Privacy Policy

Last updated: 10 October 2026

Arete Tech Labs LLP ("we", "our", "us" or "GoBananas") is committed to protecting the privacy of everyone who visits our website at https://gobananas.so/ (the "Website") and uses the GoBananas platform.

Please read the following privacy policy (the "Privacy Policy"), which describes how GoBananas collects and processes the personal information you provide when using the Service. This includes the Website and its subdomains, the GoBananas web and desktop applications, and any related content, software, integrations, materials and services made available by GoBananas (together, the "Service").

GoBananas is an AI-enabled collaborative workspace and content-management platform for teams that create, manage, review, store and publish digital content. It allows users and organizations to organize projects and workflows, upload and store digital assets, collaborate with team members, give and receive feedback, manage versions and approvals, share or release content, and manage team members, permissions and access.

We process personal information where it is necessary to perform our contract with you or your organization, to comply with our legal obligations, where we have a legitimate interest in providing, securing and improving the Service, and, where the law requires it, with your consent. We do not treat your general use of the Service as consent where applicable law requires a specific, informed choice.

The Service is intended for adults aged 18 or older and is available globally.

INFORMATION WE COLLECT FROM YOU AND HOW WE USE IT

General

In general, you may visit our Website without disclosing your identity or providing any personal information. You will be required to provide certain personal information if you register an account, join a workspace, use features that require such information, subscribe to a paid plan, or contact us by email or other means, as described below. Like many online services, we also automatically collect certain technical information through the servers and technologies used to operate and support the Service.

Registering an Account and Workspaces

To use the Service you must register an account, either with an email address and password or by signing in with Google. When you register we collect your name, email address and, if you provide it, your phone number and profile image. If you sign in with Google, Google provides us with your email address, name and profile image so that we can create, authenticate or link your account.

When you sign in we also record information about the device and session used, including a device identifier, device name, browser user agent, platform, IP address and the time of login. We use this information to secure your account and to help you recognise and manage active sessions.

GoBananas is organized into workspaces. When you create or join a workspace we store your membership, role and permissions, and the organization or workspace to which you belong. Workspace owners and administrators can see the members, content, activity, integrations and billing of their workspace. Other members see only what their role and the permissions set on individual items allow.

Content You Create and Upload

The Service exists to help you and your team store and work on content. We process the projects, tasks, workflows, comments, approvals, prompts, text, documents, files, images, audio, video and other material that you or members of your workspace submit (together, "User Content"). Uploaded files are stored in Microsoft Azure Storage, and the records describing them are stored in our database.

You are responsible for the content you choose to upload and for having a lawful basis to share any information in it that relates to other people. Content you share within a workspace is visible to the members of that workspace according to its roles and permissions, and we cannot control what those members do with it.

GoBananas is not intended for the storage of regulated or highly sensitive information such as health records, financial-account credentials, government identification numbers, biometric identifiers or information relating to children, and you should not use the Service for such purposes.

Google Drive Connector

Connecting Google Drive is optional. You can use GoBananas without connecting Google Drive.

If an authorized member of your workspace chooses to connect Google Drive, GoBananas uses Google's OAuth protocols to establish the connection and requests the limited `drive.file` permission together with the connected account's email address. Browsing and selecting files happens inside Google Picker, an interface controlled by Google. GoBananas receives access only to the files you select through Google Picker or that are created through GoBananas. GoBananas does not receive permission to browse, search or access the rest of your Google Drive.

For the files you select or create through GoBananas we may process the file identifier and name, the file type, the web-view, icon and thumbnail links provided by Google, the last-modified time and trashed status, change information needed to keep the status of the selected file up to date, and the email address of the connected Google account. At your direction GoBananas may create Google Docs or Google Sheets, update files you selected or created through GoBananas, and add or change the sharing permissions of those files for members of your workspace, subject always to your own permissions in Google Drive.

