Privacy Policy

Version 1.16 · Effective 29 October 2026 · Applies to the Gigmo mobile app (Android, iOS) and gigmo.ai · Auf Deutsch lesen

Gigmo helps freelance live performers (musicians, DJs, comedians, dancers, actors and more) manage their gigs, tasks and contacts. This policy explains what data the app stores, where it goes, and how you get rid of it.

1. Who is responsible

The controller for the processing described here is:

Gigmo is an independent app, not a company product. If you are in the EU or the UK, the GDPR applies to this processing, and your rights under section 14 are enforceable against the controller named above.

2. The short version

• Your gigs, tasks, contacts and profile are stored in Google Firebase, in Google’s European multi‑region.
• We do not sell your data, we do not run advertising, and we do not share your content with anyone except the service providers listed in section 11.
• Google Calendar sync, email import, the WhatsApp Business connection and automatic AI updates are off until you turn them on.
• Usage statistics, extra detail in error reports and AI samples are off until you turn them on too (section 10). Basic crash reports are always sent, and short error reports are sent unless you turn them off; neither carries your account id.
• Our server counts anonymous daily totals from the data Gigmo already stores, such as how many gigs were created. Only the numbers are kept (section 10).
• Deleting your account deletes your data — automatically and server‑side, not “on request”. See gigmo.ai/delete-account.

3. Data you give us by using the app

Your account

• Sign‑in details — your email address, and, if you sign in with Google, your Google account identifier and display name. Handled by Firebase Authentication. Gigmo never sees your Google password.
• Your profile — username, names, phone numbers, email addresses, postal addresses, websites and dates you choose to record, plus your app settings (notification preferences, gig types, custom fields, task and message templates, visibility settings).
• Your profile picture, if you set one.

Your work data

• Gigs — title, dates and times, venue name and address (including its map coordinates), fees and payment lines, notes, schedule, and the contacts you associate with the gig. A per‑gig change history is kept so collaborators can see what changed.
• Tasks — title, due date, notes, and the gig they belong to.
• Contacts — names, phone numbers, email addresses, postal addresses, role, contact type, notes and a picture, for the people you work with. See section 6.
• Files you attach — contracts, riders, stage plans, gig pictures, audio such as demos and reference tracks. Stored in Firebase Cloud Storage.
• Availability and collectives — blocked date ranges, and the membership and shared gigs of any collective you join.

Sharing with other Gigmo users

When you share a gig with another Gigmo user, that gig — and the profile information your sharing settings allow — becomes visible to them. Contact requests record who asked, who was asked, and the answer. You control what others can see about you in the app’s privacy settings.

4. Data from your device

Each of these is requested only when you use the feature, and only after your operating system asks your permission:

Without asking for a permission, each installation of the app also stores on your account which app version it runs, the platform, the phone model or browser, the operating system version and when you last opened the app, so that we can see which version you have when you ask for help. It holds nothing you entered and no device identifier, only a random id for the installation, and it is deleted with your account.

5. Google Calendar (optional)

If you connect Google Calendar, you grant Gigmo the calendar.events scope, plus read access to your calendar list. With it, Gigmo:

• reads events from the calendars you select, so gigs can be imported and double bookings are visible;
• creates, updates and cancels calendar events for your gigs.

So that this keeps working while your phone is off, a Google refresh token is stored on our server and is readable only by the sync worker. Gigmo does not add guests to your calendar events unless you explicitly turn that on for a specific gig.

Google API Services User Data Policy. Gigmo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data, and the Gmail sending permission (section 7), are used only to provide the features described. Gigmo uses gmail.send only to send a reply you confirmed, when you tap Send. None of it is ever sold, never used for advertising, and never used to train AI models.

You can disconnect at any time in the app’s calendar settings, which revokes the token with Google and deletes it from our server.

6. Contacts you add — data about other people

Gigmo is an address book for your working life, so most contact records are personal data about someone else. You decide what goes in. In GDPR terms you are responsible for having a lawful basis for the details you record, and Gigmo processes them on your behalf and on your instructions.

