Privacy Policy
Last updated October 5, 2026
The short version
- We collect what's needed to run Gusset: your account details, the record you write, and how the service is used.
- We never sell your information, never use it for advertising, and never use it to train AI.
- Your record is stored in Canada. Some of our service providers process information in the United States.
- Gusset takes words only. There is no way to attach a file or a photo.
- You can download everything we hold about you, or delete your account and everything in it, at any time in Settings.
- No advertising cookies, no trackers, no cookie banner. See Cookies.
1. Who is responsible
Gusset is operated by Mridul Sharma, an individual in New Brunswick, Canada ("Gusset", "we", "us"), who is responsible for the personal information described here.
Privacy officer: Mridul Sharma, support@gussetlog.com. Write with any question, request or complaint.
Mailing address: Gusset, 100 Jenkins Dr, Douglas, NB E3A 9E5, Canada
This policy follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to us, the privacy laws of the United States and its states.
2. What we collect
| Category | What | Why |
|---|---|---|
| Account | Your name, email address, province or state, discipline, and the month you started work | To run your account |
| Sign-in with Google or Microsoft | Only if you choose one of them instead of the email code: your name, your email address, whether they have verified that address, and their id for your account. We ask for nothing else (no contacts, calendar, files or photo) and keep nothing else they send | To sign you in, and to match you to your one Gusset account |
| Your record | The entries you write or dictate, their dates, hours, projects and competency tags, drafts of write-ups, and the name and professional title of a supervising engineer if you give one | The service itself |
| Chats with Gus | What you type to Gus and what he answers, and the short memory shown under Settings > What Gus remembers | So you can pick a chat back up, and so Gus can file new notes sensibly |
| What you agreed to | That you confirmed being 18 or older, which version of the terms you agreed to, and each email, notification, marketing and renewal consent, with its exact wording and time | Proof of consent |
| Payment | Your plan, currency, and renewal date. Your card is handled by Stripe; we never see or store the full card number | Billing |
| Email and notification settings | Which optional emails you switched on, the time and time zone you chose, and, if you switch on notifications for a device, that device's address at its browser's notification service | To send what you asked for, when you asked |
| Messages to us | What you send through Help or by email, your email address, the page you were on and your browser type | To answer you |
| Usage and technical | Counts of AI requests and what they cost, records of errors and of limits being reached, which emails were sent to you (not their content), and counts of page views made without cookies. Your IP address is used in passing to deliver pages and limit abuse, and is not stored with your account | Security, cost control and keeping the site working |
We do not ask for and do not want sensitive information such as health, financial, government-ID or biometric information, or other people's personal information beyond a supervising engineer's name and title. Please keep it out of your entries.
3. How we use it, and what we never do
We use personal information only to: provide Gusset; draft entries and write-ups from what you give us; send service emails (sign-in codes, receipts and subscription terms, renewal notices, confirmations); send the optional emails and notifications you switch on; keep the service secure, within its limits and working; answer you; and meet our legal obligations.
We never sell or rent your information. We never share it for advertising or use it to advertise to you. We never use your record to train AI models. Gusset makes no automated decisions about you: Gus only suggests drafts, and you decide what to keep.
We rely on your consent, which you give when you create an account and agree to this policy, and which you can withdraw (see section 7). Optional emails, notifications and news each need their own separate yes, and are off until you give it.
4. Your words and AI
- What you type or say is sent to draft the entry, and we keep the entry. Gusset does not accept files, photos or documents.
- Drafting is done by Anthropic (the Claude API), in the United States. Under Anthropic's commercial terms it may not train its models on what we send. Anthropic keeps what we send only for a limited period set out in its own terms, to provide the service and check for misuse, and then deletes it.
- AI drafts can be wrong. Review everything before you rely on it.
- Don't enter confidential, client-identifying or export-controlled information. See the Acceptable Use Policy.
5. Who processes it for us, and where
We share personal information only with the service providers below, who may use it only to provide their service to us, and each of which we have chosen for its security practices and bound by its contract terms.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Canada (Central) |
| Anthropic | AI drafting of entries and write-ups | United States |
| Cloudflare | Hosting the site, protecting it from abuse, page-view counts without cookies, the "are you a person" check on the signed-out contact form | Worldwide network, including the United States; processed where you connect |
| Stripe | Payments | United States and Canada |
| Resend | Sending email | United States |
| Google or Microsoft | Signing you in, only if you choose "Continue with Google" or "Continue with Microsoft". They learn that you signed in to Gusset and when; they never see your record | Where that company runs its sign-in |
| Apple, Google, Mozilla or Microsoft (your browser's notification service) | Delivering a reminder notification, only if you switch it on for a device. They carry it encrypted and cannot read it | Where that service runs |
We may also disclose information if the law requires it (for example, a court order), or to a successor if Gusset is ever transferred to a company we form or to a buyer, who must honour this policy; we would tell you first.
