Goable — Privacy Policy
Version: 2026-06-26.
This Privacy Policy explains how Goable collects, uses, shares, and protects personal data when you use the Service (the API, SDKs, web console, documentation, and any related artefact). It is published at https://goable.io/legal/privacy-policy.
If you are a Customer (Tenant), this Policy works together with the Terms of Service, the Acceptable Use Policy, and, where Goable processes personal data on your behalf, the Data Processing Agreement (DPA).
1. Who we are and how we act
Controller identity (GDPR Article 13): Goable is a brand operated by Fabio Carucci, an Italian sole proprietor.
- Operator: Fabio Carucci (trading as "Goable")
- Address: Magliano Alfieri, 12050 (CN), Italy
- VAT (P.IVA): IT04133450041
- Privacy contact:
privacy@goable.io - General / legal contact:
contact@fabio-carucci.com - Security contact:
security@goable.io
Controller of your tenant data: For our own customer accounts, billing, security operations, marketing, research dataset, and corporate communications, Goable acts as a data controller under GDPR.
Processor of your end users' data: For per-request data you submit to the Service (including pseudonymised user references on the decision-agent surface), Goable acts as a data processor on behalf of you, the Customer, who is the controller of your end users' personal data. Processor obligations are governed by the DPA.
Data Protection Officer (DPO): For day-to-day data-protection enquiries, write to privacy@goable.io. Goable periodically assesses whether a DPO is required under GDPR Article 37 based on the nature, scope, and purposes of its processing; until then, privacy@goable.io is the privacy contact point.
Supervisory authority: The Italian Data Protection Authority (Garante per la protezione dei dati personali), https://www.garante.it. You may lodge a complaint with the Garante or with the supervisory authority in your EU member state of residence.
2. Categories of personal data we process
2.1 Account data (Goable as controller)
| Category | Examples | Source |
|---|---|---|
| Tenant identity | display name, slug, plan, status | Signup form |
| Tenant contact | contact email, optional billing email | Signup form |
| Billing identifiers | Stripe customer id, Stripe subscription id | Stripe webhook |
| Authentication | console session tokens, short-lived magic-link tokens, API keys stored only as hashes (no plaintext), hashed ops-user passwords | Signup + login flows |
| Legal acceptance ledger | document kind + version + content hash + timestamp + IP + user-agent at acceptance | Signup flow + legal-doc acceptance endpoint |
2.2 Request data (Goable as processor for the Customer)
| Category | Examples | Source |
|---|---|---|
| Geographic | latitude, longitude, sub-spot slug, region | API request body |
| Temporal | time window (from, to), forecast horizon | API request body |
| Activity context | activity slug, time of session | API request body |
| Pseudonymised user reference | userPseudonym, a keyed hash (HMAC) of your internal user-id, keyed by a salt you hold. We never see the cleartext user id. | API request body (decision-agent surface only) |
| Non-identifying user attributes | skill level (beginner/intermediate/advanced), equipment type (electric/combustion/manual) | API request body (optional) |
| Outcomes | a structured reason code (ran/cancelled/rescheduled/no_show) plus an optional free-text comment | POST /v1/score/:id/outcome or /v1/outcomes |
| Audit log entry | request + response + provider chain + raw weather samples + forecast horizon + research-eligibility flag | Computed at score time, retained per clause 7 |
The optional free-text comment on an outcome is treated as Customer Personal Data under the DPA. It is off by default, and you must not populate it with special-category data or direct identifiers (see AUP clause 3). Outcomes are otherwise captured as structured reason codes.
2.3 Inferred and derived data (Goable as processor)
| Category | Examples | Source |
|---|---|---|
| Per-user behavioural model | a per-pseudonym behavioural model artifact | Trained from outcome history on the decision-agent surface |
| Archetype × spot-tier model | per-cell k-anonymous aggregates (k≥10 distinct pseudonyms) | Trained periodically |
| Decision-run trace | per-call recommendation + verdict + scores + latencies + LLM tokens | Computed at /v1/decision call time |
We do NOT collect: end-user names, end-user email addresses, precise device identifiers, IP addresses of your end users (only the calling tenant's request IP is logged transiently for abuse prevention), free-text biometric data, special categories of personal data under GDPR Article 9 (you are contractually prohibited from submitting these, see AUP clause 3).