What happens to a selected file depends on its type. When you import a video, audio or other uploaded file from Google Drive, GoBananas downloads the file and stores a copy in our Microsoft Azure Storage. From that point the copy is treated like any other file uploaded to GoBananas: it becomes part of your workspace's User Content, is available to the members of your workspace according to its roles and permissions, and is processed by the same features as other uploads, including the AI-enabled features and video processing described below. Changes you later make to the original file in Google Drive are not applied to the copy.

When you select a Google Doc or Google Sheet, GoBananas keeps a synchronized copy of its content so that the document can be viewed and worked with in GoBananas. GoBananas uses Google's change notifications to refresh the copy when the document changes in Google Drive, and where you edit the document through GoBananas, your changes are written back to the original in Google Drive. Synchronized documents are also treated as User Content within your workspace.

We use Google user data only to connect your Google account or workspace; to display, link, import, create, update, share and synchronize the files you selected or created through GoBananas; to provide the features of the Service to the imported and synchronized copies, including AI-enabled features that you or your workspace use; to maintain the security and reliability of the connector; and to produce aggregated or de-identified usage statistics that help us understand and improve the connector. We do not use Google Drive file contents, file names, links or account identity for advertising, and we do not use Google user data to train AI models. Where imported or synchronized content is processed by Microsoft Azure AI services or Mux, this is done solely to provide features of the Service to you, and those providers are prohibited from using the content to train their models.

We store the imported and synchronized copies in Microsoft Azure Storage and our database, together with the metadata and links needed to maintain the connection. The OAuth access and refresh tokens that Google issues to us are encrypted using AES-GCM and protected by access controls. GoBananas personnel may access Google user data only when you ask us for support, when access is necessary to investigate a security issue, or when required by law. We disclose Google user data only to the service providers that host or operate the Service on our behalf, within your workspace in accordance with its roles and permissions, at your direction, or where required by law or necessary to protect users, GoBananas or others. We do not sell Google user data.

You may revoke GoBananas's access at any time by disconnecting Google Drive in your workspace settings or by removing GoBananas's permissions through your Google account at https://myaccount.google.com/permissions. When the connection is disconnected or revoked, GoBananas stops accessing Google Drive through that authorization, stops synchronizing Google Docs and Sheets, and deletes the stored access and refresh tokens, connected-account information and change-monitoring state. Stored links and metadata associated with the connection are deleted from our active systems within 30 days, and any residual copies in backups expire within 90 days.

Copies of files that you imported, and the last synchronized version of any Google Doc or Sheet, remain in your workspace as User Content after disconnection, because you chose to bring them into GoBananas. You or an authorized member of your workspace can delete them at any time from within the Service, and they are deleted when the workspace or account is deleted, in each case under the retention periods described in the Data Retention section. You may also request deletion of any Google-derived data by writing to hello@gobananas.so.

GoBananas's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI-Enabled Features

When you use AI-enabled features, GoBananas sends the relevant prompts, content and workspace context to Microsoft Azure AI services in order to provide the feature you requested. Files in your workspace, whether uploaded directly or imported or synchronized from Google Drive, may also be processed by Azure AI services for features such as transcription, optical character recognition, image analysis, embeddings, search and review insights, and videos may be processed by Mux for encoding, playback and captions.

Our agreements and configurations with Microsoft prevent the content you submit from being used to train third-party foundation models. GoBananas does not currently train or fine-tune its own models using customer content. If we ever propose to do so, we will first obtain separate, informed, opt-in authorization from both your organization and you, the option will be off by default, and you will be able to withdraw at any time. Google user data is never used to train AI models.

AI output may be inaccurate or incomplete and should not be relied upon as professional advice.

Subscriptions and Payments

If you or your organization subscribe to a paid plan, we collect subscription, purchase, invoice and transaction information. Payments are processed by Razorpay. To create your billing profile and prefill checkout we may share your name, email address and phone number with Razorpay. Razorpay processes your payment-card details directly; GoBananas does not receive or store full payment-card numbers.

