Last updated: 27 September 2026
Lisa ("the Service") is operated by GRABO LLC ("we", "us"), Suite 9E, Eastern Commerce Center, 6000 South Eastern Avenue, Las Vegas, NV 89119, USA. This policy explains what data the Service collects, how it is used, and your choices. Questions: support@grabo.cc.
openid email profile). If you create an account with email and a
password, we store your email and a salted password hash.gmail.readonly) — read-only, so Lisa has context from
messages relevant to your tasks and the people you work with;drive.readonly) — read-only, so Lisa can find
and reference documents relevant to your tasks;calendar.events) — to read your events and, at your
request, create or update events (e.g. book a confirmed meeting or reminder);contacts.readonly) — read-only, to recognise the
people you ask Lisa to reach and seed your assistant's address book.We use your data solely to provide the Service to you: to organize your tasks, let your AI assistant reason over your information, and — only if you connect it — give you relevant mail, file and calendar context and act on your calendar/contacts on your behalf. We do not sell your data, and we do not use it for advertising.
Lisa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve user-facing features of the Service; we do not transfer or sell it; we do not use it for advertising; we do not use it to train generalized AI/ML models; and humans do not read it except with your explicit consent, for security/abuse/legal reasons, or where the data is aggregated and anonymized.
To power the assistant, relevant task content and the data you connect may be sent to our AI model providers (e.g. Anthropic, OpenAI) strictly to generate responses for you. These providers process the data on our behalf and do not use it to train their models on your data under our API terms.
We do not sell or rent your data. We share it only with the infrastructure and AI providers that operate the Service on our behalf (e.g. our cloud host and the AI model providers in §4), and only as needed to run the Service or where required by law. Google user data is never shared for advertising.
Your data is stored on our servers. OAuth access and refresh tokens are encrypted at rest, and access is restricted to the Service operating on your behalf. We retain your data for as long as your account is active. When you disconnect Google, the stored Google tokens are revoked and deleted immediately; calendar/contacts data is fetched on demand and not retained beyond what is needed to serve your active tasks. When you delete your account, we delete your account data within 30 days.
The Lisa app is optional. With the permissions you grant on your phone, one at a time and each explained first, it sends your Lisa account your contacts, call log and text messages, the notifications your phone shows (including chat messages), your location (also while the app is closed, for delivery addresses and "time to leave" alerts), your phone's calendars, previews of new photos, Health Connect data (steps, sleep, heart rate, weight, exercise) and phone status (battery, network, whether you are driving). The microphone is used only in voice mode and your voice is not stored. This data is used only to provide the Service to you, never sold and never used for advertising; Health Connect data follows the Health Connect Permissions policy, including its Limited Use requirements. Locations are kept 90 days, phone status and notifications 30 days, the rest while your phone is connected. Full details are in section 6 of the lisa.my Privacy Policy.
We may update this policy; material changes will be reflected by the "Last updated" date above.