Privacy Policy

1. Who this policy covers

This policy is provided by OpenAce ("we," "us," or "our") for openaceai.com and the official hosted service at app.openaceai.com. Privacy questions and requests can be sent to openaceai@gmail.com.

OpenAce is also available as software you can run yourself. In an independently operated or self-hosted installation, the person or organization operating that installation controls its storage, model configuration, integrations, and access. Its additional privacy practices are their responsibility. Using a local installation does not, by itself, prevent data from being sent to external services you enable.

2. Information we handle

• Account and business details: your name, email address, business profile, account identifiers, preferences, and authentication information. Where password login is used, the password is stored as a hash rather than in readable form.
• Your work: chat messages, attachments, files, images, voice-derived text, leads, contacts, forms and submissions, workflow instructions, generated outputs, and other information you submit or ask Ace to retrieve.
• Connected-account information: the identity of the account you connect, the permissions granted, authorization tokens or credentials, connection status, and the authorized data needed for your tasks.
• Operational information: request and activity records, errors, device/browser information, network information such as IP addresses, session identifiers, usage/credit records, and notification subscriptions.
• Payments and support: purchase, billing-status, and support correspondence information when you use those features. Payment details entered into an external payment processor are handled by that processor; OpenAce does not need your full payment-card details to provide account credit records.

We use this information to authenticate you, provide requested features, save and resume work, operate connections, deliver notifications, respond to support requests, maintain security and reliability, and administer usage or billing. You should only submit or connect information you are authorized to use.

3. Google account data

Connecting Google is separate from signing into OpenAce. Google presents a consent screen, and you decide which permissions to approve. The available features depend on the permissions actually granted; declining a permission leaves that capability unavailable.

We store access and refresh tokens so an authorized connection can continue working without asking you to log into Google for each task. We do not receive your Google password through OAuth. Requests are scoped to your connected account, and you can choose among multiple connected accounts.

Relevant retrieved content and results may be included in your chat history, generated documents, saved business records, and operational activity records. Disconnecting stops future access through that connection but does not automatically erase these saved copies or undo changes already made in Google.

Limited Use: OpenAce's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google data for the user-facing features you authorize, not to create unrelated datasets, sell information, serve ads, assess creditworthiness, or train generalized models.

4. AI processing and model training

Ace provides task instructions and relevant context, including authorized tool results, to its configured AI model to generate responses and carry out your work. The official hosted deployment currently uses models running on OpenAce-operated infrastructure. A model running on that infrastructure is still processing your information on our server; it does not mean your information stays on your phone.

OpenAce software also supports separately configured external AI providers, including Google Gemini, OpenAI, Anthropic, and Moonshot. In deployments configured to use such providers, relevant prompts, attachments, conversation context, and tool results can be transmitted to the selected provider to perform the requested task. The installation's operator is responsible for selecting appropriate services, settings, and contractual protections. This paragraph describes those configurable deployments; it does not grant permission to use Google data for model training.

Google Workspace API data is not used to develop, improve, or train generalized or non-personalized AI/ML models. Hosted conversation capture into model-training datasets is disabled. We do not permit Google user data to be transferred to an AI provider for generalized model training. If the official hosted service changes how or where it processes Google data, we will update the disclosures and obtain any additional consent required before using that data in a materially new way.

5. Sharing, service providers, and human access

Information is disclosed as necessary to provide the features you use:

• Services you connect or instruct Ace to use: for example, Google receives API requests, email recipients receive messages you send, and services receive the information required to create your requested records or files. Information you intentionally publish or send is accessible to its intended audience.
• Infrastructure providers: Firebase Hosting serves the public website, and Cloudflare provides network/proxy services used by the website or app. These providers may process network, request, and security information needed to deliver the service.
• Optional feature providers: payment, email, SMS/voice, and push-notification services process the information needed for the feature you enable. Examples include Stripe for payments, your selected mail service, Twilio for connected messaging/phone features, and your browser or device's push service. Connecting Google does not itself subscribe you to every optional integration.
• Legal and security needs: we may disclose information when required by law or when necessary to address fraud, abuse, security incidents, or threats to people's rights or safety.