• Contacts you add are visible to you, and to anyone you share the relevant gig with.
• Temporary contacts created for a one‑off gig are archived automatically once that gig is long past.

If you appear in someone else’s Gigmo contact list and want that record removed, write to privacy@gigmo.ai and we will pass the request on.

7. Email import (optional)

If you switch email import on, Gigmo issues you a private forwarding address (import+…@gigmo.ai). Enquiries you forward there are received by Cloudflare, which runs the gigmo.ai mail domain (Email Routing and a Worker that parses the message), and passed to Gigmo, which stores:

• the sender’s name and address, the subject, the message text and any attachments;
• the time it was sent and received, and its SPF, DKIM and DMARC authentication results;
• what the AI extraction made of it, so you can accept or reject the suggestion — or, if you turned on automatic updates, what was applied (section 9).

You can also put the address in BCC on mails you send to clients yourself, so the AI sees both sides of a conversation (for example the fee you offered). Gigmo reads such a mail only when someone it is addressed to is in your Gigmo contacts; a mail to anyone else is dropped unread and nothing of it is stored. A mail it reads is stored as above, together with whom it was addressed to.

Cloudflare handles the message in transit on its global network — the location that receives it depends on where the sending mail server is, and may lie outside the EU — and keeps nothing once it has been passed on; the stored copy lives in Frankfurt like the rest of your data (section 11).

These records delete themselves 30 days after arrival. Anything you accept into a gig, task or contact is then kept as ordinary app data. You can switch email import off, and change or retire the address, in the app’s settings.

When you ask for it, the AI can also draft a reply to an imported email (section 9). The draft is shown to you to edit, copy or open in your own email app, and Gigmo does not store it; it is gone once you close it. If you tap Send from Gigmo, Gigmo sends that one reply for you through Scaleway (Paris, France): from send@gigmo.ai under your name, with your account’s email address as the address your client’s answer goes to, and, if you leave Send Me a Copy on, a hidden copy to you. Gigmo keeps only a count of how many replies you sent in the last day, as a limit against misuse.

If you tap Send from My Gmail instead, Gigmo asks Google, the first time, for the gmail.send scope: permission to send mail as you, and nothing else. Gigmo cannot read, search or delete your mail with it. The reply is sent from your phone or browser straight to Google as an ordinary mail of yours, so it appears in your Gmail Sent folder. The short-lived Google token stays on your device for that one send; Gigmo stores no Gmail credential and no copy of the mail on its servers. You can withdraw the permission at any time in your Google Account under third-party connections.

If you want the drafts to sound like you, you can paste or share some mails you sent to clients into Settings → AI Assistant → Teach Mo My Style. The AI reads them once (section 9) and writes a short description of how you write: your greeting, sign-off, tone and typical phrases, without names, places, prices or other details. Gigmo does not store the mails you paste; they are discarded as soon as the description is made. Only the description is kept, with your account, and every reply draft uses it. You can read, change or delete it there at any time.

8. WhatsApp Business (optional)

If you use the WhatsApp Business app, you can connect your number to Gigmo so that your WhatsApp chats with clients turn into draft gigs, tasks and contacts. You connect it yourself, by signing in with Meta, and you keep using the WhatsApp Business app on your phone as before. Gigmo receives a copy of new messages through Meta’s WhatsApp Business Platform:

• one‑to‑one messages people send to your number after you connect it: the sender’s phone number and WhatsApp profile name, the time, the message text and any pictures and PDF documents in it;
• the messages you send yourself from the WhatsApp Business app in those chats after you connect it: the recipient’s phone number, the time, the message text and any pictures and PDF documents in it, so that the AI sees both sides of a conversation (for example the fee you agreed to);
• voice messages, which the AI described in section 9 turns into text. Gigmo keeps the text, not the recording;
• for other media, such as videos, other documents, locations or contact cards, only the fact that one was sent, and a document’s file name. Gigmo does not download them.

Group chats never reach Gigmo.

