This policy explains how GAL handles personal information when you visit gal.run, contact us or use our configuration distribution services. It distinguishes business contact information from the configurations your organization controls.
1. Who this policy covers
GAL Runtime Ltd, Israeli company number 517139382 (“GAL,” “we” or “us”), is responsible for personal data we handle to run our website, manage business relationships and administer the services.
Customer-controlled data. Where we process information on an organization’s behalf, that organization’s instructions and the applicable data processing agreement govern. Your employer or workspace administrator may have its own privacy notice. The entity named in your agreement is responsible for its commitments.
2. Information we handle
- Contact and meeting details: your name, email, organization, messages and information you choose to provide when contacting us or booking a call.
- Account information: identifiers, profile details and organization membership received from the sign-in provider you use, together with access and acceptance records.
- Agreement evidence: the customer’s legal name, organization identifier, representative’s name and authority declaration, the authenticated account and acceptance time, and copies and integrity hashes of the documents presented for acceptance. These records document the agreement and related rights; acknowledging this notice does not authorize optional recording or marketing.
- Configuration distribution data: files and release metadata you choose to submit, target and machine identifiers, installed-version reports and distribution records for features you enable. Configuration files can themselves contain personal information.
- Operational information: IP address, browser and device information, requests, errors, timestamps and security logs needed to serve, troubleshoot and protect the service.
- Feedback: ratings, selected reasons, comments and product or page context you submit, together with associated account or organization information where available. Email feedback also includes the sender details and message you choose to send.
Your choice to provide information. You are not generally required by law to give us account or inquiry information. Without the details needed for an account, response or booking, we may be unable to provide that function. Optional research, marketing and meeting recording are separate choices. An organization may supply your work details when inviting you; we use those details for that organization’s workspace and access administration.
Keep submissions limited. Do not put secrets, personal data that is unnecessary for the task, or restricted material into configuration bundles, public inquiries or meeting notes. A configuration-distribution workflow does not require you to give GAL all of your source code or conversations.
3. Why we use it
We use this information to answer requests, arrange meetings, administer accounts, deliver the enabled distribution workflow, investigate failures, assess product suggestions, protect the service and meet legal obligations.
Where the GDPR or a similar law applies, the following explains the basis for each activity. Contract necessity applies when you are personally a party to that contract; for a customer’s employee or representative, the relevant basis is normally our legitimate interest in administering the business relationship, subject to that person’s rights.
| Purpose | Basis where required |
|---|---|
| Account access, requested configuration distribution and support | Contract performance where applicable; otherwise legitimate interests in delivering and administering the organization’s service. |
| Answering an inquiry or arranging a meeting | Steps requested before a contract; or legitimate interests in responding to business requests. |
| Security, troubleshooting and misuse prevention | Legitimate interests in a reliable, secure service and protection of users; legal obligations where applicable. |
| Responding to voluntary feedback and assessing product suggestions | Legitimate interests in resolving reported problems and improving the service, subject to confidentiality and your rights. This does not authorize a separate research study or model training. |
| Accounting, legal claims and required records | Applicable legal obligations; legitimate interests in establishing or defending legal claims. |
| Optional research, recording or marketing | Separate consent where required; the specific notice explains the activity and how to stop it. |
Separate choices. Booking a call or contacting us does not subscribe you to marketing, authorize session recording or enroll you in a research study. Those activities require their own applicable notice and permission. This policy does not grant permission to train a model on your configurations.
4. Providers and sharing
Service providers. We use providers to host and protect the services and support business communication. The current hosted deployment uses Amazon Web Services; Cloudflare provides website delivery or protection; Google Calendar and Google Meet handle calls you choose to book. Identity and source-control providers, including GitHub when you choose it, receive information needed for that integration. Authorized organization administrators can see membership and distribution activity within their workspace.
Diagnostics and feedback handling. The hosted API uses Sentry for error monitoring and performance diagnostics. Diagnostic events may include technical request context and error information. When investigating feedback, authorized staff may copy relevant report details into support or issue-tracking tools, including GitHub. Keep feedback limited to information needed to explain the problem; do not include credentials or restricted customer material.
Following an external booking or sign-in link sends information directly to that provider, subject to its privacy terms. Providers’ locations and processing can differ from the primary application hosting region. Ask [email protected] for the provider list and handling details applicable to your deployment before sending sensitive data.
Other disclosures. We may disclose information where required by law, to address fraud or a security incident, or in a business transfer subject to applicable confidentiality and data-protection obligations. We do not sell personal data.
6. GAL browser extension
The GAL browser extension connects your Chrome profile to GAL, so the AI agents you run can use the browser tabs you approve.
- Sign-in. You sign in to GAL once, at app.gal.run. The extension uses that same GAL session, and signing out in the dashboard or in the extension signs you out of both. GAL uses your account identifiers to show your account.
- Your browsers in your GAL account. While you are signed in, the extension reports to your GAL account, about every 15 seconds: a name for this computer as the GAL app on it reports it, the email of the Google account signed in to this Chrome profile, the extension version, whether an agent is working, the sites you approved for agents, and this browser’s switches. You see and manage these in the GAL dashboard under Settings, Browser extension. A browser not seen for 30 days is removed.
- Site rules for all your browsers. The allowed and blocked sites and the switches you set in the dashboard are stored in your GAL account, and each of your browsers applies them. A blocked site always wins.
- Profile label. The extension reads the email of the Google account signed in to the Chrome profile to label the profile: for you in the GAL dashboard, which is why it is sent to GAL’s servers with this browser’s entry, and for the agent you run through the GAL app on your computer.
