Privacy Policy

Information the OS stores

We store the information needed to operate an agency workspace, including user identity, organization membership, CRM records created by users, security logs, and basic integration connection status.

Connected-platform data

When an authorized agency administrator connects Gmail, Google Calendar, Google Ads, Meta and Instagram Ads, QuickBooks Online, Stripe, or Twilio, the provider displays its own authorization screen. The OS stores an encrypted authorization grant and the minimum account, company, calendar, or advertising-account identifiers needed to operate the connection.

Provider business records—such as campaigns, performance metrics, calendar events, invoices, payments, expenses, and message bodies—are requested when an authorized user opens the corresponding view. The OS is designed not to automatically persist those provider records in its database. An agency may explicitly save selected, normalized advertising metrics and its own commentary as a client report. Saved reports include the reporting period, source settings and agency branding, rather than raw provider responses or credentials.

How connected data is used

Connected data is used to display information and carry out actions requested by authorized users, subject to the connection's permissions and workspace controls. The OS does not sell connected account data or use it for unrelated advertising.

Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Google Calendar and Gmail

AgencyOS uses the connected Google account's identifier and email address to identify the account and associate its connection with the correct workspace. Google asks which permissions to grant when you connect or enable additional features.

For Google Calendar, AgencyOS lists available calendars and reads events from calendars selected for the workspace. If an authorized user enables calendar changes, AgencyOS can create, update or cancel supported events. Google may send invitations and updates to attendees as part of these requested changes.

For Gmail, AgencyOS reads conversation details, message headers, bodies and supported inline images to display the inbox. Attachment names and sizes are shown with a message; file contents are retrieved only when you download them. It can read the connected sender's signature for the composer. With the relevant permissions and workspace controls enabled, users can send messages and replies, mark conversations read or unread, and archive or restore conversations to the inbox. Editing an imported signature in AgencyOS does not change the signature in Gmail.

Google data processing and storage

Google data passes through AgencyOS application servers to provide these features. Message bodies, displayed calendar events and imported signatures are processed when needed rather than automatically archived as provider-content snapshots in our database. Opened email bodies, image-display choices, unsent drafts and imported signatures may remain in the current browser workspace's memory. Reloading the application discards that session state.

We retain encrypted connection credentials, account and selected-resource identifiers, and workspace records needed to operate the connection. User-created routing and CRM relationships may reference a Google conversation or calendar event. Email sending records retain request identifiers and hashes, account references, provider message identifiers, outcomes and timestamps rather than raw email bodies, subjects or recipient addresses.

Calendar action records retain the requested operation, names of changed fields, account, calendar and event identifiers, request and version hashes, outcomes and timestamps. Completed action receipts do not store the event title, description, location or requested schedule. Related activity and security records identify the action and the workspace user who performed it.

To finish a requested Gmail inbox action or Calendar change after you close AgencyOS, we temporarily save the command in encrypted storage. A pending Calendar command includes the title, description, location and schedule you submitted. Command contents are deleted after a confirmed completion or failure, or when the 24-hour processing window expires and cleanup runs. Minimal queue records are kept for 30 days after completion; unresolved outcome records remain until resolved. This queue does not store email bodies or attachments and does not send queued email messages.

Email images and recipients

External images in received messages are hidden until you choose to display them. Displaying them causes your browser to contact the image host, which may receive your IP address and request information. Imported signature previews may also contain externally hosted images.

Sending a message or changing an event shares the requested content with Google and, as applicable, the recipients or attendees you select.

Service providers

Vercel hosts the application runtime and Supabase provides authentication and database services. Connected platforms process authorization and API requests under their own terms and privacy policies. Our configured transactional email provider processes recipient email addresses, report invitations and verification codes when those messages are requested. We may also disclose information when required by law or to protect the service and its users.

Security and retention

Integration grants are server-only and encrypted at rest. Access is limited by organization membership and role. No internet service can guarantee absolute security, but we use reasonable technical and organizational safeguards and remove grants when a connection is disconnected or deleted.

Saved client reports remain in the agency archive. Private links have independent email verification, expiration and revocation controls. Ending recipient access does not delete the agency's original report or a copy the recipient downloaded. Report deletion requests follow the contact process below.

Your choices

Organization administrators can disconnect an integration inside the OS and can also revoke it from the connected provider. To request access, correction, or deletion, visit the data-deletion page or contact us.

Contact

Onyx Dev Labs
1617 Park Place Avenue, Suite 110
Fort Worth, Texas 76110
support@onyxdev.io