Privacy Policy

1. Agreement to These Terms

1.1. These Terms of Service and Privacy Policy (these "Terms") govern access to and use of OpsBell (the "Service"), a product of Sai Business Innovations Inc., an Ontario corporation, with a business address at 105 Bonnie Braes Dr, Brampton, ON L6Y 0Z4, Canada (the "Company," "we," "us," or "our"). OpsBell (the Service) and the Company are distinct: the Company is the legal entity that provides, operates, and is responsible for the Service.

1.2. The Service is offered to businesses and their authorized personnel ("Customer," "you," or "your"), not to individual consumers acting in a personal capacity. Users of the Service must be at least 18 years old and authorized to act on behalf of the business or entity they represent. By creating an organization, accepting these Terms through the Service, or otherwise using the Service, you represent that you meet this requirement and have the authority to bind that business or entity.

1.3. Only a user holding the owner or admin role for an organization may accept these Terms and confirm launch sign-off on that organization's behalf. Ordinary team members and client-portal viewers cannot accept these Terms, and no platform staff member or agency partner assisting with onboarding may accept these Terms on Customer's behalf.

1.4. Where OpsBell is made available to Customer through an agency or reseller partner ("Agency"), the Agency may assist with configuring certain account, integration, and commercial settings, but an Agency can never accept these Terms or confirm launch sign-off for Customer.

1.5. Initial launch market. As of this version, OpsBell is offered on a commercial basis to businesses in Canada. These Terms are written with that market in mind; see Section 14 (Governing Law).

2. The Service

2.1. OpsBell is a multi-tenant, AI-assisted business operations platform for small and local businesses, combining customer-communication handling, scheduling, marketing, a client-facing website, and operational reporting, with an optional agency-managed layer for partners who operate the platform on behalf of their own clients.

2.2. The specific features available to Customer depend on the modules and integrations Customer (or its Agency) configures and the commercial plan associated with Customer's organization. Depending on configuration, the Service may include: unified email and WhatsApp message handling with AI-assisted classification and drafting; appointment scheduling with calendar integration; lead and follow-up tracking (a lightweight customer-relationship-management, or CRM, capability); automated operational reporting delivered by email and/or WhatsApp; AI-assisted social media content planning and, for approved posts, publishing; AI-assisted creation of a client-facing marketing website, including publication under a shared or Customer-provided domain; billing and invoicing functionality described in Section 9; and internal records of business facts, account activity, and completed work for Customer's own visibility. Not every feature is active for every Customer at every time, and the Company may add, change, or retire features from time to time.

3. Account and Tenant Administration

Customer is responsible for maintaining accurate account and business information within the Service, for assigning roles (owner, admin, staff, client-viewer) appropriately, for promptly removing access for personnel who should no longer have it, and for the acts of everyone it grants access to its organization, including any authorized user who connects a third-party account to the Service.

4. AI-Assisted and Autonomous Operations

4.1. Human oversight is the default. No category of message, post, or action is autonomous by default. Autonomy for a specific communication channel and message category is only active where an authorized owner or admin has explicitly enabled it, and only after that category has met the Service's evidence-based criteria for automatic handling. Customer may disable any category's autonomy at any time, which takes effect immediately.

4.2. Where enabled, autonomous handling is scoped narrowly: it applies only to specific low-risk categories of message (such as a routine appointment request), only where the connected account uses a supported channel and provider for which OpsBell has validated automatic sending, and never to categories such as billing or support inquiries, low-confidence classifications, or topics Customer has designated as restricted — those are always routed to a person. Social media publishing requires Customer's approval by default; only specific, bounded, already-approved categories of content may be configured for autonomous scheduling, and only with Customer's separate, explicit authorization. Autonomy that has been enabled for a category can be rolled back to human review automatically or manually if its performance does not hold up, and every autonomous action is recorded for Customer's own review.

4.3. AI output can be inaccurate. Classifications, drafts, and generated content (including website copy, marketing content, and reporting summaries) are produced using third-party AI models and may be inaccurate, incomplete, or unsuitable for a specific situation. Customer is responsible for reviewing and, where the Service routes an item to Customer for approval, for approving or rejecting it appropriately. The Company does not warrant that AI-classified or AI-drafted content is accurate, and Customer should not rely on it as a substitute for its own judgment, particularly for sensitive, legal, medical, financial, or safety-related communications. The Company does not represent that any category of communication is error-free or operates without human involvement.

