Privacy

Last updated September 26, 2026.

Pablo is made by E12 Labs Limited, a company registered in Cyprus with registration number HE 495121 and its office at Ellados 12, 8020 Paphos, Cyprus. This policy explains what we collect, how we use it, who we share it with, and what your rights are. It covers the Pablo app, this website, and everything else we run under the Pablo name.

The short version

Pablo works by remembering what you tell it, so the app holds a lot about your life. We collect that data to run Pablo, organize your spaces, and make the product better. Your conversations and the things you put in a space are sent to AI providers so the assistant can reply and keep your board up to date. The most sensitive things (your photos, your voice notes, your location) happen only if you give the app permission, and you can take that permission back in your device settings at any time. People on our team may read conversations to fix problems and make Pablo better. There are no ads inside Pablo, but we advertise Pablo in other apps, and we use advertising, analytics, and crash reporting tools to see which ads work and how the app is used. Anything that links you across other apps happens only if you allow it on Apple's tracking prompt. You can ask us to delete your account and the data tied to it.

What we collect

• Things you give us: your phone number, your first name, and your email address and profile photo if you add them. The phone number is how you sign in. We also store the time zone your phone reports, so anything scheduled happens at your local time.
• Everything you say to Pablo. That includes your messages, the spaces you create, and the notes, tasks, events, places, contacts, links, and files that come out of them.
• What Pablo organizes for you. Each space has a board, built from what you and the people in the space have said and shared, so Pablo does not have to ask again.
• Phone numbers you invite into a space. When you invite somebody we store their number so the invitation can find them when they sign up. If you open your contacts on the invite screen, the app reads them on your phone only. Names never leave your phone, and only the numbers you choose to check or invite are sent to us, to show who is already on Pablo. Those numbers are never sent to AI providers.
• A notification token from Apple, if you allow notifications, so we can send them to your phone.
• Voice notes, if you let the app use your microphone. We store the recording and have it written out as text, so Pablo can read what you said and answer it.
• Photos, documents, and links you send or share into the app. We store the file. A photo is also described in words so Pablo knows what is in it, and for a link we fetch the page to show a preview.
• Your location, if you allow it, and only when you attach it to a message. Pablo uses it to work with places you mention and to show them on a map. We never collect it in the background. The map itself is drawn by Apple Maps on your phone.
• Nothing from your calendar or Reminders reaches us. If you tap Add to Calendar or Sync, the app writes events and tasks from your board into your calendar or a Reminders list of its own, on your phone. It only reads and writes inside what it made, and never touches your other calendars or lists.
• Basic technical data our servers see on every request, such as your IP address and ordinary server logs, which we keep to run the service and keep it safe.
• How you use the app. Analytics tools record things like which screens you open, which features you use, and how long you stay, tied to your account.
• Crash and performance reports. If the app crashes or runs slowly, a crash reporting tool sends us a report with your device model, system version, and what the app was doing at the time.
• Advertising data. The app tells our advertising partners when it is installed, opened, and signed into, so we can see which of our ads brought you here. If you tap Allow on Apple's tracking prompt, this includes your device's advertising identifier. See Ads, analytics, and tracking below.

Pablo and AI

Pablo is built on AI, so this part matters. To reply to you, organize a space, and keep your board and files current, we send your messages and the content of that space to AI model providers that work for us. The same route handles voice notes, which are written out as text, and photos, which are described in words. What gets sent depends on what you are doing.

Two kinds of company receive it, and we think both are worth naming. The first builds the models: OpenAI, Anthropic, Google, and xAI. The second runs them, because a model has to be served on somebody's machines, and that host holds the same words while it does. Those include Amazon Web Services, Microsoft Azure, Google Cloud, DigitalOcean, DeepInfra, Baseten, CoreWeave, SiliconFlow, and others. We reach all of them through OpenRouter, a single gateway that passes each request on to whoever is serving it.

Read those as examples rather than a closed list, because it is not a fixed one and we would rather say so than pretend. Pablo is not tied to one company, one model, or one host. For each job, and there are several behind a single reply, whatever does that job best right now gets it, weighing quality, speed, and cost. Models improve every few months, new ones arrive, prices move, and a provider we have never named can end up serving a request tomorrow. We update this page as that changes, and this page is always our current answer.

What does not change is the bar every one of them has to clear. We only use providers whose terms commit them to protecting your data to the same standard this policy sets, and to using it to serve your request rather than for their own ends. None of them may train a model on what you write. That is set account wide in our provider settings and sent again on every single request, so it holds no matter who ends up serving it.

People at E12 Labs can see your content too. When something goes wrong, or to check that Pablo answers well and files things in the right place, a small number of people on our team may read messages, boards, and files, along with what Pablo sent to the AI and what came back. We keep that to what the job needs.

We ask before any of this happens. The first time you open Pablo, the app shows you what it sends, names who it goes to, and waits for you to agree. Nothing of yours reaches a model before that, and we keep a record of which version of that wording you agreed to and when. Withdrawing is one tap: delete your account from the account screen and it goes with it, your spaces, messages, files, and everything Pablo remembered about you. It happens straight away, with no grace period. Two things do outlive it, and both are set out under “How long we keep it” below: what you wrote inside somebody else's shared space, which is theirs to keep, and the little we are legally required to hold on to.

