gaia synergy

Privacy Policy

Last updated: October 22, 2026

1. Who we are

Gaïa is operated by GAIA SYNERGY, a company registered in France (SIRET: 930 916 473 00018), which is the data controller for the personal data described in this policy. Contact: contact@gaia-synergy.io.

2. Scope

This policy covers the gaia-synergy.io website, the Gaïa web app, and the Gaïa connector for Claude and ChatGPT (listed as “Carbon Invoices for Net Zero Cloud”, served at mcp.gaia-synergy.io). It describes what we collect, why, who receives it, how long we keep it and the controls you have.

3. Data we collect

Account data

  • Email address and authentication data, managed by our login provider (Amazon Cognito). We never store your password in clear text.
  • Subscription and usage records (plan, number of invoices processed).

Invoices and extracted data

  • The invoice files you upload (PDF, PNG, JPEG), their name, size and a fingerprint (hash) used to detect duplicates.
  • The data extracted from them: supplier name, invoice and due dates, billing period, consumption and unit, total cost and currency, bill type and GHG Protocol scope, plus the processing status.
  • Invoices can contain personal data of their own, such as a contact name, a billing address or a customer number. We process it only as part of the invoice and don't use it for any other purpose.

Salesforce connection

  • If you connect a Salesforce Net Zero Cloud org: its instance URL and the credentials of the integration user, stored encrypted in AWS Secrets Manager and only used to send your invoice data to your org.

Website and contact

  • Contact form: your name, email address and message.
  • Analytics: pages visited and interactions, collected through Google Tag Manager.

Technical data

  • Server logs: request metadata (time, path, tool name, client user agent, errors). File contents, tool arguments and tool results are not logged.

4. Gaïa connector for Claude and ChatGPT

When you connect Gaïa in Claude (Anthropic) or ChatGPT (OpenAI), you sign in with your Gaïa account and the assistant can only reach data of that account. Depending on your request, the connector:

  • reads your invoices: file name, type and size, processing status, dates, GHG scope, bill type, the Salesforce record ID once sent, and the extracted data listed in section 3;
  • uploads new invoices: in ChatGPT, the file you attach is downloaded by our server from OpenAI and stored in your account; in Claude, you drop the file into an upload box in the chat, which sends it directly to our storage.

This data is sent to the assistant only to answer your request, and is then handled by Anthropic or OpenAI under their own privacy policies. We don't store your conversations. The connector never modifies or deletes your existing invoices.

5. How we use data and legal bases

  • To provide the service: process your invoices (OCR, then AI extraction), show the results, send them to your Salesforce org and answer connector requests (performance of contract).
  • To bill subscriptions and track plan limits (performance of contract, legal obligation).
  • To secure, debug and improve the reliability of the service (legitimate interest).
  • To answer your messages and communicate about your account (performance of contract, legitimate interest); marketing only with your consent.
  • To measure website audience (consent, where required).

We don't sell personal data, and neither we nor our providers use your invoices to train AI models.

6. Recipients and subprocessors

  • Amazon Web Services: hosting, database, file storage, authentication, email, and invoice processing with Amazon Textract (OCR) and Amazon Bedrock (AI extraction with Anthropic Claude models run by AWS), in the EU (Paris region).
  • Stripe: payments and billing. Card details are collected by Stripe; we never see or store them.
  • Salesforce: your own Net Zero Cloud org, when you connect it and ask Gaïa to send data to it.
  • Google: website analytics (Google Tag Manager) and spam protection on the contact form (reCAPTCHA).
  • Anthropic (Claude) and OpenAI (ChatGPT): when you use the Gaïa connector (see section 4).

Some providers process data outside the EU; such transfers rely on the EU Standard Contractual Clauses or an adequacy decision. We may also disclose data where required by law.

7. Data retention

  • Account data, invoices and extracted data: for the life of your account. You can delete invoices at any time in the web app; everything is deleted within 30 days of account closure.
  • Billing records: as long as required by law (10 years in France).
  • Salesforce credentials: until you disconnect your org or close your account.
  • Contact messages: up to 3 years after our last exchange.
  • Connector logs: 14 days. We don't store your Claude or ChatGPT conversations.

8. Your controls and rights

  • View and delete your invoices in the web app.
  • Disconnect the Gaïa connector at any time in Claude (Settings → Connectors) or ChatGPT (Settings → Apps); this immediately stops the assistant's access to your Gaïa data.
  • Under the GDPR, you can access, correct, delete, export or restrict your data, and object to processing. Email contact@gaia-synergy.io; we answer within one month.
  • You can lodge a complaint with the CNIL (www.cnil.fr).

9. Security

Data is encrypted in transit and at rest. Access is restricted per account through authenticated, owner-scoped permissions, so users and the connector can only reach data that belongs to their own account.

10. Children

Gaïa is a business service and is not directed to children under 16.

11. Changes and contact

We will update this page and the date above when this policy changes, and notify account holders of material changes. Questions: contact@gaia-synergy.io.