- Agent browser access. When you approve a site for an agent, the page content, screenshots, form values, tab addresses and titles, and the results of the agent’s actions on that site can be passed to the agent through the GAL app on your computer. When the agent asks, it can also read that tab’s console messages and network requests, with sign-in tokens removed. This content can include personal communications or anything else shown on the page. Your agent and its provider handle that information under their own terms.
- Pages GAL never acts on. Some pages are never-act whatever any rule says: app.gal.run’s settings and sign-in pages, GitHub’s sign-in, session and settings pages, the Chrome Web Store, and the developer consoles of the Mozilla, Microsoft, Visual Studio, npm, PyPI and Google Play stores. Sensitive sites (cloud consoles, sign-in pages, Google account and Gmail, GitHub, Stripe, GAL admin pages, local and private-network addresses) can only be approved by you in the extension’s side panel, never by your GAL session.
- Browser Auth (optional). If you turn on Browser Auth for a site and allow cookie access, the extension captures that site’s cookies (including its subdomains) and local storage. These can include sign-in credentials. Uploading the capture to your GAL workspace is a separate step you confirm. GAL keeps uploads encrypted until you delete them. You can see each upload, whether its sign-in has expired, and delete it in the GAL dashboard under Browser Profiles.
- Usage data. One setting on your GAL account, Usage data, covers every GAL app you sign in to, including this extension. It is on unless you turn it off in the GAL dashboard under Settings, Privacy, and no GAL app collects anything until the dashboard has shown you a one-time notice after your first sign-in. An organization admin can turn it off for all members, but cannot turn it on for anyone. While it is on, GAL collects feature events, counts, error reports, app version and operating system, a random install ID, and your Claude Code and GAL Harness sessions: prompts, responses, tool calls with their outputs, and folder paths. Known secret formats and values under secret names (passwords, tokens, keys, cookies) are masked before upload. From this extension, usage data is feature events, such as “popup opened” or “workflow inserted”, with a random installation ID, the extension version and your operating system; never page content, prompts, workflow text, web addresses, account or organization names, or email addresses. Before you sign in, or while the setting cannot be read, the extension sends nothing.
- Limited Use. The use of information received from the extension follows the Chrome Web Store User Data Policy, including the Limited Use requirements. GAL does not sell this data, does not use it for purposes unrelated to the extension’s purpose, and does not use it to decide credit or lending.
7. Retention and security
Retention. We determine retention by the purpose and applicable obligations, rather than keeping all data indefinitely. Inquiry and meeting records are retained while responding and managing the resulting relationship; account and distribution records while needed to provide the workspace and resolve operational issues; security logs while relevant to detection, investigation and claims; and contractual, acceptance and accounting records for applicable recordkeeping and limitation periods. A legal hold can extend relevant retention. An agreed DPA may set specific periods. On expiry of the applicable purpose and obligations, records should be deleted or irreversibly anonymized; backups may expire separately and remain access-restricted in the meantime. Ask us for the retention schedule applicable to your deployment before providing sensitive information.
Security. We use access restrictions and operational safeguards appropriate to the service. No system can guarantee absolute security. A public website, an in-development feature or a meeting link is not a claim of defense accreditation, a particular compliance certification or approval to process classified information.
Restricted deployments. Residency, offline operation, support access, retention and deletion must be established for the particular customer deployment. Do not assume an air-gapped arrangement applies to a hosted account.
8. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, or withdraw consent for processing based on consent. You may also complain to the relevant data-protection authority.
Send requests to [email protected]. We may need proportionate information to verify your identity and authority. We respond within the period required by the law that applies to your request and explain any lawful limitation. Where GDPR applies, the usual response period is one month, with a permitted extension for complex or numerous requests and notice of the reason within the first month. Withdrawal of consent does not invalidate earlier lawful processing. If we refuse a request, we explain the reason and available complaint route. For data controlled by your organization, we may direct you to its administrator or assist it under our agreement.
Where applicable law permits a representative to act for you, we may ask for evidence of that authority. You may ask us to reconsider a refusal or use any appeal procedure required by applicable law; this does not prevent a complaint to a regulator. We will not penalize you merely for exercising a protected privacy right.
9. International processing
Israeli rights. Where Israeli law applies, you may seek access to personal information about you held in a database and request correction of information that is incomplete, inaccurate, unclear or outdated, subject to statutory conditions. You may contact the Israel Privacy Protection Authority; the rights available under other laws depend on their applicability.
We operate from Israel and use providers in other countries. Application hosting in a particular region does not mean all communications, delivery, support or identity processing stays there. Transfers may involve Israel, the United States, the European Economic Area and locations used by the selected providers. Where restricted-transfer rules apply, the relevant arrangement must use a permitted basis, such as an applicable adequacy decision or approved contractual safeguards with any required additional measures. This notice is not itself a transfer agreement or a certification. You may request details of the mechanism applicable to your data and, where required, a copy of relevant safeguards, with confidential details redacted. Deployment-specific commitments belong in your data processing agreement.
10. Children, updates and contact
Automated decisions. Configuration and access checks are technical service functions. This notice does not authorize solely automated decisions about employment, credit or other matters producing legal or similarly significant effects; a materially different use requires its own assessment and notice.
Business use. GAL is intended for adult professional users, not children. Contact us if you believe a child has provided personal data through the service.
Updates. We will identify changes with an updated date and provide additional notice or seek consent where required. An updated notice does not by itself supply consent for a new purpose or override existing contractual restrictions.
Contact: GAL Runtime Ltd, [email protected].