Earlier chats, only the ones you pick. WhatsApp shares your earlier one‑to‑one chats only once, within 24 hours of connecting, and only if you allow it in the WhatsApp Business app while you connect. Right after you connect, Gigmo shows you a list to pick from: your Gigmo contacts, ticked, and the other people in your WhatsApp Business app’s contact list, by the name saved there, not ticked, plus a switch for chats with numbers you haven’t saved. To show that list, Gigmo keeps the names and numbers of your WhatsApp contact list until you have picked, and deletes them then, at the latest 24 hours after you connected. Only after you pick does Gigmo ask Meta for the chats. Of what Meta sends, Gigmo keeps only the chats you picked, and of those only the messages from the 30 days before you connected; everything else is dropped as it arrives, unread and not stored. If you don’t pick within the 24 hours, Gigmo imports the chats with your Gigmo contacts and with numbers you haven’t saved. The never-read list below applies to earlier chats too. Picked chats are handled like new messages (below), except that you get no notification for them and automatic updates don’t apply to them. Pictures and documents in earlier chats are included only when they were sent in about the last two weeks; older ones are left out.

Private chats are skipped unread. To tell them apart, Gigmo asks Meta once, when you connect, for the phone numbers in your WhatsApp Business app’s contact list, and then receives changes to it. Apart from the list for picking earlier chats (above), Gigmo keeps no names from it, and no numbers either: only a code made from each number with a secret key that never leaves Gigmo’s servers, so the code cannot be turned back into the number without it. A chat is read only when the other person is one of your Gigmo contacts or is not saved in your WhatsApp; messages from and to people saved in your WhatsApp but not in Gigmo are dropped before anything reads them, and nothing of them is stored. Chats with numbers you put on the never-read list in the app’s settings are never read. Your own messages follow the chat they are in: they are read only where the other person’s messages would be, and are dropped unread everywhere else. If Meta does not share the contact list, the app on your phone uses your phone’s address book instead, but only if you already allowed Gigmo to read your contacts: at most once a day it sends a code made from each number in it (never a name or a number), which Gigmo keeps in the same keyed form, and Meta’s list replaces it once it arrives. Without either list, every message except those from the never-read list is read. The settings page says which applies. Disconnecting deletes the codes.

Each new message that is read is analysed by the AI described in section 9 (consecutive messages in the same chat, yours and theirs, are taken together), to find a gig, task or contact in it. If it finds none, the message is discarded and nothing is stored. If it finds one, Gigmo keeps the message with the suggestion in your inbox, so you can accept or reject it; nothing goes into your gigs, tasks or contacts until you confirm it, unless you turned on automatic updates (section 9).

If you turned Cloud AI off (section 9), no AI reads the message on our servers. Gigmo then keeps every message it receives in your inbox, unread, until you open it on your phone, where your device’s own AI can read it or you add the details by hand. Voice messages are then not turned into text. These messages, too, delete themselves 30 days after arrival.

The people who write to you are not Gigmo users, so these messages are personal data about someone else. As with the contacts you add (section 6), you are responsible for having a lawful basis for collecting them, and Gigmo processes them on your behalf and on your instructions.

Meta processes the messages on its servers to deliver them to Gigmo. It keeps them encrypted for at most 30 days, for example to retry a delivery, and does not use them for advertising. The copy Gigmo stores lives in Frankfurt like the rest of your data (section 11).

Stored messages delete themselves 30 days after arrival, as imported emails do. Anything you accept into a gig, task or contact is then kept as ordinary app data. You can disconnect at any time in the app’s settings, or in the settings of the WhatsApp Business app; Gigmo then receives no further messages. Disconnecting in Gigmo also deletes the access token stored for your number.

When you ask for it, the AI can also draft a reply to a WhatsApp message in your inbox (section 9). You read and edit it first. If you tap Send on WhatsApp, Gigmo sends that one reply through Meta from your connected number to the person who wrote, and it shows in your WhatsApp Business app like a message you typed there. WhatsApp allows this only within 24 hours of their last message; after that you open the reply in WhatsApp and send it yourself. Gigmo does not store the draft or the reply; it keeps only a count of how many replies you sent in the last day, as a limit against misuse.