5. Third-Party Integrations and Subprocessors

5.1. The Service operates by connecting to infrastructure and third-party providers, which may include database, authentication, and hosting infrastructure; AI model providers; email, calendar, messaging, and social media providers Customer chooses to connect (which may include Google, Microsoft, Zoho, other email service providers Customer configures, and Meta's WhatsApp and social platforms, and LinkedIn); payment processing infrastructure; website hosting and domain infrastructure; and workflow-automation infrastructure used to coordinate longer-running processes. Not every subprocessor receives every category of information — each is involved only to the extent necessary for the specific connection or feature Customer configures.

5.2. Each third-party connection Customer authorizes is made through that provider's own standard authorization flow, and any resulting credentials are stored server-side in encrypted form and are not exposed to Customer's browser.

5.3. The Company is not responsible for the availability, accuracy, security practices, or policies of third-party providers. A provider's own terms and privacy policy govern the Company's, and in turn Customer's, use of that provider's services, in addition to these Terms.

5.4. The Company will provide reasonable advance notice, where practicable, of a material change to the subprocessors used to provide the Service, through in-product notice or notice to the contact details on file for Customer's organization. This section does not create a formal objection right beyond what applicable law or a signed written agreement between Customer and the Company separately provides.

5.5. LinkedIn data-use restriction. Where Customer connects a LinkedIn organization page, the Company accesses only the data and functionality necessary to publish Customer-approved posts to that page and to support any other LinkedIn functionality expressly enabled within the Service. The Company does not use data obtained through a connected LinkedIn account for prospecting, audience building, advertising, recruiting, customer-relationship-management enrichment, data export, or unsolicited outreach, and does not use the Service to exceed the scope of permissions LinkedIn has approved for the Company's use.

6. Customer Communications — Email, WhatsApp, and Social

Customer is solely responsible for having a lawful basis to communicate with its own end customers by email, WhatsApp, and social channels through the Service, including obtaining any consent required by applicable law before importing, messaging, or authorizing automated messaging to any contact, and for complying with each connected provider's own messaging policies. The Company processes inbound and outbound message content, including full message bodies, to provide classification, drafting, reply, and reporting features, as described in this document.

7. Customer Content and Data

7.1. "Customer Content" means business information, connected-account data, and end-customer data (such as leads, appointment details, message content, and social content) that Customer, its personnel, or its Agency submit to or generate within the Service.

7.2. As between Customer and the Company, Customer retains ownership of Customer Content. Customer grants the Company a license to host, process, transmit, and display Customer Content solely to provide, maintain, and improve the Service, and as otherwise described in these Terms.

7.3. Customer represents that it has all rights necessary to submit Customer Content to the Service and to authorize the Company's processing of it as described here, and that it will not submit payment card data, government identification or insurance numbers, protected health or medical records, or other similarly highly regulated or special-category information through the Service unless the Company has expressly agreed in writing that the relevant use case is supported and appropriate safeguards and terms are in place. The Service does not automatically detect or block the submission of such information, and Customer is responsible for not submitting it outside an arrangement the Company has expressly agreed to.

7.4. The Company does not sell Customer Content, and does not use Customer Content to train OpsBell's own models or any third-party general-purpose AI model. The Company may use irreversibly de-identified, aggregated operational metrics derived from Customer Content for service improvement, but only where such metrics do not identify Customer or any individual, are not sold, and are not used to re-identify Customer or any individual.

8. Acceptable Use

Customer will not, and will not permit its personnel or Agency to, use the Service to: (a) send unlawful, fraudulent, or unsolicited communications; (b) violate a connected third-party provider's terms of service; (c) attempt to bypass, disable, or interfere with the Service's access controls, tenant data isolation, or autonomy safeguards; (d) submit content that infringes a third party's rights or that OpsBell is not permitted to process under applicable law; or (e) use the Service to build a competing product.

9. Fees and Billing

9.1. Fees, billing cycle, payment due dates, applicable taxes, and any cancellation or renewal specifics for Customer's use of the Service are set out in the commercial plan, order form, proposal, or invoice applicable to Customer's organization (whether agreed directly with the Company or through an Agency), and are incorporated into these Terms by reference. Where Customer's commercial plan includes a self-serve subscription, payment is collected through the Service's integrated payment processor, Stripe, under Stripe's own terms; where it does not (including every Agency-resold arrangement, which remains outside this self-serve billing flow), payment is handled outside the Service by invoice or through the applicable commercial/Agency arrangement.

