Privacy Policy

Product privacy for OplyAI calendar OAuth · Last updated October 29, 2026

1. Who we are

OplyAI operates an AI phone front desk at oplyai.com. The voice agent answers calls, checks availability, and creates, updates, or cancels booking events on a calendar you connect.

Contact: hello@oplyai.com · (831) 851-3416

2. Data we collect

Depending on how you use OplyAI, we may process:

  • Account and business contact details you give us (name, email, phone, business name).
  • Call and chat operational data needed to run the front desk (caller phone number when available, booking details the caller provides, call recordings/summaries where enabled for your plan).
  • Calendar OAuth tokens and calendar event data after you connect Google Calendar and/or Microsoft calendar via an OAuth “Allow” flow, so the agent can create, update, and cancel booking events.
Calendar OAuth scope emphasis. For Google Calendar we request only the https://www.googleapis.com/auth/calendar.events scope. For Microsoft we request the calendar equivalents needed to create/update/cancel events. We do not request Gmail read access, Drive, or broad mailbox access. You never share your Google or Microsoft password with OplyAI.

3. How we use data

We use this data only to:

  • Operate the AI phone front desk and related website chat (where included in your plan).
  • Check availability and create, update, or cancel booking events on the connected calendar.
  • Send or trigger calendar/email confirmations that the calendar provider already supports.
  • Support you, improve reliability, and meet legal or security obligations.

We do not sell Google or Microsoft user data. Calendar data is used for scheduling and booking for your business, not for advertising.

Google API Services User Data Policy (Limited Use)

OplyAI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through the Google Calendar (calendar.events) scope is used only to provide the booking features you enabled; it is not used for advertising, not sold, not transferred to third parties except as necessary to provide or improve these user-facing features, comply with law, or as part of a merger or acquisition, and is not read by humans except with your affirmative consent for specific messages or events, for security purposes, or as required by law. Google user data is not used to develop, improve, or train generalized AI or machine-learning models. If you separately enable the optional email add-on, data from the gmail.send scope is used only to send the booking emails you enabled.

Google OAuth tokens are encrypted at rest (AES-256-GCM) and in transit (TLS), and only OplyAI’s server systems can access them. Staff do not read Google user data except with your consent for support, for security reasons, or as required by law. We do not transfer Google user data to third parties except as needed to provide the feature (e.g., our hosting provider), for security, or as required by law.

4. Call recording and retention

Calls to OplyAI-powered lines may be recorded and transcribed so we can deliver messages, book appointments, and improve accuracy for that business. Where the law requires it, callers are told the call may be recorded; by continuing, callers consent. If you prefer not to be recorded, you can hang up and contact the business another way. Our receptionist is an automated assistant and will tell you so if you ask. We do not sell personal information or use callers’ data to train generalized AI models.

We keep data for these periods:

  • Call recordings: 90 days
  • Transcripts and call logs: 12 months
  • Booking and message records: while the client’s account is active, plus 30 days
  • Calendar and email connection (OAuth) tokens: until disconnected or revoked, or when service ends
  • Billing records: 7 years, as tax law requires

Short backup and security-log windows may apply after deletion.

When you disconnect, revoke access, or ask us to delete your data, we delete your Google OAuth tokens and any stored Google user data within 30 days (usually immediately), except short-lived security logs, which expire within 30 days.

5. Sharing and subprocessors

We share data only with service providers who help us run OplyAI (for example hosting, telephony, voice AI, email delivery, and calendar APIs from Google or Microsoft). Those providers process data under contracts and only for the purposes above. The current list is at oplyai.com/subprocessors. We may disclose information if required by law or to protect rights, safety, or the integrity of the service.

6. Your rights and how to revoke access

You can:

  • Ask us for access, correction, or deletion of business/account data we hold by emailing hello@oplyai.com.
  • Revoke calendar or email access anytime in your Google Account security settings (third-party access) or Microsoft account permissions, and/or ask us to disconnect the calendar on our side.
  • Stop using the service; we will stop active calendar use after disconnect.

Depending on where you live, you may have additional rights under applicable privacy laws. Contact us to exercise them.

7. Text messages (SMS)

The front desk plans we sell to clients do not include SMS. OplyAI LLC sends text messages only in two cases: alerts to business owners about their own OplyAI service (for example a new message or booking taken by the agent), and replies about a request to people who opted in to receive texts from us.

  • Opt-in. We text you only after you agree, for example by checking the optional box on our contact form or asking us to text you. Consent is never a condition of buying anything.
  • Frequency. Message frequency varies with your requests and account activity.
  • Cost. Message and data rates may apply.
  • STOP and HELP. Reply STOP to any message to opt out; we send one confirmation and then stop. Reply HELP for help, or email hello@oplyai.com or call (831) 851-3416.
  • Carriers. Carriers are not liable for delayed or undelivered messages.

Mobile numbers and SMS opt-in data are never shared with or sold to third parties or affiliates for marketing purposes.

See our Terms for the full SMS program terms.

8. Cookies

The oplyai.com website does not use advertising or analytics cookies, tracking pixels, or third-party trackers. Fonts are served from our own site. Our hosting provider (Netlify) may set strictly necessary technical cookies to deliver the site and process form submissions securely.

9. Children’s privacy

OplyAI is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, email hello@oplyai.com and we will delete it once we are notified.

10. Security breach notification

If we confirm a security breach that affects your personal information, we will notify affected users without undue delay and within 72 hours of confirming the breach, and we will tell you what happened, what data was involved, and what we are doing about it.

11. Governing law

This policy is governed by the laws of the State of Oklahoma, without regard to conflict-of-law rules, consistent with our Terms of Service.

12. Contact

OPLYAI LLC · oplyai.com
Email: hello@oplyai.com
Phone: (831) 851-3416

13. Changes

We may update this policy as the product or legal requirements change. The “Last updated” date at the top will change when we do. Material changes to calendar OAuth handling will be reflected here.