GAS AIPrivacy & security

Plain-English data boundaries

You should know what a tool uses.

GAS tools do not all handle information in the same way. This page explains the current data path for the main public tools, without calling every feature “private” or “encrypted” when it is not.

See the data flows

What goes where

One platform, different data paths.

Read the description for the particular tool you are using. Do not enter passwords, payment-card information or private customer details unless a tool explicitly requires and protects them.

Marketing

Only the details you type are sent for a draft.

Your business description, offer, selected goal and optional audience are sent to the GAS AI Marketing service. A website address is treated as a hostname only; the tool does not browse it.

  1. You type the form details
  2. GAS requests one draft from OpenAI
  3. The draft appears in your browser for review
The request uses OpenAI's store: false setting. The tool does not post, spend money, connect an account or contact people.
Accounting

Selected files stay in your browser until you choose a hand-off.

You choose files, review possible records and decide what belongs in a pack. A locked pack is created in your browser before any optional temporary link is requested.

  1. You choose and review files
  2. Your browser makes an AES-256 encrypted ZIP
  3. You may create a revocable, seven-day temporary link
The temporary service receives the locked ZIP, not the secret. The full private-link secret sits after # in the link and is not sent in a normal website request.
Planning tools

Plans stay on this device unless you export them.

Business Planner, Department, IT and Call Centre planning screens use browser storage for the plan you create. They do not connect a phone line, business system or staff account by themselves.

  1. You enter a plan
  2. The browser keeps it locally
  3. You decide whether to export or clear it
Anyone who can use the same unlocked browser profile may be able to see browser-stored information. Clear it when using a shared device.

What we do not claim

Clear limits are part of good security.

GAS does not claim that ordinary email is end-to-end encrypted, that every tool has the same protection, or that a marketing draft is a professional decision. A full technical retention, data-residency and incident-response policy has not yet been published.

  • Use a secure channel when requiredEmail providers can still see addresses, subject lines and delivery information.
  • Keep full private links privateAnyone with a live full link may be able to open its locked pack.
  • Check before actingAI output can be wrong. Get qualified help for high-stakes decisions.

Your choice

Read the tool boundary before you start.

If a data path does not suit your business rules, do not use that tool for that information. You can ask a question before sharing anything.

Platform Steward swarm activeWatching platform health, not private user content.