised.

Gouzi targets professionals and organizations, not children. Anyone below the local age of digital consent or legal capacity must not register independently; lawful guardian or organization authorization is required. Material changes will be highlighted and consent renewed where needed. Until the legal operator, address, and dedicated privacy contact are published, this policy alone does not establish commercial-launch legal readiness.

When this policy changes, its version and date will be updated. Material changes to purposes, methods, data categories, or rights will be highlighted through the App, website, or account flow, and consent will be renewed where applicable law requires it.

Sign-in uses necessary session credentials and the app/browser language. The website counts random local visitor IDs, page paths, language and downloads, not project content; network services can still receive IP addresses. Clearing browser storage does not erase existing server records.