Skip to content
GatherStudio Planning Tool
Back to App

Privacy Policy

Last updated: October 5, 2026 · Effective date: October 5, 2026

Our Privacy CommitmentGather by Shortcut (Toma El Atajo SAPI de CV) respects your privacy. We only collect the minimal information necessary to authenticate you and power your studio planning workspace. We do not sell, rent, or monetize your personal data.

1. Purpose of Gather

Gather is a resource planning, capacity scheduling, and project forecasting platform built for design, creative, and engineering studios. It enables organizations to plan client projects, allocate team capacity, and monitor delivery margins.

2. Information We Collect

When you sign in to Gather using Google OAuth or Email Magic Links, we receive standard basic profile information:

  • Name: To identify you within your studio workspace and project assignments.
  • Email Address: To authenticate your account and route workspace invitations.
  • Profile Photo (Avatar): To display your avatar on team timelines and assignments.

3. Google User Data Policy Compliance

Gather's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • Authentication Scopes: We request only the minimum necessary identity scopes: openid, email, and profile.
  • Google Calendar Synchronization: When a studio workspace connects the Google Calendar integration, we request access to the Google Calendar API (https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.readonly) solely to synchronize studio time off and scheduled allocations to your designated calendar.
  • AES-256-GCM Token Encryption: All OAuth tokens, refresh tokens, and credentials received from Google are encrypted at rest using industry-standard AES-256-GCM authenticated encryption before being saved to our database.
  • No Advertising or AI Model Training: We do not use Google user data for advertising or marketing, nor do we transfer or use Google user data to train, tune, or improve generalized AI or machine learning models.
  • No Data Sales: We do not sell Google user data to third parties.
  • Human Access Restrictions: We do not allow humans to read your private calendar or profile data unless required for security investigations, with your explicit consent, or as strictly mandated by law.

4. Third-Party Service Providers (Subprocessors)

To deliver and secure Gather, we partner with trusted third-party service providers who process data on our behalf as subprocessors under strict data protection standards:

ProviderPurposeData HandledLocation
Vercel, Inc.Application hosting, edge runtime & deploymentTransient HTTP request traffic, serverless executionsUnited States (Global Edge Network)
PostHog, Inc.Product analytics & session replayUsage telemetry, navigation paths (sensitive inputs masked)United States
Neon, Inc.Serverless PostgreSQL databaseEncrypted application & workspace dataUnited States (AWS)
Cloudflare, Inc.CDN, edge network & R2 storageWorkspace avatars, static assets, edge network routingGlobal Edge Network
Resend, Inc.Transactional email deliveryEmail addresses, magic links, invitation messagesUnited States
Stripe, Inc.Subscription billing & paymentsBilling contacts, payment methods (PCI-DSS Level 1)United States
Slack Technologies, LLCStudio notifications & bot integrationTime-off digests and member statusUnited States
Google LLCOAuth sign-in & Google Calendar syncUser profile and time-off calendar eventsUnited States / Global

5. Data Storage & Security

All workspace data is stored in encrypted PostgreSQL databases hosted in secure cloud infrastructure (AWS/Neon). We enforce tenant isolation, Row-Level Security (RLS), and encryption in transit (HTTPS/TLS) and at rest.

6. Your Data Rights & Deletion

You have full rights to export or delete your personal and workspace data at any time:

  • Workspace Export: Studio Admins can export all workspace data in structured JSON format via Settings.
  • Account & Workspace Deletion: You may request complete account deletion by contacting our privacy team or using the in-app deletion tools.

7. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us:

Shortcut (Toma El Atajo SAPI de CV)