Communications

When you contact us for support or otherwise, we keep a record of the correspondence so that we can respond to you and improve the Service. We use your contact details to send you account, security, billing, service and support communications. GoBananas does not currently send promotional marketing communications.

Technical and Usage Information

Our servers and applications automatically record technical information, including your IP address, operating system, browser, device information, identifiers, the pages and features you use, the dates and times of access, performance data and error diagnostics. We use this information to operate and secure the Service, to diagnose problems, and to understand and improve how the Service is used.

HOW WE USE AND SHARE YOUR INFORMATION

We use the information described above to create and manage accounts and workspaces; to provide the collaboration, content-management, file, personalization and AI features of the Service; to process subscriptions and payments; to send transactional, service and support communications; to analyze and improve the Service; to detect, investigate and prevent fraud, abuse and security incidents; to enforce our terms and protect legal rights; and to comply with applicable law.

Where your organization provides your GoBananas workspace, the organization determines how workspace content is used and GoBananas processes that content on the organization's behalf. GoBananas remains independently responsible for the processing it determines itself, such as account administration, billing, security and the operation of the Website.

We share personal information with service providers that process it on our behalf and under our instructions. Our current providers are Microsoft Azure (hosting, storage, key management, AI services and the workflow we use to send transactional email), a MongoDB-compatible database service, Razorpay (payments), Google (sign-in and the Google Drive connector), Amplitude and Google Tag Manager (product analytics) and Mux (video processing and playback). We intend to move transactional email to SendGrid and will update this Privacy Policy before doing so.

We also share information within your workspace according to its roles and permissions, with the organization that provides or administers your workspace, at your direction or with your consent, and where we are required to do so by applicable law, regulation, legal process or an enforceable request from a regulatory or law-enforcement authority, or where disclosure is necessary to protect the rights, safety and security of users, GoBananas or others.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

COOKIES AND THIRD PARTY SERVICE PROVIDERS

Like many online services, we use application logs, browser storage and similar technologies to operate the Service and to understand how it is used.

The GoBananas application stores information in your browser's local storage, session storage and IndexedDB that is necessary for the Service to work, including your session token, your user and workspace details, a device identifier, access information for uploading files, your preferences, and the state of uploads and downloads in progress. Clearing this storage will sign you out and may interrupt uploads or downloads in progress.

Product Analytics: We use Google Tag Manager to manage analytics tags on the Website and in the application, and Amplitude to understand how the Service is used, identify problems and improve the experience. Analytics events may include your user ID, email address, workspace role and workspace name together with information about the features you use, your device and errors you encounter. Analytics information is generally retained for up to 14 months.

Third-party content and services embedded in or loaded by the Service, including Google Picker, Razorpay checkout, Mux video playback and Google fonts, may set or read their own cookies and collect information under their own privacy policies. We do not use advertising trackers.

LINKS

The Service may contain links to websites and services that are not operated by or on behalf of GoBananas ("Third Party Sites"), including Google Drive files you have connected. These links are provided for your convenience. This Privacy Policy does not apply to Third Party Sites. We have not reviewed, and do not control, such sites and are not responsible for their content, privacy policies or practices. If you access a Third Party Site, you do so subject to that site's terms and privacy policy.

TRANSFER OF INFORMATION ACROSS NATIONAL BORDERS

Arete Tech Labs LLP is based in India. In order to provide the Service we store and process personal information in India and with service providers in other countries, including the United States, some of which may have data-protection laws that are less protective than those of the country in which you reside. GoBananas does not promise that your data will remain in a particular country or region. Where applicable law requires it, we rely on appropriate safeguards for international transfers, and you may contact us using the details in the Contacts section for more information.

DATA RETENTION

We retain personal information only for as long as is reasonably necessary to provide the Service, to meet our legal and accounting obligations, to resolve disputes and to protect the Service.

