Privacy Policy

We collect the following categories of information:

• Google sign-in profile information. When you sign in with Google, we receive your name, email address, profile image/avatar, and Google account identifier.
• GoalLens account activity: Invitation and workspace membership status, and sign-in timestamps.
• Workspace information. Workspace names, goals, KPIs, goal-KPI links, sources, analysis results, reports, and workspace settings you create or configure.
• Uploaded evidence files. Files you upload to GoalLens, which may include CSV, XLSX, DOCX, PDF, TXT, PPTX, and other supported formats.
• Extracted and processed content. Parsed text, normalized evidence, summaries, signals, metadata, and GoalLens Map data derived from your uploaded or connected sources.
• Connected source information. If you connect Jira, we collect your Jira site URL, project key, issue type selections, sync status, issue metadata, and synced roadmap/epic-level issue data.
• Secrets and credentials. If you provide Jira API tokens or similar credentials, they are stored encrypted and are not displayed after saving.
• Usage and diagnostic data. Routes viewed, actions taken, analysis runs, upload events, errors, performance information, and browser/device metadata.

We use the information we collect to:

• Provide and operate the GoalLens product.
• Authenticate users via Google, email/password, and magic link.
• Manage workspaces, goals, KPIs, sources, and analysis results.
• Parse and normalize uploaded and connected evidence.
• Generate AI-assisted analysis, recommendations, alignment insights, risks, gaps, and reports.
• Improve reliability, security, debugging, and product quality.
• Manage invite-only access and understand how the product is used.
• Prevent abuse and manage operational costs.

GoalLens supports three sign-in methods: Google OAuth, email and password, and magic link (a one-time sign-in link sent by email). All three methods authenticate your identity; access to workspaces and data is controlled separately through GoalLens' invite-only, organization-first access model.

Google OAuth:

• When you sign in with Google, GoalLens receives your name, email address, profile picture, and Google account identifier.
• We do not use Google sign-in data for advertising.
• We do not sell Google user data.
• We do not access Google Drive, Gmail, Google Calendar, or other Google Workspace data unless a future feature explicitly requests that permission.
• GoalLens' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Email and Password:

• Password authentication is handled by Supabase Auth. GoalLens does not store raw passwords. Passwords are hashed and managed by Supabase using industry-standard cryptographic practices.
• You can set or update your password using the Forgot Password flow from the sign-in page.

Magic Link:

• Magic links are one-time sign-in links sent to your email address. Each link is valid for a single use and expires automatically.
• Magic links are generated and delivered by Supabase Auth.

GoalLens processes uploaded source files to extract relevant goal, KPI, risk, evidence, and execution signals. Evidence signals are scored and filtered before analysis. The AI model receives structured excerpts, summaries, metadata, and scored evidence signals needed to generate the analysis.

• GoalLens does not intentionally send raw uploaded files, credentials, or secrets to AI providers.
• Users should not upload regulated or highly sensitive personal data — including HIPAA-covered health information, payment card data, or government-issued identification numbers — unless covered by a separate written agreement with GoalLens.
• AI-generated outputs may include summaries, recommendations, risks, gaps, and alignment analysis. These outputs are suggestions and should be reviewed before being relied upon for decisions.
• GoalLens currently uses OpenRouter to call AI language models. The specific models used may change over time as we improve the quality of analysis.

GoalLens may share data with service providers necessary to operate the product, including:

• Hosting and infrastructure providers
• Database and storage providers
• Background worker infrastructure
• AI and model providers
• Authentication providers
• Connected source APIs such as Jira, when you choose to connect them

In addition:

• We do not sell personal information.
• We do not share user data for third-party advertising.
• We may disclose information if required by law, or to protect the security, rights, or safety of GoalLens, our users, or others.

• GoalLens uses reasonable technical and organizational measures to protect information.
• Jira API tokens and connector secrets are encrypted before storage where implemented.
• Secrets are not displayed after saving.
• We aim to ensure secrets are not logged or sent to AI providers.
• No system is completely secure, and we cannot guarantee absolute security.

GoalLens retains account, workspace, source, analysis, and activity data while your account or workspace is active.

• Active workspaces and their data are retained until the workspace is archived or deleted by an organization administrator.
• Archived workspaces are recoverable for 30 days after archiving. After the 30-day retention window, workspaces and all associated data — including source files, extracted evidence, analysis results, goals, and KPIs — are permanently deleted and cannot be recovered.
• Individual source files can be deleted from a workspace by editors and administrators. Deleting a source file removes the uploaded file and its extracted evidence from the workspace permanently.
• Some records — including audit logs and anonymized usage metrics — may be retained for longer periods as required for security, backups, debugging, legal compliance, or audit purposes.
• When you disconnect an integration (such as Jira), credentials may be deleted or invalidated. Previously synced evidence may remain in your workspace unless deleted separately.
• You may request deletion of your information at any time (see Section 8).

You may request to:

• Access the information we hold about you
• Correct inaccurate information
• Delete workspace data
• Delete uploaded files or connected source data where supported
• Disconnect integrations
• Request account deletion

To submit a request, contact us at admin@goallens.ai.

GoalLens is not intended for children under the age of 13 and should not be used by children. We do not knowingly collect personal information from children under 13.

GoalLens may process data in the United States or other locations where our service providers operate. By using GoalLens, you acknowledge that your information may be transferred to and processed in countries other than your own.

GoalLens uses the following third-party service providers to operate the product. GoalLens remains responsible for how these providers handle data on our behalf.

• Supabase — database and file storage (United States region). User accounts, workspace data, and uploaded files are stored in Supabase-managed infrastructure.
• Vercel — web application hosting and edge network (global CDN). The GoalLens product interface is hosted on Vercel.
• Google Cloud Platform (us-central1) — background worker processing. Evidence extraction, analysis generation, and workspace cleanup jobs run on Google Cloud Run in the us-central1 region.
• OpenRouter — AI inference. GoalLens routes AI analysis requests through OpenRouter to language models. Scored evidence signals and structured excerpts are sent; raw files and credentials are not intentionally transmitted.

By using GoalLens, you acknowledge that your information may be processed in the United States or other locations where our service providers operate.

GoalLens operates across two domains:

• goallens.ai — the GoalLens marketing website, where you can learn about the product and request access.
• app.goallens.co — the GoalLens product application, where you access workspaces, upload evidence, and run analysis.

Both domains are operated by GoalLens and are covered by this Privacy Policy. This policy applies to information collected and processed through both domains.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. We encourage you to review this policy periodically.

If you have questions or concerns about this Privacy Policy or how we handle your information, please contact us at:

admin@goallens.ai