Information processed outside Canada. Your record is stored in Canada. The providers above marked United States (and Cloudflare's network) process some information outside Canada. While it is there it is subject to the laws of that country, and may be accessed by its courts, law enforcement and national security authorities under those laws. By using Gusset you consent to this. If you have questions about how these providers handle information, ask the privacy officer.
6. How long we keep it
| What | How long |
|---|---|
| Your record, chats, drafts and settings | Until you delete them or your account |
| A deleted account | Removed from the live database at once, along with its entries, chats, drafts, consents and notification devices. Copies in our database provider's routine backups are overwritten on its schedule, within 30 days |
| Messages to support | 24 months, then deleted |
| The log of which emails were sent to you (no content) | 24 months, then deleted |
| Records of errors and of limits being reached | 90 days, then deleted |
| Records of what AI requests cost | Kept for accounting, with no link to you once your account is deleted |
| Records of a privacy breach, if one ever happens | At least 24 months, as the law requires |
| Billing records | Held by Stripe for as long as tax and payment laws require (in Canada, generally six years after the end of the tax year they relate to) |
| What our AI provider receives | A limited period set by its own terms, then deleted |
7. Your choices and rights
- See and download. Settings > Download my data gives you everything we hold about your account in one file. Export gives your entries as a spreadsheet and your drafts as documents.
- Correct. Edit your profile and any entry in the app, or ask us.
- Delete. Settings > Delete account removes your account and everything in it, and ends any subscription.
- Withdraw consent. Switch optional emails, notifications and news off in Settings, or use the unsubscribe link in any of those emails; it works at once. Withdrawing consent to this policy as a whole means deleting your account, because we can't run it otherwise.
- Ask or complain. Write to the privacy officer. We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
We will not treat you differently for using any of these rights. To protect you, we may need to confirm it's you, which signing in normally does.
8. If you live in the United States
Depending on your state, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to appeal if we refuse a request. Use the tools in section 7 or write to support@gussetlog.com; to appeal, reply to our answer and say so, and we will have it looked at again and tell you the result, and how to contact your state's attorney general if you are still not satisfied.
- We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not use it for targeted advertising or for profiling that produces legal or similarly significant effects.
- We do not knowingly collect sensitive personal information.
- California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing.
- You may use an authorised agent to make a request; we will ask for proof that the agent acts for you.
Most US state privacy laws apply only to businesses much larger than Gusset. We offer these rights to everyone regardless.
9. Global Privacy Control and "Do Not Track"
If your browser sends a Global Privacy Control signal, we record it on your profile and honour it as a request not to sell or share your information. We don't sell or share it in any case, and there are no trackers to switch off.
10. Emails and notifications
Three kinds of email are sent only if you switch them on in Settings, and each is off until you do: a reminder to log your work, a progress recap (with a note when you reach a milestone), and news from Gusset. We keep the wording you agreed to, when, and where, for each one. Every such email names us, gives our mailing address and has an unsubscribe link that works at once.
The recap is made from your entries' titles, dates, hours and competency tags. It never includes what an entry says, its outcome, or a supervisor's name. To send reminders and recaps at the right time we keep your device's time zone.
If an email to you bounces or is marked as spam, our email provider tells us, and we stop sending optional emails to that address until you switch them back on.
Emails about your account (sign-in codes, receipts, subscription terms, renewal notices, confirmations) are sent regardless, because you need them.
Notifications on your device. If you switch on "Notify me on this device", the reminder also arrives as a notification on that phone or computer. It is off until you switch it on, and one switch turns it off. The notification is encrypted for your device and only ever says it is time to log: nothing from your record.
How you sign in. You can sign in with a code we email you, or with Google or Microsoft. The email code always works. Under Settings > Account you can see how you sign in, add or remove Google or Microsoft, and change your sign-in email (we send a code to the new address and one to the current address, and need both). We only match a Google or Microsoft sign-in to an existing account when that company says the email address is verified. Use a personal account, so your record stays with you if you change jobs.
11. Security and breaches
We protect your information with encryption in transit and at rest; database rules that let each account read and change only its own data; sign-in without passwords; limits on how often anything can be asked; a strict content security policy; and as little access for us as the work needs. No system is perfectly secure, and we cannot promise that yours will never be breached.
If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner of Canada as soon as feasible, and keep a record of it for at least 24 months. If you live in the United States, we will also notify you, and your state's authorities where required, within the time your state's law sets.
12. Children
Gusset is for adults. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its information. If you believe a child has given us information, write to support@gussetlog.com.
13. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in Gusset before the change takes effect, and ask you to agree to it where the law requires consent. The date at the top shows when it last changed.
14. Contact
Privacy officer: Mridul Sharma, support@gussetlog.com
Mailing address: Gusset, 100 Jenkins Dr, Douglas, NB E3A 9E5, Canada