Privacy Policy for California Residents
Last updated: November 9, 2026
This notice supplements the Gab AI Privacy Policy for California residents and explains our practices and rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). References to selling or sharing have their statutory meanings. Rights apply subject to the law’s scope and exceptions.
Information We Collect
| Category | Information and purpose | Sources and recipients |
|---|---|---|
| Identifiers and customer records | Account name, email, user ID, IP address, contact and billing details, authentication and transaction records. Payment credentials may be processed directly by the payment provider. | You, your device, sign-in and payment providers. Hosting, security, authentication, payment and support providers; affiliates for operations. |
| Commercial information | Subscriptions, purchases, credits, payment status and transaction history. | You and payment providers. Hosting, payment, accounting and support providers. |
| Internet or electronic activity | Page visits, feature use, events, device/browser details and service diagnostics; browsing content you authorize Work to access. | Your device and authorized services. Hosting, infrastructure, security and support providers; model and tool providers for requested tasks. |
| Geolocation | Approximate location from IP or country information. Precise location only if you supply it in content or authorize access to it. | You, your device and authorized content. Hosting, security, model and tool providers as needed for your request. |
| Audio, visual and similar information | Uploads, generated media, voice inputs, and permitted screenshots or browser content. | You and authorized sources. Hosting, storage, media, model and tool providers needed for processing. |
| Professional, employment and education information | Information you supply in your profile, conversations, files or tasks. We do not require an employment or education history to open an account. | You and authorized sources. Hosting, model, tool and support providers needed for processing. |
| Protected characteristics | Information such as age, religion or other protected characteristics if included in your content. We do not require a demographic profile to open an account. | You and authorized sources. Hosting, model, tool and support providers needed for processing. |
| Inferences | Preferences, saved memories and context derived from your interactions to personalize the Service; fraud and abuse indicators. | Your interactions, device and service records. Hosting, security, model and tool providers needed for the relevant function. |
| Sensitive personal information | Account access credentials and connection tokens; private communications; precise location, health information, beliefs or other sensitive information if included in material you provide or authorize. Avoid providing sensitive information that a task does not need. | You, sign-in providers and authorized connections. Authentication, hosting, security, model and tool providers as needed for the requested function. |
| Biometric information | We do not require biometric identification to use the Service. Audio, images or files you choose to submit may contain biometric information. | You and authorized content. Hosting, media, model and tool providers as needed to process that content. |
Collection, Sources and Retention
The categories above describe information collected during the preceding 12 months, including information collected only when a user supplies it or enables a feature. Not every example is collected from every user. Publicly available, deidentified or aggregated information is outside this notice where the CCPA excludes it.
We also receive information from people who contact us, workspace administrators, and services you connect or direct us to use. We use information to deliver requested features, manage accounts and payments, personalize responses, provide support, measure and improve performance, prevent fraud and abuse, and meet legal obligations. We do not collect or retain more personal information than reasonably necessary and proportionate for these purposes.
Retention depends on each category’s purpose, the account or transaction status, security needs and applicable legal requirements. Account content is kept for the service and applicable deletion process. Payment, consent and dispute records may need longer retention for accounting or legal obligations. The Privacy Policy explains deletion, backups, separate Work records and exceptions. Earlier deletion commitments remain applicable.
Disclosures and Previous Measurement
The third column identifies sources and business-purpose recipients for each category. We may also disclose relevant categories to recipients you direct, workspace members within their permissions, professional advisers, authorities when legally required, and parties to a business transaction subject to applicable safeguards. Providers acting on our behalf are subject to applicable contractual restrictions. Independent payment providers and destinations you direct us to contact may also process information for their own disclosed purposes.
In the preceding 12 months, website measurement could disclose identifiers, internet activity, approximate location and conversion or commercial information to Meta/Facebook, Reddit and Whop. Those disclosures may constitute sharing for cross-context behavioral advertising under California law. Meta/Facebook and Reddit tracking are disabled, and we have removed the Whop website analytics pixel. Current website analytics use our in-house, self-hosted Matomo installation. Whop payment services remain available.
We do not sell personal information for money. We do not currently use the retired advertising trackers to sell or share website activity. You may still exercise rights concerning earlier disclosures. We do not knowingly sell or share personal information of anyone under 16, and our Service is intended for adults. We use sensitive information to provide requested services, secure accounts, prevent abuse, and perform other purposes permitted without a right to limit; any additional use requiring that right will be subject to the applicable notice and choice.
Your California Privacy Rights
You may request to know and access the personal information we hold about you, including specific pieces, categories, sources, purposes, and categories of recipients, and information about sale, sharing and business-purpose disclosure. Where required, we provide a portable copy. Applicable access rights may extend beyond the preceding 12 months.
You may request deletion of personal information and correction of inaccurate personal information, subject to lawful exceptions. You may opt out of sale or sharing and, where applicable, limit use or disclosure of sensitive personal information. We will not discriminate against you for exercising these rights. A feature may require information necessary to provide the feature.
How to Submit a Request
Email legal@gab.ai with your request and the email associated with your account, if any. You can also contact help@gab.ai for assistance, update available account fields in Settings, or use account-deletion controls. You do not need to create an account to exercise your rights. Please do not send passwords, full payment-card numbers or identity documents with an initial request.
For access, deletion or correction, we verify identity using information appropriate to the request’s sensitivity, such as an authenticated account or confirmation through an address we already hold. We request additional information only where reasonably needed, use it for verification, and explain if we cannot verify a request. We do not require identity verification for sale/sharing opt-outs, although we may request information needed to apply the choice.
An authorized agent may submit a request on your behalf. We may require proof of signed permission and, where allowed, verify your identity or directly confirm your authorization. A valid power of attorney is handled under applicable law.
Response Times and Decisions
We acknowledge requests to know, delete or correct within 10 business days and generally respond within 45 calendar days of receipt. If reasonably necessary and permitted, we may extend by up to 45 additional days and explain the reason within the initial period. We process sale/sharing opt-outs and applicable sensitive-information limitations as soon as feasible and within 15 business days.
If an exception prevents all or part of a request, we explain the reason and any available review or complaint options. Requests are normally free. Any permitted fee or refusal for manifestly unfounded or excessive requests will be explained. Contact legal@gab.ai to ask us to review a decision. You may also complain to the California Privacy Protection Agency or California Attorney General.
Browser Choices and Accessibility
Our Privacy Policy describes current analytics controls and how we respond to browser privacy signals. Browser choices do not automatically apply to other devices, native apps, or independent payment services. Contact legal@gab.ai for a request concerning information already held or previously disclosed.
For an accessible alternative format of this notice or help exercising your rights, contact help@gab.ai. We review this notice at least annually and update it when our practices materially change.