9.2. Discounts and account credits. The Company may, at its discretion or as set out in an applicable order form, apply a discount to an invoice or issue an account credit to Customer's organization (for example, as a goodwill adjustment, a service-credit accommodation, or to correct a billing error). A discount or account credit is recorded against Customer's invoice or account balance and reduces the amount owed; it does not create any right to a cash payment except where this Section, an applicable order form, or applicable law separately provides one.

9.3. Refunds. Except where an applicable order form provides otherwise or applicable law requires otherwise, fees already paid are non-refundable. Where the Company does issue a refund (for example, to correct a billing error, an overpayment, or a duplicate charge), it is processed back through the original payment method where technically available, or otherwise as an account credit.

9.4. Invoice corrections. An invoice issued in error may be voided by the Company; a voided invoice is never presented to Customer as an amount due. Where a correction to an already-finalized invoice is required, the Company issues a separate correcting invoice that references the original rather than altering the original invoice's own record.

9.5. Taxes. Applicable sales, goods and services, or harmonized sales tax (including GST/HST, where applicable) is added to invoiced fees where the Company is required by law to collect it. As of this version, the Company's GST/HST registration status is being finalized. Where the Company has registered and an invoice shows a GST/HST registration number, that tax has been charged and collected on that invoice; where an invoice does not show a registration number, no such tax has been charged on that invoice. This is a statement of current invoice presentation, not a representation about whether registration will or will not ultimately be required or obtained. This Section will be updated, and invoices will show the Company's registration number, once the Company's registration status is confirmed.

9.6. If Customer's account falls into non-payment under its applicable commercial terms, the Company may suspend access to the Service, or to specific modules, until the account is brought current, using the suspension process described in Section 12.

10. Intellectual Property

10.1. The Company and its licensors own all right, title, and interest in the Service, including its software, design, and underlying methodologies, excluding Customer Content.

10.2. Customer receives a limited, non-exclusive, non-transferable right to access and use the Service during its subscription term, solely for its own internal business operations and, where applicable, its own end-customer-facing website and communications generated through the Service.

10.3. As between the Company and Customer, and subject to the underlying rights of the Company's own platform and any third-party AI or content-generation provider, Customer may use content specifically generated for Customer's organization through the Service for Customer's own business purposes. The Company retains all rights in the underlying platform, software, and tooling used to generate that content. The Company does not guarantee that generated content is unique or free of third-party rights, and Customer remains responsible for reviewing generated content, including for trademark, copyright, or other third-party rights issues, before public use.

11. Confidentiality

11.1. Each party may receive non-public information of the other in connection with the Service ("Confidential Information"). Each party will use the other's Confidential Information only to perform its obligations or exercise its rights under these Terms, and will protect it with at least the same degree of care it uses for its own confidential information of similar sensitivity, but no less than reasonable care.

11.2. Confidential Information does not include information that: is or becomes publicly available without breach of these Terms; was already lawfully known to the receiving party without an obligation of confidentiality; is independently developed without use of the disclosing party's Confidential Information; or is lawfully received from a third party without an obligation of confidentiality.

11.3. A party may disclose the other's Confidential Information where compelled by law or legal process, provided it gives the other party reasonable advance notice where legally permitted, so that party may seek a protective order or other appropriate remedy.

12. Suspension and Termination

12.1. Customer may request closure of its account at any time by written notice to the Company using the contact details in Section 17. Unless the applicable order form provides otherwise, closure takes effect at the end of the then-current paid term, or, for an arrangement with no fixed term, within 30 days of the Company's receipt of the closure request.

12.2. The Company may suspend or terminate Customer's access to the Service, or to a specific integration or autonomy category, where the Company reasonably believes Customer has violated Section 8 (Acceptable Use) or Section 7.3 (highly regulated data), where a connected third-party provider revokes or restricts access, where Customer's account is in material non-payment under its applicable commercial terms, or where required by law. The Company will make reasonable efforts to notify Customer of a suspension and its cause, except where doing so would itself violate law or create a security risk.

12.3. Upon Customer's request made within 30 days after effective termination, the Company will make a commercially reasonable effort to make Customer Content available for export in a commercially reasonable format, to the extent technically available at that time.

