Draft for professional review
Privacy overview
This draft explains the intended Galatea data practices. It must receive professional review and final business details before launch.
Contact and sign-in emails
Contact messages include your name, reply email, topic and message. Galatea uses Resend to send these to its business inbox and to deliver requested sign-in links. Contact messages remain in the business email system for follow-up; submitting a message does not subscribe you to marketing. Please do not include sensitive credentials. To request access to or deletion of your contact correspondence, use the contact form and choose Privacy request.
Spam-prevention counters use keyed hashes of the submitting network address and email, with no message content. They expire within 24 hours and are removed on later requests. Sign-in delivery records contain provider references or failure notices, not new raw sign-in links. Email and hosting providers maintain their own operational logs.
Marketplace offers
When a member confirms public sharing, their business name, offer details, category, location and supplied links are visible to everyone. Older member-only posts stay private until reconfirmed. Offers stop appearing publicly when closed, hidden, expired or the posting membership is no longer eligible. Public content may have been copied or indexed elsewhere. Private info requests reveal account email addresses only after both eligible members agree. Public reports can be sent through our contact form.
Website requests and approvals
Short website status notifications are sent through Resend to your membership email; draft content and review images stay in the dashboard. Notification text and delivery status are recorded for follow-up. Confirmed briefs, review images, written drafts, feedback and version-specific approval records are stored to deliver and document your website work. They are available to your eligible account and authorized Galatea staff. Unsubmitted form text is not saved. Use the contact form to request access, export or deletion of these records.
Niche Finder
The current free library filters prepared public research in your browser. Search text and selections remain in page memory and reset on reload. Downloading selected profiles saves a file to your device, not Galatea’s database. This free page makes no research API calls. Opening external source links is subject to those websites’ practices. Ordinary hosting and security logs may still apply.
Separate AI research pilot, when activated
When activated, AI research sends your direction, request, location and any selected follow-up context to OpenAI for web research and analysis. Do not enter confidential information or personal contact details. Galatea requests that API responses not be stored as retrievable responses; this does not eliminate provider security or abuse-monitoring retention. See OpenAI’s data controls.
Draft findings stay in the open page and are not stored in Galatea’s database. When you choose Save, only selected findings, their sources and limitations, and the defining request are saved. A secure browser cookie controls access without a paid dashboard account. Saved records expire after 30 days; you can download or delete them. Clearing the cookie loses access. Request counters contain a hashed workspace identifier and timestamp, not your research text, and expire after seven days. Expired records are removed on the next workspace access. Hosting and security logs have separate retention.
Other information Galatea expects to use
Assessment answers, business profile details, account information, subscription status, plan progress, submitted review requests, connected-service authorization, leads supplied by the customer, and marketing performance data selected by the customer.
Why the information is used
To create and save plans, personalize guidance, provide requested automation and reporting, deliver requested review, protect accounts, and operate subscriptions.
Customer control
Customers will be able to update profiles, pause automation, disconnect Gmail, request an export, and request account deletion. Promotional consent will remain separate from required account communication.
Connections and service providers
Galatea will disclose the production providers used for hosting, AI, authentication, payments, scheduling, and Gmail authorization before launch.