Account information and saved User Content are retained for the lifetime of your account and are deleted or de-identified from our active systems within 30 days after your account is closed or the content is deleted. Prompts and outputs of AI features that are not saved are kept for up to 30 days. Security and server logs are generally kept for up to 90 days, and analytics information for up to 14 months. Payment, tax, transaction and accounting records are kept for eight years or longer where the law requires it. Where we keep backups, copies of deleted information expire within 90 days of deletion from active systems. Google Drive information is handled as described in the Google Drive Connector section above.

We may retain information for longer where the law requires it, where it is necessary to establish, exercise or defend legal claims, or where it is subject to a legal hold.

CHILDREN'S PRIVACY

The Service is intended only for adults aged 18 or older. We do not knowingly collect personal information from children and do not knowingly offer the Service to them. If you believe that a child has provided us with personal information, please contact us at hello@gobananas.so and we will take appropriate steps to delete it.

"DO NOT TRACK" OR "DNT" TECHNOLOGY

The Service does not currently respond to "Do Not Track" signals or similar browser settings.

SECURITY

We implement technical and organizational measures designed to protect your personal information, including role-based access controls within workspaces, hashing of passwords, encryption of stored data by our hosting providers, encryption of Google OAuth tokens, and security logging and monitoring. Access to production systems and customer content by GoBananas personnel is restricted to what is necessary to provide support you have requested, to investigate security issues or to comply with the law.

No method of transmission over the internet or of electronic storage is completely secure. While we take commercially reasonable measures to safeguard your personal information, we cannot guarantee that these measures will prevent all unauthorized access, disclosure, alteration or destruction of information.

CONSENT AND CHANGES TO THIS POLICY

Where we rely on your consent to process personal information, we will ask for it separately and you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices or applicable law. We will post the updated version on the Website with a revised "Last updated" date, and where a change is material we will give you additional notice, such as by email or a notice within the Service, before it takes effect. Unless otherwise specified, changes take effect on the date stated at the top of this Privacy Policy.

CONTACTS

To request access to personal information relating to you that is processed by GoBananas, to raise a grievance, or if you have any questions regarding the handling of your personal information, please contact us at hello@gobananas.so or by post at:

Arete Tech Labs LLP C7, Liberty Phase 1, Koregaon Park, Pune, Maharashtra 411001 India

USER RIGHTS AND PREFERENCES

If you are a registered user, you may access and update your account information through the Service or by contacting us at hello@gobananas.so. You may delete your account, leave or delete a workspace, disconnect integrations such as Google Drive, and delete files and AI conversations from within the Service.

Depending on where you live and subject to applicable law, you may also have the right to request access to the personal information we hold about you, to have inaccurate information corrected, to have your personal information erased, to receive a copy of certain information in a portable format, to withdraw consent, to object to or restrict certain processing, and to appeal a decision we make about your request. To exercise these rights, please email hello@gobananas.so. We may need to verify your identity and authority before acting on a request, and these rights are subject to the limitations set out in applicable law. Where your account is controlled by an organization, we may direct your request to that organization.

India: Where India's Digital Personal Data Protection Act, 2023 and its rules apply, you may have the right to information about how your personal data is processed, to correction and erasure, to grievance redressal and to nominate another person to exercise your rights, subject to that law and its exceptions. Grievances may be sent to hello@gobananas.so.

EEA, United Kingdom and Switzerland: Where the data-protection laws of these regions apply, you have the rights described above and the right to lodge a complaint with your local supervisory authority. Our legal bases for processing are described in the introduction to this Privacy Policy and our approach to international transfers is described above.

California: California residents may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to receive a portable copy of it, and not to be discriminated against for exercising these rights. GoBananas does not sell personal information or share it for cross-context behavioral advertising. You may exercise these rights, including through an authorized agent, by emailing hello@gobananas.so.