Privacy Policy

2.1 Information You Provide

• Account Information: name, email address, phone number, and profile details you provide when registering or signing in.
• Authentication Data: credentials used to sign in via email/password or third-party providers such as Google Sign-In.
• User Content:any information, documents, or data you submit through the App as part of your organization's workflow.

2.2 Information Collected Automatically

• Device Information: device type, operating system, unique device identifiers, and browser type.
• Usage Data: pages viewed, features used, timestamps, and interactions within the App.
• Log Data: IP address, access times, and diagnostic information.

2.3 Google Account Data

When you sign in with Google and explicitly authorize additional Google integrations in the App, we receive basic profile information (name, email address, profile picture, and Google account ID) and access the specific Google APIs listed in Section 3. We do not access any Google services or data unless you explicitly authorize them through the Google OAuth consent screen inside the App.

3.1 Google Scopes We Request and How We Use Them

We request each Google scope solely to deliver a specific, user-facing feature inside the App. We do not use Google user data for any other purpose.

• userinfo.profile, userinfo.email — used only to identify your Google account and link it to your Oxiom user profile at sign-in.
• https://www.googleapis.com/auth/calendar.events — used only to display your upcoming meetings in the App and to create or reschedule events when you explicitly request it (including via voice commands).
• https://www.googleapis.com/auth/tasks — used only to display your tasks inside the App and to create or mark tasks as completed when you request it.

Email inside the App is handled exclusively via user-configured IMAP/SMTP accounts (see Section 4). We do not request Gmail scopes and never access Gmail data through Google APIs.

3.2 Limited Use Commitments

With respect to data obtained from Google APIs, we commit to the following:

• We use Google user data only to provide or improve the user-facing features that are visible in the App and described in Section 3.1.
• We do not transfer Google user data to third parties except (a) as necessary to provide or improve the user-facing features described above, (b) to comply with applicable law, or (c) as part of a merger, acquisition, or sale of assets with your explicit prior consent.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not sell Google user data to third parties or data brokers under any circumstances.
• We do not use Google user data to train, fine-tune, or otherwise develop generalized or foundational AI or machine-learning models — whether our own or those of any third party. Google Calendar events and Google Tasks may be sent to the OpenAI REST API only when you explicitly invoke an in-App action that requires it (for example, a voice command such as "what's my next meeting"). Per OpenAI's Enterprise Privacy commitments and API data-usage policy, data submitted to the OpenAI API is not used to train OpenAI's models unless the customer explicitly opts in. We have never opted in.
• We do not allow humans to read Google user data, except: (a) with your explicit consent for the specific data being read, (b) when necessary for security purposes such as investigating abuse, (c) when required by law, or (d) when the data has been aggregated and anonymized and is used for internal operations.

3.3 Revoking Access

You can revoke the App's access to your Google account at any time — either from within the App (Settings → "Disconnect Google") or at myaccount.google.com/permissions.

12.1 Google APIs

Google Sign-In, Gmail, Google Calendar, and Google Tasks — subject to Google's Privacy Policy. Scopes and purposes are listed in Section 3.1.

12.2 OpenAI (AI provider)

• Provider: OpenAI, Inc., San Francisco, California, USA.
• Plan / tier: pay-as-you-go OpenAI API (project-scoped API key). No aggregator, gateway, or model hub is used — the App connects directly to api.openai.com.
• Models used: gpt-4o, gpt-4o-mini, gpt-4.1-mini (chat completions), whisper-1 (speech-to-text), tts-1 (text-to-speech).
• What is sent: only content necessary to fulfill a user-initiated action (e.g., a voice transcript for classification, an email body for summarization, a text prompt for chat). No bulk or background transfer of Google user data ever occurs.
• Training: OpenAI does not train on API customer data by default, per its Enterprise Privacy commitments. We have not enabled the opt-in data-sharing setting, so no data submitted from Oxiom to OpenAI is used to train, fine-tune, or otherwise develop any AI or ML model.
• Retention at OpenAI:up to 30 days for abuse-and-misuse monitoring, then deleted, per OpenAI's API data-usage policy.
• No other AI providers: Oxiom does not use Anthropic, Google Gemini, Cohere, Groq, Perplexity, Mistral, Replicate, Azure OpenAI, AWS Bedrock, OpenRouter, Together AI, Fireworks, or any self-hosted or offline AI model.

12.3 Other infrastructure providers

• Amazon Web Services — application hosting, database, and identity/authentication infrastructure (EU region).
• Analytics providers — used for aggregated, non-personally-identifiable product analytics only.