12.4. Following effective termination, the Company will delete or anonymize Customer's active Customer Content within 60 days, except: (a) copies retained in routine backups, which age out through the Company's ordinary infrastructure retention cycles rather than immediate deletion; and (b) records the Company reasonably retains for legal, security, fraud-prevention, tax or accounting, or audit purposes.

13. Security and Incident Notification

13.1. The Company maintains administrative and technical safeguards appropriate to the nature of the information processed through the Service, including tenant data isolation enforced at the database layer, role-based access controls, encrypted storage of connected third-party account credentials, and audit logging of account and data actions. Operational and audit logs record actions, timestamps, and bounded status or error information; they do not store full message bodies, message attachments, or third-party access/refresh tokens or passwords. No method of transmission or storage is completely secure, and the Company cannot guarantee absolute security. The Company does not hold, and does not represent that it holds, any particular third-party security certification (such as SOC 2 or ISO 27001) unless expressly identified as held in a specific written communication to Customer.

13.2. If the Company confirms a security incident that materially affects the confidentiality, integrity, or availability of Customer's personal information or Customer Content, the Company will notify the affected Customer without undue delay after confirming the incident, subject to the legitimate needs of law enforcement and any restriction imposed by applicable law.

14. Governing Law; Disputes

These Terms are governed by the laws of the Province of Ontario and the applicable federal laws of Canada, without regard to conflict-of-law principles. Each party submits to the exclusive jurisdiction of the courts located in Ontario, Canada for any dispute arising from or relating to these Terms. There is no requirement to arbitrate a dispute under these Terms.

15. Warranties; Disclaimers; Limitation of Liability; Indemnity

15.1. Disclaimer. Except as expressly stated in these Terms, the Service is provided "as is," without warranties of any kind, express or implied, including any warranty of merchantability, fitness for a particular purpose, or non-infringement. The Company does not warrant that the Service will be uninterrupted or error-free, or that AI-generated output will be accurate. The Company is not responsible for the acts, omissions, availability, or policies of the third-party providers described in Section 5, or for any other software or service Customer chooses to integrate with the Service.

15.2. Limitation of Liability. To the maximum extent permitted by applicable law, neither party will be liable to the other for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, or data, arising from or relating to these Terms or the Service, even if advised of the possibility of such damages. To the maximum extent permitted by applicable law, the Company's aggregate liability arising from or relating to these Terms or the Service will not exceed the fees paid or payable to the Company for the affected Service during the 12 months preceding the event giving rise to the claim. This section does not limit liability that cannot be limited under applicable law, or liability arising from a party's fraud or wilful misconduct.

15.3. Indemnity. Customer will indemnify, defend, and hold harmless the Company from and against third-party claims, damages, and reasonable expenses (including reasonable legal fees) arising from: (a) Customer Content that is unlawful or infringes a third party's rights; (b) Customer's unlawful messaging or marketing communications; (c) Customer's violation of a connected third-party provider's terms; or (d) Customer's use of the Service in breach of these Terms.

16. Changes to These Terms

16.1. The Company may publish a new version of these Terms. Each published version is an immutable, separately identified record; publishing a new version does not alter the record of any prior version or of any acceptance already recorded against it.

16.2. When a new version becomes current, an organization's prior acceptance no longer satisfies the current requirement, and an authorized owner or admin must explicitly accept the new version before the organization's launch-readiness will treat legal acceptance as current again. The Company will make the then-current version available for review within the Service before requiring acceptance, and will not treat a version as accepted based on anything other than an explicit acceptance action by an authorized owner or admin.

16.3. Summary of changes from the version previously in effect (Version 2). This version: (a) corrects the Company's own legal-entity references to consistently identify "Sai Business Innovations Inc." and distinguish the Company from the OpsBell product/Service it operates; (b) replaces a prior statement that no integrated payment processor exists with an accurate description of Stripe's role, now that self-serve subscription billing has been implemented; (c) adds detail on discounts, account credits, refunds, and invoice corrections (Section 9.2-9.4); (d) adds neutral, non-committal wording on GST/HST registration status (Section 9.5); and (e) adds an express restriction on the Company's use of LinkedIn member data (Section 5.5). This summary is provided for transparency and is not itself part of the operative terms.