We do not sell your personal information or share Google user data for targeted advertising, data brokerage, or unrelated third-party profiling. Providers handling Google data on our behalf must be limited to providing the authorized service and must not use it for generalized AI training.

We do not routinely read the contents of your Google account. Human access to Google user data is limited to circumstances allowed by Google's Limited Use requirements, such as your affirmative permission to review specific content for support, necessary security or abuse investigations, or compliance with applicable law. OAuth tokens are used by server-side connection code and are not included in AI prompts or returned by the connection-management screens.

6. Storage and security

The hosted app stores account records, conversations, work products, and operational data on infrastructure operated for OpenAce. Google OAuth tokens and stored connection credentials are encrypted at rest. Account-scoped access checks limit access to connected-account records. The public website and hosted app use HTTPS.

These safeguards do not mean that every saved chat message or file has separate application-level encryption. Authorized administrators and service processes may have access needed to operate and support the service, subject to the restrictions above. No internet service or storage method can guarantee absolute security.

Depending on the service or deployment you use, information may be processed outside your state or country. This policy does not promise that all processing occurs in a particular geographic region.

7. Retention and deletion

• Saved account data and conversations: retained to support ongoing work until you remove them using available controls or request deletion. The hosted service does not currently apply a single fixed automatic expiry to all saved account content.
• Google authorization: retained while the connection is active. Disconnecting removes the stored connection record and its tokens from the active connection store and attempts to revoke authorization at Google. An already-running action may finish.
• Pending Google authorization: expires after ten minutes. Abandoned authorization-state files are cleaned up during later connection attempts.
• Operational records: some activity and error records are bounded by rolling entry limits; other support, security, or transaction records may be kept as needed for the stated purpose, dispute handling, or applicable legal obligations. Deleting a chat in the app may not remove copies present in operational records.
• Backups and independent copies: deletion from active storage may not immediately remove information from existing backups; such copies may remain until the backup is deleted or replaced and are not used for routine product processing. Messages already delivered, files saved in your Google account, and data held by an independently operated integration must be managed with that service.

For deletion of your hosted account, Google-derived content saved by Ace, or operational copies, email openaceai@gmail.com from the email associated with your account and describe what you want removed. We may verify ownership before processing the request. We will explain any information that must be retained and respond with the status of your request. Do not send passwords, access tokens, or payment-card numbers.

8. Your controls and requests

You can choose whether to connect Google, approve or decline permissions, select the Google account or sending identity used for a task, disconnect accounts in OpenAce Connections, and revoke access directly in your Google account permissions. To reduce previously granted Google permissions, revoke access and reconnect with the narrower set.

You may ask us to access, correct, provide a copy of, or delete your information, or raise an objection to its use, by contacting the address below. Available rights depend on your location and applicable law. Signing out ends access in that browser; it is not an account-deletion request. Disconnecting a service and requesting deletion of saved content are separate actions.

9. Cookies, browser storage, and notifications

OpenAce uses session cookies and browser storage for authentication, maintaining an anonymous or signed-in session, preferences, and application state. Its service worker can cache the app shell for loading reliability. These functions are not advertising trackers. Browser and hosting providers may maintain their own necessary security records.

Push notifications are optional and require your permission. If enabled, the app stores a subscription endpoint and associated delivery information. Your browser/device push service processes notification delivery. You can disable notifications through the app's notification settings or your browser/device controls.

10. Intended audience

OpenAce is designed for business and professional use, not for children under 13. If you believe a child has provided personal information through the official hosted service, contact us so we can investigate and address the information.

11. Changes to this policy

We will update the date on this page when the policy changes. For material changes, we will provide an appropriate notice through the service or other available contact channels. If a change introduces a new purpose or materially different use of Google data, we will obtain any additional consent required before that use.

12. Contact OpenAce

For privacy questions, data requests, deletion requests, or concerns about a connected account, email openaceai@gmail.com. Include your account email and enough information to identify your request, without sending credentials or other unnecessary sensitive information.