Privacy Policy
Last updated: 19 October 2026
Who we are: Gali ("Gali", "we").
Privacy contact: privacy@iamgali.com
Gali is a Windows application that helps law offices work on their cases: chat with AI about a case, drafting documents from the office's own templates, tasks, calendar and mail. This policy explains which information passes through us, which stays with you, and why. The Hebrew version is the primary one.
1. The principle: case information stays on your computer
- Cases, documents, conversations, drafts, case memory, tasks and mail are stored on the lawyer's computer, in an encrypted database whose key is protected by the operating system. Gali does not hold a copy on its servers.
- Passwords and tokens (Odcanit, Microsoft 365, Google) are stored in the operating system's secure store on the computer and are never sent to us.
2. What passes through Gali's servers, and what is kept there
| Information | Why | Kept by us? |
|---|---|---|
| AI requests: the question, the relevant case context (document and mail excerpts, facts, office rules) and the answer | To pass them to the AI provider and return the answer | No. The server relays the request and does not store its content. Only usage data is kept: tokens, model, cost, time |
| Account and licensing: office name, members' e-mail addresses, roles, activated computers (computer name, operating system, version) | Managing licenses, invitations and computer activation | Yes, while the office is a customer |
| Billing: invoice details, plan, licenses, invoices | Charging and tax invoices | Yes, as the law requires for financial records. Card details are held by the payment processor only; we keep the last 4 digits and expiry |
| Support requests: subject, messages, and, if you agree, a diagnostics bundle | Support | Yes. The diagnostics bundle holds technical data (version, operating system, error codes) and no case content; you see it before sending |
| Team work: cases and items you shared with the office | Passing them between the office's computers | Stored encrypted with the office's key. The server does not have the key and cannot read the content |
| Marketplace: which procedures the office added | Updates and improving the catalog | Yes |
| System logs: IP address, request times, error codes | Security and operations | 30 days |
3. The AI provider
To answer, Gali sends the request, including the relevant excerpts from the case, to the AI provider. Today this is Anthropic (Claude models), through its commercial API. Under Anthropic's terms for commercial API customers, the data is not used to train models and is retained only for a limited period, for security and abuse detection. All sub-processors are listed in section 10.
4. Connections you choose to turn on
- Odcanit: Gali reads cases directly from the office's database over the office network. The data does not pass through us. Writing to Odcanit happens only after the lawyer explicitly approves each entry.
- Mail and calendar (Microsoft 365 or Gmail): Gali reads only the inbox and sent mail; other folders are never read. Mail goes directly from Microsoft or Google to your computer, not through us. Mail is linked to a case automatically only by an exact court proceeding number; everything else is proposed for your approval. A message is sent, or a calendar event written, only after your approval. Part of a message reaches the AI provider when you ask Gali to work on it, or, if you turned on the case scan, when the scan reads mail linked to a case to propose deadlines and next steps for your approval.
- Google Drive (final PDF): to convert a document to PDF, Gali uploads a copy to the office's Google account, converts it, and deletes it at once. Gali sees only files it created itself.
5. Information from Google and Microsoft
This section sets out what Gali does with information it receives from a Google account (Gmail, Google Calendar, Google Drive) or a Microsoft 365 account when you connect it.
What Gali accesses
- Mail: messages in the inbox and sent folders: sender, recipients, subject, date, message body (as text) and attachment names. An attachment is downloaded only when you add it to a case.
- Calendar: events from yesterday to 60 days ahead (title, time, location), and creating an event you approved.
- Google Drive: only files Gali itself creates to convert a document to PDF.
- Account details: the e-mail address of the account you connected.
The Google permissions requested: gmail.modify (read mail, save a draft and send after your approval), calendar.events (read the calendar and create an event you approved), drive.file (files Gali created only), and openid and email (to identify the account).
How Gali uses it
Only to provide the features you asked for: showing mail in the case it belongs to, proposing a case link, search, drafting a reply, proposing deadlines and next steps for your approval, hearing reminders, and saving a draft or sending after your approval.
Where it is stored
On your computer only, in Gali's encrypted database. Mail is not stored on Gali's servers. The account's access token is kept in the operating system's secure store.
Who it is shared with
Only the AI provider (Anthropic), and only the excerpts needed for the action you asked for or for the case scan you turned on. The request passes through Gali's server and is not stored there. The information is not sold, not used for advertising, and not transferred to anyone else unless the law requires it.
Who sees it
No one on the Gali team reads your mail, calendar or files. Exceptions: when you explicitly ask for it for support and send the information yourself, or when the law requires it.
Limited Use
Gali's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gali does not use information from Google to develop, improve or train generalized artificial intelligence or machine learning models.
Disconnecting and deletion
Disconnecting the account in Gali's settings deletes the mail synced from that account, and its token, from the computer. You can also revoke access at any time in your Google account (myaccount.google.com/permissions) or your Microsoft account.
6. What we do not do
- We do not sell data or use it for advertising.
- We do not read your case content. The Gali team has no access to it.
- We do not use your content to train models or improve the product. Aggregate usage figures (how many requests, which model) are used for operations and billing.
7. Security
Encryption on the computer (SQLCipher), encryption in transit (HTTPS), signed requests from every activated computer, secrets kept in the operating system's secure store, and separation between offices. If a security incident affects your information, we will notify you as the law requires, including the Israeli Privacy Protection (Data Security) Regulations, 2017.
8. Where data is hosted
Gali's servers run on Google Cloud in the Israel region (Tel Aviv). The account database is hosted by Neon in the European Union (Frankfurt). The AI provider and the sign-in provider process data in the United States.
9. Retention and deletion
- Case content on the computer: under your control. Uninstalling Gali does not delete it, to prevent loss; the data folder can be deleted.
- When an office closes: team-work data and phone relay data are deleted automatically, and its computers are disconnected after 30 days. Account and invoice records are kept as the law requires.
- You can ask to see, correct or delete personal information by writing to privacy@iamgali.com.
10. Sub-processors
| Provider | Service | What it processes | Location |
|---|---|---|---|
| Anthropic, PBC | AI models (Claude) | AI requests: questions, the case excerpts sent with them, and the answers | United States |
| Google Cloud | Hosting of Gali Cloud, logs, secrets, update files | Account, licensing and usage data; AI requests in memory only while relayed | Israel (Tel Aviv) |
| Neon | Managed database | Account, licensing, usage, billing, support, and encrypted team-work data | European Union (Frankfurt) |
| Clerk | Sign-in and identity | Name, e-mail address, sign-in events | United States |
| Cardcom | Card payments and tax invoices | Billing details, card token, charges and invoices | Israel |
Services a lawyer connects on their own computer (Microsoft 365, Google, Odcanit) are not Gali sub-processors: the data goes directly between the computer and that service, under the office's own agreement with it.
11. Changes
If we change this policy materially, we will tell you in the product and by e-mail to the office owner before the change takes effect.