16.4. Summary of further changes. This version adds a dedicated disclosure of Google API Services / Gmail and Calendar Data use (Section 30), covering both the Gmail and Google Calendar integrations, and removes the standalone version-number and publication-date caption previously shown at the top of this document (the version identity and publication date remain recorded in the Company's internal publication and acceptance records, and in the Summary above). This summary is provided for transparency and is not itself part of the operative terms.

16.5. Summary of further changes. This version: (a) renames Section 30 to "Google API Services / Gmail and Calendar Data" to name both integrations in the section title itself; (b) expands Section 19's data-category list to explicitly name identity, authentication, contacts, appointment, marketing, reporting, and audit data already described elsewhere in this document; (c) adds a general statement to Section 22 that personal information is not used for advertising, ad-targeting, data brokerage, recruiting, or credit/lending/insurance decisions; and (d) adds a statement to Section 13.1 that operational and audit logs are bounded and never store full message bodies, attachments, or third-party credentials. This summary is provided for transparency and is not itself part of the operative terms.

17. Notices and Contact

Questions about these Terms, or requests concerning personal information, may be directed to:

Sai Business Innovations Inc. 105 Bonnie Braes Dr Brampton, ON L6Y 0Z4, Canada Email: contact@opsbell.ai

Privacy Policy

This Privacy Policy is part of these Terms and describes how the Company handles information in two distinct capacities:

• As controller, for information about Customer's own personnel who use the Service, and about visitors to the Company's own marketing website and contact form.
• As processor/service provider acting on Customer's instructions, for information about Customer's own end customers (such as leads, appointment contacts, and message senders and recipients) that flows through the Service because Customer has connected accounts and configured modules that process it. Customer is the controller of its own end-customer information and is responsible for ensuring it has a lawful basis for the Company to process that information as described in Section 6 above.

18. Applicable Privacy Law

As a Canada-focused service, the Company handles personal information in accordance with applicable Canadian privacy law, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and substantially similar provincial private-sector privacy legislation where applicable. This Privacy Policy does not represent compliance with the privacy laws of any other jurisdiction.

19. Categories of Information

• Account, identity, and organization information: business name, organization/tenant identifier, timezone, login/authentication session identifiers, staff roster, role assignments (owner, admin, staff, client-viewer), and business-profile details Customer provides.
• Connected-account information: which third-party accounts are connected, authorization scope, and connection status. Access credentials themselves are stored in encrypted form in a dedicated secret store and are not accessible in readable form through ordinary use of the Service.
• Communication content: email and WhatsApp message content, and social post/direct-message content, that Customer's connected accounts send or receive, together with AI-generated classifications and drafts derived from that content.
• Contacts, leads, and appointment information: names, email addresses, phone numbers, company names, notes, activity history, and appointment/scheduling details for Customer's own contacts, leads, and customers.
• Website and marketing content: brand assets, generated site design and content, domain/deployment configuration, and AI-assisted social/marketing content planned or published through the Service.
• Billing information: invoice, discount, credit, and payment-status records associated with Customer's organization, as described in Section 9.
• Reporting, usage, and audit information: automated operational reports delivered to Customer; records of account actions, role/permission changes, and automated workflow runs, kept as an audit trail for security, troubleshooting, and giving Customer visibility into what the Service did.

The Company does not store payment card numbers or bank account details. Where Customer's commercial plan includes a self-serve subscription, payment instrument data (such as card details) is collected and held directly by the Company's integrated payment processor, Stripe, Inc., not by the Company; the Company receives only limited, non-sensitive billing metadata from Stripe (such as subscription status, plan, and renewal date) to operate the Service. Stripe's own privacy policy governs its handling of payment instrument data.

20. Sources of Information

Directly from Customer and its personnel; from Customer's connected third-party accounts, through authorized access Customer grants; from Customer's own end customers, indirectly, where they message a connected channel or submit a form on a Customer website built with the Service; from the Company's integrated payment processor, Stripe, for billing metadata described in Section 19; and from the Company's own marketing website contact form, directly from the submitter.

21. How Information Is Used

To provide, operate, and support the Service, including AI-assisted classification, drafting, scheduling, reporting, billing, and website generation; to maintain security, audit records, and tenant data isolation; to communicate with Customer about its account; and, for the Company's own marketing-site contact submissions, to respond to inquiries.

