Privacy Policy

Optiva provides an AI workflow-automation platform. For most personal information that flows through the service (a Client’s customers, suppliers, employees, emails, invoices), the Client is the entity that decides how it is used- Optiva processes it on the Client’s behalf to operate the automations the Client configured. For the Client’s own account information, Optiva is the handler.

• Account information - name, email, hashed password, role, and security data (multi-factor authentication secrets, session and login metadata) for the people who use the dashboard.
• Business data the Client puts through the service- contacts and their details, suppliers, quotes, invoices and receivables, appointments, leads, support questions, online reviews, and the content of emails and documents the Client connects for processing. This may include personal information about the Client’s own customers.
• Employee payroll information (only if the Client uses payroll features) - including Tax File Numbers and bank details, which are treated as sensitive and encrypted at rest (see §6). TFNs are handled in accordance with the TFN Rule under the Privacy Act.
• Operational and technical data - automation execution logs, audit events, and usage metrics needed to run, secure, and bill the service.

We do not sell personal information, and we do not use Client business data to train our own models.

Directly from the Client (account sign-up, data they enter or upload) and, where the Client connects a third-party account (their mailbox, calendar, accounting ledger, or Google Business Profile) via OAuth, from those services with the Client’s authorisation and only within the scopes granted. We do not buy personal information from third parties.

To provide and operate the automations the Client configured - for example classifying and drafting replies to inbound email, drafting quotes and invoices, proposing appointment times, scoring leads, drafting review replies, bookkeeping intake, and payroll calculations. Also to secure the service, provide support, meet legal obligations, and bill the Client. We use information only for these purposes or directly related ones the Client would reasonably expect.

We use a small set of sub-processorsto deliver features the Client switches on (the AI model provider, the Client’s connected mail/calendar/accounting/review providers, text embeddings, hosting). Each receives only what the relevant feature needs, to act on the Client’s instructions. The current list, what each does, and where it is located is maintained on our Sub-processors page. Some sub-processors may process data outside Australia; where that occurs we take reasonable steps consistent with APP 8. The platform and the Client’s stored data are hosted in Australia (Sydney).

We may also disclose information where required by law.

When a Client connects a Google account, Optiva accesses Google user data. Google requires this to be spelled out explicitly, so it is set out here in full and in the same terms Google uses.

• What we access - with Gmail: the messages that arrive in the connected mailbox (sender, subject, body, attachments) and the ability to send replies from it. With Google Calendar: events, to read availability and to create, move or cancel appointments. With Google Business Profile: the Client’s reviews and the ability to publish replies to them. We access no other Google data.
• How we use it - solely to provide the features the Client switched on: sorting inbound mail into their spaces, drafting replies and quotes for a human to approve, reading a supplier invoice into their books, proposing appointment times, and drafting review replies. Every outbound message is approved by a person, or by an automation that Client explicitly enabled.
• Who it is shared with - the AI provider that performs the reading and drafting (Anthropic), listed on our Sub-processors page. It is never sold, never shared with advertisers or data brokers, and never used to build profiles across Clients.
• How it is protected - Google credentials are encrypted at rest with AES-based authenticated encryption and are never exposed to our automation layer or returned by any API. Access is segregated per Client by database row-level security, and all traffic is encrypted in transit.
• Retention and deletion - a Client can disconnect a Google account at any time from Settings, which deletes the stored credentials immediately. Deleting the workspace erases the associated Google data. Google data is retained only while the connection is active and the feature is in use.

Limited Use.Optiva’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI and machine learning. Google Workspace data is sent to our AI provider only to produce the output the Client asked for, and is not used to develop, improve or train any AI or machine learning model, by us or by that provider. We contract for no-training and zero-retention handling on that data, and we remove card numbers and tax file numbers before any content leaves our servers.

• Tenant isolation- every Client’s data is segregated by database row-level security; one Client can never see another’s.
• Encryption - passwords hashed with Argon2id; third-party tokens and sensitive payroll data (TFN, bank details) encrypted at rest; TLS in transit.
• Access control - role-based permissions, multi-factor authentication, and an audit trail of significant actions.

No security is perfect, but we take reasonable steps to protect information from misuse, loss, and unauthorised access.

We keep personal information only as long as needed for the purposes above or as required by law. Operational logs are automatically purged after the Client’s configured retention window. Financial records are retained for at least five years as required by Australian tax law. When a Client deletes their account, all their data is permanently destroyed (see §9).

Enquiries sent through the contact form on our website are used only to reply to you. They stay in our mailbox for 24 months, then they are deleted. You can ask us to delete yours sooner at any time.

A Client can export a copy of their data at any time (Settings → Privacy → Export) and can correct information directly in the app. Individuals whose information a Client processes should contact that Client (the controlling entity); we will assist the Client to meet such requests.

A Client owner can permanently delete the account and all associated data from Settings → Privacy. This is immediate and irreversible (subject to any minimum legal retention that applies to specific records, such as financial records).

Questions or complaints: contact@optiva-solutions.com. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this policy; the current version is always available at this page. Material changes will be notified to Clients.