Shared spaces

A space can be shared with other people. Everything in a shared space (the conversation, the board, the files) is visible to every member of it, and Pablo takes part in that conversation. Anyone you invite can see what was already there. Only share a space with people you want to have that.

Pablo knows the first names of the people in a shared space, so it can tell who said what and answer whoever asks. Members see each other's first name and profile photo. The person who made the space can invite people and remove them, and anyone else can leave at any time. Your own Pablo space can never be shared.

Inviting somebody who is not on Pablo yet opens a text message on your phone, which you send yourself, from your own number. We do not send it and we do not see it. If they never sign up, the waiting invitation holds only their number, and you can take it back.

Ads, analytics, and tracking

Pablo shows no ads inside the app. We do advertise Pablo in other apps and on other websites, and to know which of those ads work, the app includes tools from advertising partners. Today that is Meta (Facebook and Instagram). It can also include Google, TikTok, and Apple, and a measurement company that brings their results together. They learn that the app was installed, opened, and signed into. They use that to measure and improve our ads, and under their own terms, their own services.

Some of this is what Apple calls tracking: linking what happens in Pablo with what these companies know about you from other apps and websites, using your device's advertising identifier. That only happens if you tap Allow when the app asks. You can change your answer at any time in Settings, then Privacy and Security, then Tracking. If you do not allow it, partners get only counted results through Apple that do not say who you are.

We also use analytics and crash reporting tools inside the app, to see how Pablo is used and to fix what breaks. None of these partners, advertising or analytics, get your conversations, your boards, or your files.

This website is a separate thing from the app. It uses an analytics tool (Amplitude) to count visits to hipablo.app and see where people came from. If we add a partner that gets more than what this section describes, we will update this page and the privacy label on the App Store before it does.

How we use it

We use data to run the app and this website, answer you, organize your spaces, remember what you told us, send you the notifications you allow, build new features, keep the service safe, and meet our legal duties. Under the GDPR our legal bases are: performing our contract with you, our legitimate interests in running and improving the service, your consent where the law requires it (tracking with your advertising identifier is always one of those), and legal obligations.

Who we share it with

• Service providers who work for us: hosting and databases (Railway and Amazon Web Services), file storage (Cloudflare), AI models (OpenRouter, and through it the model builders and the hosts that serve them, as described above), realtime messaging (Pusher), notifications to your phone (Apple), text messages for your login code (Twilio), and email (Postmark).
• Services that read something on your behalf, at the moment you ask for it: web search when Pablo looks something up, and the readers we use to see a social post or the page behind a link you send. Today those are SerpApi for web search, and RapidAPI and HikerAPI for posts on TikTok, Reddit, X, and Instagram.
• Advertising partners (Meta today, and possibly Google, TikTok, Apple, and a measurement company), and analytics and crash reporting tools, as described in Ads, analytics, and tracking.
• Other people, when you choose it: whoever is in a space you share sees what is in it.
• A buyer or successor, if we are ever part of a merger, acquisition, or sale of assets.
• Authorities, when the law requires it or to protect our rights, our users, or the public.

We do not sell your data, and we do not share it with data brokers. Sending app events to advertising partners so we can measure our ads counts as “sharing” under some US state laws, such as California's, and you can opt out of it by tapping Ask App Not to Track or by emailing [email protected]. Every other company named above is a service provider acting on our instructions.

Messages from Pablo

If you allow notifications, Pablo sends them to your phone: when somebody writes in a space you share, when you are invited into one, and when Pablo has finished building something you asked for. A notification can show a short preview of the message. You can turn them off in your device settings at any time. If we ever send emails about your account, you will be able to unsubscribe from the email itself.

Where the data goes

We and our partners process data in countries outside the European Economic Area, including the United States. Where that happens we rely on recognized safeguards, such as adequacy decisions and standard contractual clauses.

How long we keep it

We keep data for as long as we need it for the purposes described here. You can delete a message, a file, or a whole space in the app, and what Pablo remembered from it stops being used. If you delete your account, we delete or anonymize the data tied to you within a reasonable time, except for what we must keep for legal, security, or accounting reasons, and except for content in a shared space that other members still rely on.

Your rights and choices

Under the GDPR you can ask to see the data we hold about you, correct it, delete it, receive a copy of it, restrict how we use it, object to how we use it, and withdraw consent you gave earlier. Email us at [email protected] and we will sort it out. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus. On top of that, your device gives you direct switches for the sensitive parts: your microphone, your photos, your location, and tracking are all permissions you can revoke in settings.

Children

Pablo is not aimed at children under 13 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Changes

As Pablo grows, this policy will change with it. If a change is meaningful, we will say so in the app or on this page before it takes effect.

Contact

Email [email protected], or write to E12 Labs Limited, Ellados 12, 8020 Paphos, Cyprus.