22. Disclosures and Subprocessors

Information is disclosed to the third-party subprocessors described in Section 5 strictly as needed to provide the specific connected feature Customer has configured. The Company does not sell personal information; does not use or disclose personal information for advertising, ad-targeting, or cross-context behavioral-advertising purposes; does not broker or otherwise transfer personal information to data brokers; does not use personal information for recruiting or other employment-related decisions; does not use personal information for credit, lending, or insurance eligibility decisions; and does not use personal information for any other purpose unrelated to providing the Service Customer requested. The Company may disclose information where required by law, or to protect the rights, property, or safety of the Company, its users, or others.

23. Cross-Border Processing

OpsBell's core infrastructure is currently hosted in the United States, and some subprocessors described in Section 5 may process information in other jurisdictions. This means personal information about Canadian Customers and their end customers may be processed outside Canada. The Company remains accountable for personal information under applicable Canadian privacy law regardless of where it is processed, and requires its service providers to protect information consistently with that accountability. The Company does not represent that all information is or will be stored exclusively within Canada.

24. Security

See Section 13 above, which applies equally to this Privacy Policy.

25. Retention

Customer Content is retained for as long as Customer's organization remains active on the Service, and thereafter as described in Section 12.4 (Termination). The Company does not currently offer an automated, self-service data-retention or deletion tool; retention and deletion after account closure are handled as described in Section 12.

26. Individual Privacy Rights

An individual whose personal information is processed through the Service may have rights under applicable Canadian privacy law to access, correct, or request deletion of that information, subject to applicable exceptions. A request concerning Customer's own end-customer information should generally be directed to Customer, as the controller of that information; Customer may relay such a request to the Company for assistance. A request concerning the Company's own account, personnel, or marketing-contact information may be directed to the Company using the contact details in Section 17. As of this version, such requests are handled through the Company's administrative process rather than a self-service tool.

27. Cookies and Similar Technologies

OpsBell uses strictly necessary cookies or equivalent browser storage to authenticate users, maintain login sessions, and protect the security of the Service. OpsBell does not currently use these technologies for third-party advertising or analytics tracking. If that changes, the Company will update this Privacy Policy through a new published version and provide any additional disclosure or consent mechanism required by applicable law before doing so.

28. Marketing Communications

The Company may send Customer's account contacts communications reasonably necessary to operate the Service. Where the Company sends a commercial electronic message, it will do so only where a lawful basis or consent exists, will identify itself and provide contact information, and will provide a readily usable way to unsubscribe, honoured within the period required by Canada's Anti-Spam Legislation (currently no later than 10 business days after a request).

29. Children

OpsBell accounts are for adults acting on behalf of a business; the Service is not directed to children, and the Company does not knowingly collect personal information directly from children through the account-holder-facing product. Where Customer's own end-customer data submitted to the Service relates to a minor (for example, through a form on a Customer website), Customer remains responsible, as controller of that data, for having a lawful basis to collect and instruct the Company to process it, and the Company processes it only as Customer's service provider under Customer's instructions.

30. Google API Services / Gmail and Calendar Data

30.1. Scope of this section. This section describes, specifically and separately from the general disclosures in Sections 19-29 above, how the Company's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, for every Google integration the Service actually offers today: Gmail and Google Calendar. This section makes the general disclosures in Section 5 and Section 22 concrete for Google specifically; it does not expand what those sections already permit.

30.2. What Google data the Service accesses.

• Gmail (where Customer connects a Gmail account): the content and metadata of messages in the connected mailbox needed to display, classify, draft replies to, and send messages on Customer's behalf — message subject, sender/recipient/cc addresses, message body text and HTML, a short preview snippet, timestamps, and Gmail's own message and thread identifiers. The Service does not access or store Gmail attachment file content. The Service uses the `gmail.modify` scope (read, send, and organize mail on Customer's behalf) and the `userinfo.email` scope (to identify which mailbox is connected).
• Google Calendar (a separate, optional integration — connecting Gmail does not connect Calendar, and connecting Calendar does not connect Gmail): the connected account's list of calendars (identifier, display name, time zone), free/busy availability, and the details of events the Service creates, updates, or cancels on Customer's behalf when an appointment is scheduled through the Service (summary, description, start/end time, attendees, reminders). The Service uses the `calendar.events`, `calendar.freebusy`, and `calendar.calendarlist.readonly` scopes, and the `userinfo.email` scope to identify the connected account. The Service does not request the broader, unrestricted `calendar` scope.
• For both integrations: OAuth access and refresh tokens, used only server-side to maintain the authorized connection, as described in Section 30.5 below.

