Privacy Policy

Who we are

Gatelion ("we", "us") provides the Gatelion service: this website, the console, the Control Plane and the Gateways. This policy explains what personal data we process, why, where, for how long, and the rights you have under Egypt's Personal Data Protection Law (Law No. 151 of 2020) and other laws that may apply to you.

Two roles. We decide how your own account data is used, such as your name, email and sign-in. What an organization puts into Gatelion, we process on that organization's behalf and following its instructions. That covers its people, its configuration, its agents' calls and approvals, and its customers' sign-ins. On request, we'll sign a data processing agreement with your organization.

What we process

Your account

• Your name, email address, and the organization and roles you belong to.
• Your password, stored only as a salted hash. Your second-factor details: the authenticator secret (encrypted), your passkeys' public keys, and your recovery codes (as hashes).
• If you sign in with your company login: its issuer and your account identifier there.
• When you last signed in, and security events such as sign-ins, password changes and changes to your second factor.
• When your organization agreed to our terms and this policy, and which version.

What your organization sets up and does in Gatelion

• Configuration: environments, Gateways, connections to your systems (their addresses and the names of their secrets), tools, policies and agents. Agent tokens are stored only as hashes.
• Secrets:
  • For a Gateway in your network, your systems' secrets stay on that machine, and we never receive them.
  • For our hosted Gateway, they're encrypted in your browser before they reach us, so only the hosted Gateway can read them.
• Agent calls: for each call, we record:
  • which agent called which tool, and for whom;
  • the decision and its outcome;
  • a fingerprint of the arguments;
  • the fields of the result that the tool marks for the audit trail (for example an order number).
  We don't keep the full arguments or results of calls that don't need approval.
• Approval requests: the arguments an approver needs to see, encrypted in our database, and who decided what, and when.
• An audit trail of these events and of administrative changes, with fields named like secrets hidden.
• Usage counts: how many calls, approvals and resources an organization has, per day.

Your customers, if your organization uses customer access

• When your customers let an AI agent act for them, we receive from your customer login their account identifier, and their email address and name if it provides them.
• We also record the permissions they gave, the actions they confirmed or declined, and when they last signed in.

This website and the console

• This website sets no cookies and uses no analytics or tracking.
• The console uses only the cookies it needs to work: your session, and short-lived cookies during sign-in. It also stores a few preferences in your browser, such as the environment you chose, the colour theme, and whether you hid the getting-started guide.
• IP addresses: our servers use the requester's IP address to limit repeated attempts, such as password guessing. We don't store it with your account.

Why we use it

• To provide Gatelion. That means signing you in, running your organization's configuration, and deciding and recording agents' calls. It also means sending the emails the service needs:
  • confirmations, invitations and password resets;
  • sign-in codes;
  • approval requests, if you choose to receive them.
• To keep it secure and within its limits: to detect abuse, apply rate and usage limits, and investigate incidents.
• To help organizations get started: to see which organizations are active and how far they've got setting up, from counts and dates only, so we can help. When a new organization signs up, its name and its administrator's name and email are sent to our team.
• To meet our legal obligations.

We process this data because it's necessary to provide the service your organization signed up for, for our legitimate interests in keeping the service secure and running, to meet legal obligations, and with consent where the law requires it. We don't sell personal data, we don't use it for advertising, and we don't use your organization's data to train AI models.

Who processes it with us

We use a small number of service providers to run Gatelion: for hosting, the database, sending email, and distributing the Gateway software you download. Some of them are outside Egypt, so your data may be transferred abroad. We transfer only what each one needs to do its part, to providers bound to protect it, and on the conditions Law No. 151 of 2020 sets for cross-border transfers. Write to us at contact@gatelion.si if you'd like to know more.

Your own systems, your company login and your customer login are run by you or your providers, not by us. A Gateway installed in your network processes data on your machine and sends us only what's described above.

How long we keep it

• Unconfirmed sign-ups are removed after 7 days.
• A Gateway keeps the results of its calls for 7 days, so an agent can ask for the status of a call it made.
• The audit trail is kept as long as the organization exists, because it's tamper-evident and can't be changed after the fact. It identifies people mainly by an internal id.
• When an organization closes, we delete its data, audit trail included, within 30 days, except what the law requires us to keep.
• If you leave an organization, or your access is removed, your account stays until the organization closes or you ask us to delete it. Records of what you did remain in its audit trail while it exists.

How we protect it

Our Security page describes how we protect it. That covers isolation between organizations, encryption of secrets and approval arguments, and the audit trail. If a personal data breach affects you, we'll tell you and the authorities as the law requires.

Your rights

Under Egypt's Personal Data Protection Law, and other laws that may apply to you, you have the right to:

• know what personal data we hold about you, and get a copy of it;
• have it corrected or completed;
• have it erased or its processing restricted, where the law allows;
• withdraw consent you gave, and object to processing;
• be told of a breach that affects your data.

Write to us at contact@gatelion.si. We'll answer within the time the law sets. If your data is in Gatelion because your organization, or a business you deal with, uses it, we'll pass your request to them, because they decide about that data. You can also complain to Egypt's Personal Data Protection Center.

Children

Gatelion is a service for organizations. It isn't meant for children, and we don't knowingly collect their data.

Changes

We publish each version of this policy here, with its date. People who sign up agree to the version current at the time. For a material change, we email organizations' administrators at least 14 days before it takes effect.

Contact

Questions about privacy, or a request about your data: contact@gatelion.si.