3. Purposes and legal bases
| Purpose | Categories used | GDPR legal basis |
|---|---|---|
| Provide the Service (compute + return scores, store outcomes, surface analytics) | Account, request, outcome, audit-log | Art. 6(1)(b) contract |
| Bill paid plans | Account, billing identifiers, usage meters | Art. 6(1)(b) contract |
| Authenticate and protect the Service against abuse | Account, authentication, request IP (transient) | Art. 6(1)(f) legitimate interest (security) |
| Deliver the contracted service via tenant-scoped calibration (the per-tenant calibration loop) | Audit-log + outcomes from the same tenant | Art. 6(1)(b) contract (processing as processor under the DPA) |
| Contribute aggregated, disclosure-controlled data to the research dataset | Audit-log + outcomes from tenants who opted in | Art. 6(1)(a) consent (revocable; release only after disclosure-control review, see clause 7) |
| Comply with legal, tax, and accounting obligations | Account + billing | Art. 6(1)(c) legal obligation |
| Generate natural-language explanations via Anthropic Claude | Request payload + breakdown | Art. 6(1)(b) contract + AUP clause 3 (no PII permitted) |
For the purposes above where Goable acts as processor (per-request processing, tenant-scoped calibration, and LLM-generated explanations over request payloads), the legal basis is determined and held by you as the controller of your end users' data; Goable processes only on your documented instructions under the DPA, and the bases cited in those rows are the ones on which you, as controller, are expected to rely. The bases Goable relies on in its own right apply to the rows where Goable is identified as controller (account, billing, security, and the opt-in research programme).
General model improvement on personal data (as distinct from delivering the contracted, tenant-scoped calibration above) is not covered by Art. 6(1)(b) and would require a separate legal basis and assessment before any such processing. Open research release is separate again and relies on explicit opt-in consent under the research governance described in clause 4 and at https://goable.io/research/governance.
4. Sharing — sub-processors and recipients
Goable engages the sub-processors below to deliver the Service. The current list is also maintained in the DPA Annex; we notify Customers of new sub-processors 30 days before activation per the DPA.
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Amazon Web Services EMEA SARL | API/compute hosting (Lambda + API Gateway), object storage (S3), CloudFront CDN for the public API ingress (api.goable.io) | EU (eu-west-1 Ireland) |
| Neon Inc. | Postgres database (primary + analytics) | EU (Frankfurt, eu-central-1) |
| Vercel Inc. | Website and console front-end hosting | EU (Frankfurt, fra1) |
| Upstash Inc. | Redis (rate-limit counters, ephemeral session tokens) | EU |
| Stripe Payments Europe Ltd. | Payment processing, subscription management, metered usage | EU (Ireland) with sub-processors in US under SCCs |
| Cloudflare Inc. | DNS and the console/marketing edge; Turnstile CAPTCHA on signup | EU edge and global edge locations (no tenant API payloads cached) |
| Anthropic Ireland Ltd. | LLM inference for the AI explainer + decision-agent natural-language layer. When the Goable-provided fallback key is used, Anthropic is a sub-processor; where a tenant uses its own key (BYOK), Goable does not hold that key | EU (Ireland) with possible US fallback under SCCs |
| Resend Inc. | Transactional email (magic links, billing receipts, drift notifications) | EU edge with US data plane under SCCs |
| PostHog Inc. | First-party product analytics on the console (self-hosted EU instance) | EU |
We do not sell personal data. We do not share personal data with advertisers, brokers, or any third party not listed above except where required by law (clause 6).
5. International transfers
Primary processing takes place in the EU (Ireland and Frankfurt). Where personal data is transferred outside the European Economic Area (EEA), for example to Stripe, Anthropic, or Resend sub-processors, Goable relies on the EU Commission's Standard Contractual Clauses (SCCs) of June 2021, supplemented with technical and organisational measures appropriate to the recipient and the data category. The sub-processor table in clause 4 identifies which recipients may process data outside the EEA and under what safeguard.
Where Goable processes data on behalf of you as a Customer, the DPA also incorporates SCCs by reference.
6. Compelled disclosure
We may disclose personal data where required by law, by a court order, by a competent regulatory authority, or to protect the rights, property, or safety of Goable, our Customers, or the public. Where lawful, we notify the affected Customer before disclosing data that we process on their behalf.
7. Retention
| Category | Retention |
|---|---|
| Account + billing data | Duration of the customer relationship + the period required by applicable Italian tax and accounting law |
| Request + response audit log | 1 year by default; extendable per signed DPA addendum |
| Outcomes | Same as audit log |
| Per-user behavioural model + decision runs | Until the user is erased via DELETE /v1/decision/user-data/:pseudonym (GDPR Art. 17 cascade); otherwise per the audit-log retention |
| Magic-link tokens | Short-lived |
| Console session | Short-lived (then re-authentication required) |
| Research aggregates (post disclosure-control review) | Retained only where determined no longer personal data or otherwise lawful (see clause 4) |
8. Your rights (GDPR Articles 15–22)
You have the right to:
- Access the personal data we hold about you and obtain a copy.