30.3. How the Service uses Google data. Solely to provide the mailbox and/or calendar connection an authorized owner or admin enabled, and the specific features built on it: displaying and organizing inbound Gmail messages; generating AI-assisted classifications and draft replies for Customer's review and approval; sending Customer-approved replies and new messages through Gmail; checking calendar availability and creating, updating, or cancelling calendar events to reflect appointments scheduled through the Service; and reporting integration and sync health so Customer can see whether a connection needs attention. Google data is used only for the organization that authorized the connection and only for the functionality that organization has enabled — never for any other Customer, and never for a purpose unrelated to providing the Service Customer requested.

30.4. Sharing, sale, and prohibited uses.

• Gmail message content described in Section 30.2 may be sent, transiently and only as needed to generate a classification or a draft reply, to the Company's AI model provider (currently Anthropic) — see Section 5 and Section 22. Google Calendar data described in Section 30.2 is not sent to any AI model provider; availability checks and event creation, updates, and cancellation are performed through direct, deterministic calls to the Google Calendar API.
• Both Gmail and Google Calendar data are stored using the Company's hosting, database, and encrypted secret-storage (Vault) infrastructure described in Section 22, solely for the purpose of operating the Service.
• The Company does not sell Google user data; does not broker or otherwise transfer it to data brokers; does not use or disclose it for advertising or ad-targeting purposes; does not use it for recruiting or other employment-related decisions; does not use it for credit, lending, or insurance eligibility decisions; and does not use it for any other unrelated profiling. The Company does not transfer Google user data to any third party except the specific subprocessors described in Section 22, each engaged only for the purpose and to the extent described there.

30.5. Security. Gmail and Google Calendar OAuth access and refresh tokens are stored server-side only, in the Company's encrypted, Vault-backed secret store, and are never returned to Customer's browser or exposed in any client-facing response. All connections to Google's APIs use HTTPS/TLS. Access to the underlying data is bounded by the tenant data isolation and role-based access controls described in Section 13.1, and account and data actions are recorded in the Company's audit log. As stated in Section 13.1, the Company does not hold, and does not represent that it holds, any particular third-party security certification unless expressly identified as held in a specific written communication to Customer.

30.6. Google Limited Use disclosure. OpsBell's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. OpsBell uses Google Workspace/Gmail API data — and, where connected, Google Calendar API data — only to provide or improve user-facing features that Customer's authorized user requested, as described in Section 30.3. OpsBell does not use Google Workspace/Gmail API data, or Google Calendar API data, to develop, improve, or train generalized, non-personalized artificial-intelligence or machine-learning models. The transient, per-message use of Gmail content described in Section 30.4 to generate a classification or a draft reply for the connected organization's own review is a permitted, feature-specific use under this Section 30.6, not a prohibited generalized-training use.

30.7. Retention and deletion. Gmail message content and Google Calendar data ingested through the Service are retained as Customer Content for as long as the connection remains active and the organization remains active on the Service, consistent with Section 25 above. An owner or admin may disconnect a Gmail or Google Calendar integration at any time in the Service's integration settings; doing so revokes the Company's authorization with Google where Google's revocation endpoint accepts the request, and the Service stops accessing that account from that point forward. Previously ingested data already stored in the Service is not deleted immediately upon disconnection — it is handled according to the same retention and deletion practice described in Section 12.4 and Section 25. Following account closure, the Company deletes or anonymizes active Customer Content, including Gmail- and Calendar-derived data, within the timeframe stated in Section 12.4, subject to the same backup and legal/security/tax/audit retention exceptions stated there. This is independent of, and does not control, any retention obligation Google itself has under its own policies. A request about this data, including a request to disconnect an integration, close an account, or ask a question about Google data specifically, may be directed to contact@opsbell.ai as described in Section 17.

30.8. Change notice. If the Company's use of Google data materially changes — for example, by requesting an additional Google API scope or by adding a new Google integration — that change will be reflected in a new published version of this document, and, where the change affects an authorization Customer has already granted, the Company will seek Customer's fresh authorization through Google's own consent flow before relying on the new scope.

These Terms, including this Privacy Policy, are the entire agreement between Customer and the Company regarding the Service, together with any applicable order form, proposal, or invoice referenced in Section 9.