Privacy Policy

Information you give us

• Account data — name, work email, password (stored only as a salted hash), company name, and workspace settings.
• Billing data — your plan, subscription status, and billing identifiers. Card details are handled by our payment processor; we never see or store full card numbers.
• Support and sales communications — messages you send us by email or through the product.

Information we collect automatically

• Usage data — pages and features used, actions taken, and timestamps, used to operate and improve the product.
• Device and log data — IP address, browser type, operating system, and referring pages.
• Cookies and similar technologies — see our Cookie Policy for the full list and your choices.

Customer content processed on your behalf

When you use Ooperon, contact records, conversation history across channels (email, SMS, WhatsApp, Instagram, live chat, voice, and others), pipeline data, tasks, and files flow through the platform. We process this content solely to provide the service to you. You are the controller of that data and are responsible for having a lawful basis to load and process it.

We use personal data to:

• Provide, maintain, and secure the platform and your account.
• Run AI sales agents, automations, and analytics that you configure.
• Process payments and manage subscriptions.
• Respond to support requests and send service and security notices.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Improve our products and, where permitted, measure how features are used.
• Comply with legal obligations and enforce our Terms.

Ooperon relies on trusted third parties to deliver the service — for example, cloud hosting, database and storage providers, payment processing, product analytics, email and messaging delivery, and the AI model providers that power our sales agents. These providers act as our subprocessors, are bound by contract to protect the data, and may only process it to provide their service to us.

Where content is sent to an AI model provider to generate a reply or complete an automation, it is used only to produce that output for you. A current list of subprocessors is available on request at contact@ooperon.com.

When you connect a Google account to Ooperon, we request only the scopes required for the feature you enable, and we access your Google data solely to provide those features to you:

• Gmail (gmail.send) — send emails you write or automate from your connected address. We do not read, store, or index your inbox.
• Google Calendar (calendar) — create and manage the events and Google Meet links used by the scheduling features you set up.
• Google Contacts (contacts) — create, update, and look up contacts you choose to sync between Google and your CRM.
• Google Drive (drive.file) — access only the specific files you select with the Google Picker, or that the app creates on your behalf; never your entire Drive.
• Google Sheets, Docs, and Forms (spreadsheets, documents, forms.body.readonly, forms.responses.readonly) — read or write only the specific spreadsheets, documents, and form responses you connect to an automation.
• Google Tasks (tasks) and Google Meet (meetings.space.created, meetings.space.readonly) — create and manage the tasks and meeting spaces for the automations you configure.

We store Google OAuth tokens encrypted at rest and use them only to make the API calls your configured features require. We do not use Google user data for advertising, sell it, or transfer it to third parties, and no one at Ooperon reads your Google data except where necessary for security (for example, investigating abuse) or to comply with law. You can disconnect any Google account at any time in Settings → Integrations, which deletes the stored tokens.

Some Ooperon features use AI models to generate replies or run the automations you configure. When an automation you build sends data received from Google Workspace APIs to an AI model, that call is made with your own AI provider API key, and the data is used only to produce the output you asked for. We do not use, transfer, or sell raw, aggregated, or derived Google Workspace data to create, train, or improve any generalized or foundational artificial intelligence or machine learning model, whether our own or a third party’s. Our use of raw or derived user data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share personal data only in these circumstances:

• With subprocessors that provide infrastructure and features on our behalf, under contract.
• With integrations you explicitly connect (such as your calendar, payment, or messaging tools), limited to what those integrations require.
• To comply with the law, a valid legal request, or to protect the rights, safety, and property of Ooperon, our customers, or the public.
• In connection with a merger, acquisition, or sale of assets, subject to this Policy.

We keep personal data for as long as your account is active or as needed to provide the service. After termination, we delete customer content within a reasonable period, except where we must retain limited records to comply with legal, tax, accounting, or security obligations. You can request deletion at any time.

We protect data with encryption in transit and at rest, least-privilege access controls, network isolation, and continuous monitoring. No system is perfectly secure, but we work hard to safeguard your data and to notify you promptly of incidents that affect you. See our Security page for details.

GDPR (EEA, UK, and Switzerland)

If you are in these regions, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. Our legal bases are performance of a contract, legitimate interests, consent, and legal obligation, depending on the processing.

CCPA / CPRA (California)

California residents have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CPRA. You will never be discriminated against for exercising these rights.

To exercise any right, email contact@ooperon.com. We will respond within the timeframe the applicable law requires. Where we act as a processor, we will refer your request to the relevant customer (the controller).

We are based in the United States and may process data in the U.S. and other countries where we or our subprocessors operate. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Ooperon is a business product not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised Policy.

Questions or requests? Contact our privacy team at contact@ooperon.com. You may also lodge a complaint with your local data protection authority.