Draft — needs legal review. This text is a plain-language draft and is not yet in force. It will change before Gandalph is offered to customers.
Draft of 16 October 2026
In short: your company owns its data, each company is kept apart, our AI providers may not train on your data, and nothing leaves your company or moves money without a person's approval.
Gandalph is an AI operations platform. Your company connects the tools it already uses, names its own agent, and that agent runs routines, keeps track of commitments and prepares work for your team to approve.
These terms are an agreement between Gandalph ("we", "us") and the company that signs up ("you", "your company"). If you sign up on behalf of a company, you confirm you are allowed to accept these terms for it. If your company has signed an order form or a separate agreement with us, that document wins where it differs from these terms.
Each company has its own space in Gandalph, with its own members, workspaces, agents, settings and data. Owners and admins decide who can sign in, what each member can see and do, and which apps and connectors are switched on.
You are responsible for the people you invite, for keeping sign-in details safe, and for what your members do in Gandalph. Tell us straight away at hello@gandalph.io if you think an account has been misused.
Everything your company puts into Gandalph or brings in through a connector (messages, documents, records, files and what the agent writes from them) is your data. You own it. We do not claim any rights to it beyond what we need to run the service for you.
You give us permission to store, process and display your data only to provide Gandalph to you, keep it secure, support you when you ask, and meet legal obligations. We never sell your data, and we never use it to advertise to you or anyone else.
You can export your data at any time while your account is open. When your account ends, you have 30 days to export it, after which we delete it from the live service. Backups roll off on their normal schedule.
Your company's data is isolated from every other company on Gandalph. No record, prompt, memory, cache, job or log line from your company is used to answer another company's questions or to run another company's agents. One company's agent cannot see another company's data.
Your agents use large language models to read, summarise, draft and plan. Like any AI, they can be wrong or incomplete. You are responsible for checking what they produce before you rely on it, especially for legal, financial, tax, employment or safety decisions.
Anything that leaves your company or moves money needs a person to approve it. Sending a message or email outside your company, paying, invoicing or changing records in a connected finance system waits for a tap from someone your company has authorised. Admins can choose which internal actions an agent may take on its own.
Every action an agent takes leaves a receipt you can review, and where the connected system allows it, an undo.
To run Gandalph we use a small number of service providers that process your data on our behalf and under written terms:
We use these providers under business terms that do not allow them to train their models on your data. We do not train any model on your data either. The current list of subprocessors is in our Privacy Policy, and we will tell your company's owners before we add a new one.
When an admin connects another service (for example Slack, WhatsApp, Google Workspace, Microsoft 365 or QuickBooks), Gandalph reads and, only after approval where section 5 requires it, writes to that service under the permissions your admin grants. That service's own terms apply to your use of it. You can disconnect a connector at any time from Settings.
Please do not use Gandalph to:
Fees, plan limits and payment terms are set out in your order form or plan page. Each company sets a monthly AI budget; when it is reached, agents pause non-urgent work until an admin raises it or the month resets. Pilot plans may be free or discounted for a set period, as agreed in writing.
We protect your data with access controls, encryption in transit and at rest, encrypted storage of connector credentials, and audit logs of administrative actions. We treat your data as confidential and only let our staff access it when needed to run or support the service, or when you ask us to.
If we learn of a security incident that affects your data, we will tell your company's owners without undue delay and share what we know.
Gandalph is improving all the time. We may add, change or remove features. If a change materially reduces what your company pays for, we will tell you in advance. Features marked as beta or preview are offered as they are and may change or stop.
We will provide Gandalph with reasonable care and skill. Beyond that, and to the extent the law allows, the service is provided "as is", and we do not promise that it will be uninterrupted, error-free or that AI output will be accurate.
To the extent the law allows, neither side is liable for indirect or consequential losses, or for lost profits, revenue or data, and each side's total liability under these terms is limited to the fees your company paid us in the 12 months before the claim. These limits do not apply to fraud, to a party's breach of confidentiality, or to anything the law does not allow us to limit.
Your company can stop using Gandalph at any time. We may suspend or end access if fees are unpaid after notice, if these terms are seriously broken, or if we must to protect other customers or comply with the law. Where we can, we will warn you first and give you time to export your data (see section 3).
We may update these terms. If a change matters, we will tell your company's owners at least 30 days before it applies. The law that governs these terms, and where disputes are heard, will be confirmed in the final version.
Questions about these terms: hello@gandalph.io.
See also the Privacy Policy.
