Privacy Policy

1. About this policy

1.1 The Generous Company Pty Ltd (ACN 679 992 164), trading as Opair ("Opair", "we", "us"), operates the Opair platform, website and related services (the "Services"). This policy explains how we collect, use, share and protect personal information when businesses and their staff use the Services.

1.2 We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the laws of another country apply to you, we comply with them to the extent they apply.

1.3 This policy forms part of our Terms of Service. Capitalised terms such as Agent, Channel, Connected Service and Credits have the meanings given in the Terms.

2. Who this policy covers

2.1 Customers and their users. Opair is for businesses. Account holders and anyone they invite must be at least 18.

2.2 People who interact with an Agent. When someone emails or messages one of our customers' Agents, or joins a meeting a customer transcribes, we process their information on that customer's behalf. The customer decides why that information is collected and is responsible for telling those people and obtaining any consent required.

3. Information we collect

3.1 Account information. Your name, email address, role, workspace membership, sign-in details (handled by Clerk), and notification and onboarding preferences.

3.2 Billing information. When you buy Credits, Stripe collects your card details, billing address and, if you provide it, your ABN or other tax ID. We receive your name, email, billing address, tax ID, purchase amounts and payment status. We never receive or store full card numbers. We also keep a record of your Credit balance and how it was used.

3.3 Customer Data. The content you and your Agents work with: your instructions, projects, files and uploads, Outputs, Agent configuration and message history, and the business context Opair builds up about how you operate.

3.4 Connected Service data. When you connect a service such as Google Workspace, Microsoft 365, Xero or Slack, we store the access tokens in our encrypted Vault. Your Agents then read and act on data from that service within the access you grant.

3.5 Communications data. Through Channels, we process:

• emails sent to and from Agent mailboxes, including headers and attachments
• SMS messages sent to an Agent's phone number, which receives SMS only, including the sender's number and the time received
• messages on WhatsApp, Slack and Discord, including sender details
• meeting audio streamed for transcription, and the resulting transcripts

This can include personal information about people outside your business (see 2.2).

3.6 Your own AI keys. If you connect your own API keys for AI model providers, we store them encrypted, along with the spending limits you set.

3.7 Prompt capture (opt-in only). If you turn on "Share model traffic for troubleshooting" in Settings, Opair staff can capture the exact requests your Agents send to AI models, and the replies, while they investigate a problem you have raised. Captures are visible only to Opair staff and are deleted automatically after 7 days. Nothing is captured unless you opt in, and turning it off stops capture immediately.

3.8 Security and audit records. Logs of actions taken on your account, administrative actions by Opair staff (including IP addresses), security events, and abuse or fraud flags.

3.9 Technical data. IP address, browser and device type, session state, and usage metadata for each AI request (model, token counts, timing and errors).

3.10 Feedback. If you send us feedback through the Platform, we record it, and it may be logged in our issue tracker (GitHub).

3.11 Cookies. We use only the cookies needed to keep you signed in and to keep the Services secure. We do not use advertising or analytics cookies.

4. How we use information

We use personal information to:

• create and run your account, Agents and Channels
• carry out the work you ask for, including sending your instructions and Customer Data to AI model providers and returning the results
• connect to the services you link and act within the access you grant
• process Credit purchases, calculate GST and issue tax invoices
• provide support, including prompt capture where you have opted in
• keep the Services secure, and detect and respond to fraud, abuse, spam and security incidents
• keep audit records for security, compliance and dispute resolution
• send service messages, such as billing notices and alerts about your Agents
• improve the reliability and performance of the Services
• meet our legal obligations, including tax and record keeping

We send marketing emails only where the law allows, and you can unsubscribe at any time.

For people in the EEA, UK or Switzerland, we rely on performing our contract with you, our legitimate interests (security, fraud prevention and improving the Services), legal obligations, and consent where we ask for it.

5. AI model providers

5.1 To do the work you ask for, we send your instructions and the relevant Customer Data to third-party AI model providers. We route these requests through OpenRouter, which passes each one to an underlying model provider, such as Anthropic, OpenAI, Google, Amazon Web Services or Microsoft Azure.

5.2 Zero data retention. We only use model routes that do not retain your data after processing it. We do not allow any provider to use your data to train its models.

5.3 Your choice of models. In Settings you can restrict which models and providers your account uses. Only routes that meet section 5.2 are offered.

5.4 Your own AI keys. If you connect your own key, requests made with it are governed by your agreement with that provider.

5.5 Google user data. This section applies to information we receive from Google APIs when you connect a Google account ("Google user data").