9. AI processing

Gigmo uses Google Gemini models to turn text — an email, a message, or something you type or dictate — into a draft gig, task or contact, and, when you ask for one, into a suggested reply to an imported email or WhatsApp message, or a description of your writing style (sections 7 and 8). The text you submit, and the messages that reach Gigmo from a connected WhatsApp number (section 8), are sent to Google Vertex AI, which currently serves these models from a global endpoint, so processing may take place outside the EU. Google acts as our processor for these calls; under the Google Cloud terms the content is not used to train Google’s models.

You can turn Cloud AI off under Settings → AI Assistant. Imported emails and WhatsApp messages are then not sent to Vertex AI: they wait in your inbox, unread, for your device’s own AI or for you (sections 7 and 8).

Every AI suggestion is shown to you for confirmation before anything is saved, unless you turn on automatic updates.

Automatic updates (optional)

Automatic updates are off until you turn them on in the app’s settings. When they are on, Gigmo applies what the AI finds in incoming emails (section 7) and WhatsApp messages (section 8) to your gigs, tasks and contacts without asking you first. Two further switches, also off until you turn them on, decide whether it may also create new gigs and also change existing details; with both off it only adds new contacts, new tasks and details for fields that are still empty.

• Only incoming emails and WhatsApp messages are applied this way. What you type, dictate or share into Gigmo yourself is always shown to you for review first.
• These go to review instead: an email whose sender Gigmo cannot verify; anything that would remove data, including a cancellation that would delete the gig’s Google Calendar event; changes to gigs someone else shared with you; and changes that would make Google email someone, such as adding or removing a guest.
• The AI never overwrites a detail you changed by hand after the email or message arrived.
• Every automatic change is listed in the app’s Updates list with the old and the new value, and you can undo it there.

You can turn automatic updates off at any time; from then on every suggestion waits for your confirmation again.

10. Helping to improve Gigmo

Basic crash reports are always sent from the Android and iOS apps, so that crashes can be fixed: what went wrong in the code, the device model, operating system and app version, and the app’s own warning and error messages just before it. They carry no account identifier and none of your gigs, tasks or contacts. The web app sends none.

Error reports (on unless you turn them off)

With Send error reports on, which is the default on Android, iOS and the web, every error the app records takes the app’s last log lines with it, at most 50. The lines describe what the app was doing just before the error. Email addresses and access tokens are removed from them and your account id is blanked out; no account id or email address is sent with them. A line can still name something the app was working on, so we treat them as personal data.

• On Android and iOS the lines ride the crash report of that error in Google Crashlytics, which groups reports by a random id for this installation, not by your account.
• On the web, where there are no crash reports, they are uploaded as a small text file to Cloud Storage in Frankfurt, under a random id kept in this browser. Only while you are signed in; readable only by us and deleted after 30 days.

You can turn Send error reports off at any time under Settings → Data and privacy, also before you sign in; from then on no log lines go with an error.

Anonymous daily totals (for everyone)

Once a day our server counts, from the data Gigmo already stores, how the app is used overall: for example how many accounts are new or active, how many gigs, tasks and contacts were created, how email and WhatsApp imports went, how many calendar connections need reconnecting, how many notifications were sent, and how often AI suggestions were accepted, edited or removed. Only the totals are kept: numbers, with no account id and no content.

A few of these numbers exist only on your device, such as how a capture was made (voice, photo, text or PDF) and what you did with each suggestion on the review screen. The app adds them to a small counter stored with your account, one per day and holding numbers only, never text; the server adds up everyone’s counters into the daily total. This counter is only kept while Usage statistics is on (section 10, off until you turn it on); with it off, the app writes nothing. Each counter deletes itself after 35 days and goes with your account if you delete it.

Options you choose

The three options below are off until you turn them on. After you sign in, Gigmo asks you once, with the three off and Send error reports on; “Not now” keeps the three off. You can change each choice at any time under Settings → Data and privacy. Your choice is stored with your account, together with the date and the version of the wording you answered, and applies on every device.

