Opsmate
Draft under legal review. This document is published so our partners can see how Opsmate handles data; it is not yet in effect and may change before counsel signs off. Version 0.3, last updated 2026-11-08.

Opsmate Privacy Policy

Opsmate ("Opsmate", "we"), 130 Johnny Smith Ln, Clinton, TN 37716, provides AI agents that help small businesses (our "Customers") answer leads, manage email and calendars, keep a customer database, publish content, and run a website. This policy explains what personal information we collect, how we use it, and the choices available. It covers our website, our dashboard, and the Service we provide to Customers.

Two roles matter here:

  • When you are a Customer (a business user of Opsmate), we are the controller of your account information.
  • When you are a Customer's contact (a lead, client, or correspondent of a business that uses Opsmate), the business is the controller of your information and we are its processor. We act on the business's instructions under our Data Processing Addendum. For questions about how a particular business uses your information, contact that business.

1. Information we collect

From Customers

  • Account details: name, email address, business name, role, sign-in events. Sign-in is by emailed link; we store no passwords.
  • Billing: handled by Stripe. We store a Stripe customer identifier, plan, and subscription status; we never see or store full card numbers.
  • Business profile: the services, hours, service area, prices, policies, brand voice, and rules the Customer enters, and documents the Customer uploads.
  • Connected accounts: with the Customer's authorisation, access tokens for Slack, email and calendar (through Nylas or Google), Twilio telephone numbers, social profiles (through Ayrshare), GitHub and Vercel for the Customer's website. Tokens are encrypted at rest.
  • Usage: how the dashboard is used, approvals and edits of Agent proposals, support requests.

On behalf of Customers (as processor)

  • Contacts and leads: names, email addresses, phone numbers, company, addresses, notes, consent status, and the content of conversations (emails, text messages, form submissions, missed-call records) exchanged with the business.
  • Calendar events the business connects, to schedule meetings.
  • Content the business chooses to publish (social posts, website pages).

Automatically

  • Server logs, device and browser information, IP address, and cookies needed to keep you signed in and to secure the Service. We do not use advertising cookies or third-party analytics trackers, and we do not respond differently to "Do Not Track" signals because we do not track visitors across sites.

2. How we use information

  • To provide the Service: run the Agents, send and receive messages on the Customer's behalf, keep the customer database, publish approved content, host the website, and produce reports.
  • To learn each Customer's preferences from its own approvals and edits, so its Agents improve. We do not use one Customer's data to train or configure Agents for another Customer, and we do not use Customer data to train general-purpose AI models.
  • To bill, support, secure, and improve the Service, and to meet legal obligations.
  • To communicate with Customers about their account, the Service, and (with consent where required) new features.

3. AI processing

Agent behaviour is produced by large language models provided by Anthropic, PBC under a commercial agreement that prohibits use of our data to train their models. Message content, business information, and relevant history are sent to the model to produce a draft or decision. Content that comes from third parties (an inbound email or text, a form, a web page) is treated as untrusted data: Agents are instructed never to follow instructions inside it, and sensitive actions prompted by it require human approval. Agents identify themselves as AI assistants when asked.

4. Email and calendar data; Google Limited Use

When a Customer connects a Google account, Opsmate's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Gmail and Google Calendar data only to provide the features the Customer asked for (reading and replying to business email, drafting in the Customer's voice, scheduling meetings); we do not use it for advertising; we do not allow humans to read it except with the Customer's consent for support, for security purposes, or as required by law; and we do not transfer it to others except as needed to provide the Service.

Sent-mail history (the last ninety days) is analysed once at connection time to learn the Customer's writing voice; the examples kept are visible to the Customer in Knowledge & Rules and can be deleted there.

5. Text messaging

Text messages are sent through Twilio from a telephone number provisioned for the Customer. The Customer is responsible for consent to receive messages. Replying STOP to any message stops further texts from that business through Opsmate; HELP returns contact information. Opt-out status is recorded and honoured automatically. Messages are not sent between 9 pm and 8 am in the recipient's local time.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except with the messaging carriers and Twilio as needed to deliver the messages.

6. Sharing

We share information only with:

  • Sub-processors that help us run the Service, under contracts that limit their use of the data: Anthropic (AI models), Supabase (database, authentication, file storage), Railway (application hosting and job queues), Vercel (dashboard and website hosting), Twilio (telephony), Nylas (email and calendar access), Google (when a Customer connects a Google account), Slack (approvals and notifications, when connected), Ayrshare (social publishing, when connected), GitHub (website source code), Stripe (billing), Langfuse (AI tracing), Voyage AI (text embeddings), and Sentry (error monitoring, when enabled). We give Customers at least thirty (30) days' notice before adding a sub-processor that handles their contacts' data.
  • Recipients the Customer chooses: the people the Customer's Agents message, and the platforms on which the Customer publishes.
  • Authorities when required by law, or to protect rights, safety, or the Service.
  • A successor in a merger or acquisition, under this policy.

We do not sell personal information and do not share it for cross-context behavioural advertising.

7. Retention

  • Customer account and business data: for the life of the subscription and thirty (30) days after cancellation (the export window), then deleted from production systems. Backups age out on their normal cycle. Billing records are kept as required by tax and accounting law.
  • Raw inbound email payloads: ninety (90) days, after which only the processed conversation and summaries remain.
  • Logs: ninety (90) days. Logs are redacted of credentials, tokens and message bodies before they are written.

8. Security

Each Customer's data is isolated by database row-level security, so one Customer's account cannot read another's. Credentials for connected accounts are encrypted with keys held outside the database. Access by Opsmate staff is logged in the Customer's audit trail. Every Agent action is recorded. We test cross-tenant isolation and a red-team suite of adversarial scenarios as part of every release. No method of transmission or storage is perfectly secure; we will notify Customers of a breach affecting their data as required by law and our Data Processing Addendum.

9. Your choices and rights

Customers can view and edit their business information, knowledge, and rules in the dashboard; disconnect any integration at any time; export their data; and cancel. Owners can request deletion of their account data before the export window ends by contacting us.

Contacts of a Customer should direct requests to access, correct, or delete their information to the business they interacted with; we will help the business fulfil such requests. Replying STOP opts out of texts from that business.

Depending on where you live (for example California, Colorado, Virginia, the EU or UK), you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and not to be discriminated against for exercising them. To exercise a right, email privacy@opsmate.us. We will verify your identity and respond within the time the law requires. You may also appeal a decision by replying to our response.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their information; if we learn we have, we delete it.

11. International transfers

We operate in the United States. If you access the Service from elsewhere, your information is transferred to and processed in the United States. Where required, we rely on standard contractual clauses with sub-processors.

12. Changes

We will post changes here and, for material changes, notify Customers at least thirty (30) days in advance.

13. Contact

Opsmate, 130 Johnny Smith Ln, Clinton, TN 37716. Email: privacy@opsmate.us.