What we access. Opair asks only for the access the integration you choose needs:

• Gmail, read: to read and search your messages and their attachments (gmail.readonly);

• Gmail, send: to create drafts and send messages from your account when a task you set calls for it (gmail.compose);

• Google Calendar: to read your calendars and events (calendar.readonly) and, where you choose the write integration, to create, change and delete events on calendars you own (calendar.events.owned);

• Google Drive: to read the files in your Drive (drive.readonly) and, where you choose the write integration, to create files and to change the files Opair created or that you open with it (drive.file); and

• your Google account's email address and identifier (openid, userinfo.email), to show which account is connected.

How we use it. We use Google user data only to provide and improve the features you use it with: one of your agents reads, drafts, sends, schedules or saves on your behalf as part of a task you have set, and you see the result in Opair. We do not use Google user data for advertising, we do not sell it, and we do not use it to profile you for any other purpose.

AI and machine learning. We do not use Google user data, or anything derived from it, to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models, and we do not allow anyone else to. To carry out a task, the content it involves is sent through OpenRouter to the model provider running your agent, only on endpoints that retain no copy of it (section 5.2). Those providers process it to produce the response and do not train on it.

Who we share it with. We share Google user data only: with the model providers just described, to perform the task you asked for; with the infrastructure providers that host and store the Platform (section 6.1), whose contracts limit them to providing those services to us; where necessary to comply with applicable law, or to protect against fraud, abuse or security threats; and, with notice to you, as part of a merger, acquisition or sale of assets under these same terms. We do not transfer it to anyone else.

Human access. No one at Opair reads your Google user data unless you ask us to, for example when you ask us for help with a particular task (and then only what that help requires); unless it is necessary for security purposes, such as investigating abuse; or unless applicable law requires it.

Storage and security. The tokens for your Google account are stored encrypted (AES-256-GCM) in your Vault and are used only by the agents you connect them to. Content an agent works with is kept where the task puts it, such as your agent's conversation history, files and working notes in your account, under the retention periods in section 8.

Revoking access and deleting data. You can disconnect a Google account in the Vault at any time, which deletes its stored tokens so no agent can use them again. You can also remove Opair's access from your Google Account at https://myaccount.google.com/permissions. Content your agents have already saved stays in your account until you delete it or close your account; closing your account deletes it (sections 8 and 10).

Limited Use. Opair's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.6 No training by Opair. Opair does not use your Customer Data to train AI models.

6. Who we share information with

6.1 Service providers. We use the providers below to run the Services. Each one handles personal information only to provide its service to us.

6.2 Your Connected Services. When an Agent acts on a service you connected, data moves between Opair and that service as you direct. Those services are your providers, not ours, and their own privacy terms apply.

6.3 Stripe collects card details directly and acts as an independent controller under its own privacy policy.

6.4 Business transfers. If Opair is merged, acquired or sells substantially all of its assets, personal information may transfer to the new owner. We will tell you before that happens.

6.5 Legal disclosure. We may disclose information where the law requires it, or to protect people, the Services or our rights.

6.6 No sale. We do not sell personal information or share it for advertising.

7. Overseas disclosure

7.1 Opair is based in Australia, but most of our providers store or process information overseas, mainly in the United States. AI model providers may process data in other countries where they operate.

7.2 Before disclosing personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs (APP 8).

7.3 For information transferred from the EEA, UK or Switzerland, we rely on the transfer safeguards in our providers' terms, such as the European Commission's Standard Contractual Clauses.

8. How long we keep information

Our database provider keeps a 7-day recovery history, so a deleted record can remain there for up to 7 days.

9. Security

9.1 We protect personal information with measures including:

• AES-256-GCM encryption of credentials and API keys in a Vault that runs separately from the main application
• encryption in transit (TLS) between your browser, the Services and our providers
• checks on every request so each customer can access only their own data
• each Agent running in its own isolated machine, with outbound access limited to approved destinations
• detection of leaked credentials in Agent output
• audit logs of staff and account actions

9.2 Opair's systems can decrypt Vault contents, and do so only when needed to carry out a task you have authorised.

9.3 No system is completely secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

10. Your rights

10.1 You can ask to access or correct the personal information we hold about you. Depending on where you live, you may also have rights to deletion, restriction, portability and objection, and to withdraw consent.

10.2 Email support@opair.ai to make a request. We may need to verify your identity, and we will respond within 30 days.

10.3 If someone who contacted one of our customers' Agents asks us about their information, we will refer them to that customer, because the customer controls that information.

11. Complaints

11.1 If you have a complaint about how we handle personal information, email support@opair.ai. We will acknowledge it and respond within 30 days.

11.2 If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the EEA or UK, you can contact your local data protection authority.

12. Changes and contact

12.1 We will update the effective date when this policy changes. For material changes, we will email you before they take effect.

12.2 Contact: The Generous Company Pty Ltd (ACN 679 992 164), trading as Opair, Melbourne, Victoria, Australia. support@opair.ai