We read AI samples to find where the assistant goes wrong. A mistake may be turned into a test case for the assistant, rewritten by hand with every personal detail removed. Samples never go to Analytics or Crashlytics and are never used to train Google’s models.

Turning an option off stops that collection straight away. What was already sent is deleted on the schedule above; if you want it removed sooner, write to privacy@gigmo.ai.

11. Who else touches your data

That is the complete list. We do not sell personal data, we do not share it with advertisers or data brokers, and the app contains no advertising or tracking SDKs. Transfers outside the EU rely on the European Commission’s Standard Contractual Clauses as incorporated into each provider’s terms.

12. Why we are allowed to do this

• Performance of a contract (Art. 6(1)(b) GDPR) — your account, gigs, tasks, contacts and files. Without them the app does nothing.
• Your consent (Art. 6(1)(a)) — Google Calendar sync, email import, the WhatsApp Business connection, automatic AI updates, device permissions, optional notifications, and the three options in section 10 (Usage statistics, Help fix bugs, Improve the AI assistant). Withdraw it at any time in the app; withdrawal does not undo processing that already happened.
• Legitimate interests (Art. 6(1)(f)) — basic crash reports, error reports and abuse prevention, so the app can be kept working and secure; which app version each installation runs, so we can help you; and the anonymous daily totals, so we know how the app is used. You can object to the error reports at any time by turning Send error reports off.

13. How long we keep things

• Your account data — until you delete your account.
• Imported emails — 30 days from arrival, automatically.
• Reply drafts — not stored at all; gone once you close them. Gigmo keeps no copy of a reply you send from Gigmo either, by email or on WhatsApp.
• Mails you paste to teach Mo your style — not stored at all. The writing-style description made from them stays with your account until you delete it or the account.
• The Updates list, including the record of each automatic update — 30 days, automatically.
• WhatsApp messages — not stored at all when the AI finds no gig, task or contact in them; otherwise, and always while Cloud AI is off, 30 days from arrival, automatically.
• Temporary contacts — archived automatically once their gig is long past.
• Crash reports, including the log lines of Send error reports — 90 days in Crashlytics; our BigQuery copy at most 14 months.
• Error reports from the web — 30 days, automatically.
• Daily counters stored with your account — 35 days, automatically. The anonymous daily totals hold no personal data and are kept.
• Usage statistics — at most 14 months, in Google Analytics and in our BigQuery copy.
• Diagnostic logs (Help fix bugs) — 30 days, automatically.
• AI samples (Improve the AI assistant) — about 90 days, automatically.
• Your privacy choices — with your account, until you delete it.
• Server logs — retained by Google Cloud Logging for 30 days by default.

14. Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or hand it to another service in a portable form. Write to privacy@gigmo.ai; we answer within one month.

You also have the right to complain to a supervisory authority. In Germany that is the data protection authority of the federal state where you live.

15. Deleting your account

You can delete your account from inside the app, under Settings → Account → Delete account, or request deletion from the web at gigmo.ai/delete-account, which also lists precisely what is erased. Deletion is a server‑side cascade: your gigs, tasks, contacts, files, imported emails and WhatsApp messages, forwarding address, notification tokens and calendar grant all go with the account, the calendar token is revoked with Google, and a connected WhatsApp number is disconnected and its access token deleted. The diagnostic logs, daily counters and AI samples of section 10 go with it too, and we ask Crashlytics to delete the crash reports and Google Analytics to delete the usage statistics sent with your user id. Error reports carry no account id, so they cannot be traced to your account; they, and our BigQuery copies, expire on the schedule in section 13.

16. Security

Data is encrypted in transit and at rest by Google Cloud. Access is enforced by Firebase Security Rules that check the requesting account on every read and write, so one user cannot reach another user’s data. Firebase App Check is enforced, so requests from anything other than a genuine Gigmo installation are rejected.

17. Children

Gigmo is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

18. Changes to this policy

If this policy changes in a way that matters, we will raise the version number at the top of this page and tell you in the app before the change takes effect. Older versions are available on request.

19. Contact

privacy@gigmo.ai