- Rectify inaccurate personal data.
- Erasure ("right to be forgotten"), see clause 8.1 for the programmatic cascade on the decision-agent surface.
- Restrict processing while a dispute is resolved.
- Portability, receive your data in a structured, commonly-used, machine-readable format and have it transmitted to another controller where technically feasible.
- Object to processing based on legitimate interests.
- Withdraw consent where processing is based on consent (clause 3); withdrawal does not affect the lawfulness of processing prior to withdrawal.
- Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. The decision-agent surface is decision-support, not decision-automation; you remain the controller and the decision-maker.
To exercise rights as a Customer (Tenant), write to privacy@goable.io from your tenant contactEmail or via signed authenticated request from the console. We respond within one month of receipt; complex requests may extend to three months with notice.
8.1 Programmatic erasure for end-user pseudonyms
Because Goable processes pseudonymised end-user data on the decision-agent surface, we provide a programmatic Article 17 cascade for Customers:
DELETE /v1/decision/user-data/:pseudonym
The cascade:
- Hard-deletes the per-user behavioural model artifact from
user_behavioral_models. - Hard-deletes decision-run rows from
decision_runs. - Anonymises audit-log rows attributable to the pseudonym (sets
was_pseudonymized=true, strips the pseudonym, and retains only the remaining non-personal facts). - Returns response headers
X-Anonymized-Rows: <count>+X-Receipt: <hash>so you can record the receipt in your own DSAR audit file.
The cascade is idempotent and tenant-scoped; cross-tenant attempts are refused.
9. Cookies and similar technologies
The Goable console (console.goable.io) uses the following first-party cookies:
| Cookie | Purpose | Lifetime |
|---|---|---|
goable_console_session | HttpOnly signed session cookie for authenticated console access | Short-lived |
goable_csrf | CSRF protection token | Session |
The public landing pages (goable.io) set no marketing cookies. Product analytics on the console is gathered via PostHog self-hosted on an EU instance with cookie-less server-side capture by default; full cookie disclosure is in the console's cookie banner.
10. Security
Goable implements technical and organisational measures appropriate to the risk, including:
- In transit: TLS 1.2+ everywhere, HSTS preload on production hostnames, TLS 1.0/1.1 disabled.
- At rest: AES-256 via AWS-managed KMS keys for the database, object storage, and other data stores. Secrets are held in AWS SSM SecureString.
- Authentication: API keys and magic-link tokens are stored only as hashes (no plaintext); ops-user passwords are stored using a strong password-hashing function.
- Access: AWS Identity Center SSO with TOTP-mandatory; principle of least privilege for service IAM roles.
- Audit: every console session action and every API score call is logged with a per-request id; CloudTrail captures AWS-control-plane activity.
- Incident response: an incident triage channel; status published to the public status strip promptly on detection; post-mortems published for incidents affecting tenant traffic.
Full security posture: https://goable.io/security.
11. Personal data of minors
The Service is not directed at children under 16 (or the applicable digital-consent age in your member state). We do not knowingly collect personal data of children. If you believe a child's data has been submitted to the Service, contact privacy@goable.io and we will investigate and erase where appropriate.
12. Changes to this Policy
The current version is always at https://goable.io/legal/privacy-policy. Material changes are notified to the tenant contact email at least 30 days before they take effect (or sooner where required by law). The version stored in legal_documents is the canonical version that applied at the time of your acceptance; on request, you can obtain a downloadable copy of the full text, version, content hash, and acceptance timestamp of the version you accepted.
13. Complaints
If you believe Goable has not complied with this Policy or with applicable data-protection law, please contact us first at privacy@goable.io so we can resolve it. You also have the right to lodge a complaint with a supervisory authority: the Italian Garante (https://www.garante.it) or your local EU member-state supervisory authority.
14. Contact
Privacy: privacy@goable.io
Security disclosures: security@goable.io
Legal / contractual notices: contact@fabio-carucci.com
Operator: Fabio Carucci (trading as Goable), Magliano Alfieri, 12050 (CN), Italy. P.IVA IT04133450041.
Last updated: 2026-06-26. This document is published at https://goable.io/legal/privacy-policy. The version stored in legal_documents and accepted at signup is the canonical version for your account.