Legal

Privacy Policy

Effective date: September 25, 2026

This Privacy Policy explains how AcaiOS ("AcaiOS," "we," "us," or "our") collects, uses, discloses, stores, and protects information when you visit acaios.io, create an account, purchase a subscription, connect AcaiOS to an approved AI service, or use AcaiOS services.

This policy applies to AcaiOS-controlled websites, applications, onboarding, billing, connectors, and operating services. Third-party services you use with AcaiOS also operate under their own privacy policies and terms.

1. Information we collect

Information you provide

We may collect your name, business email address, company name, role, contact details, support communications, and information you submit during onboarding. Onboarding information may include business goals, operations, products, services, policies, customers, workflows, preferences, instructions, approvals, and autonomy settings.

We may also process content and files that you choose to submit, connect, or authorize AcaiOS to use.

Google Sign-In information

Depending on what Google provides, AcaiOS may receive your Google account identifier, name, email address, and email-verification status. AcaiOS uses the immutable Google account identifier as the primary provider identity. Your verified email and name may be used for account display, billing continuity, auditing, security, and support.

Google Sign-In does not give AcaiOS access to your Gmail messages, Google Drive files, contacts, or other Google Workspace content. Google Calendar access is requested only if you separately connect Google Calendar, as described below. AcaiOS will not request additional Google permissions without presenting a separate consent request and updating this policy when required.

AcaiOS's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

Google Calendar information

AcaiOS accesses your Google Calendar only if you choose to connect Google Calendar to AcaiOS. When you connect it, Google shows you a separate consent screen, and AcaiOS requests these permissions:

• openid, email, and profile, to confirm which Google account you connected.
• https://www.googleapis.com/auth/calendar.events, to read events on your primary calendar and to book, reschedule, and cancel events on it.
• https://www.googleapis.com/auth/calendar.freebusy, to read when you are free or busy.

AcaiOS uses Google Calendar data only to read your availability and to book, reschedule, and cancel appointments for your business. AcaiOS stores the Google Calendar tokens it receives in encrypted form. You can disconnect Google Calendar in AcaiOS or revoke access through your Google Account security settings.

AcaiOS does not use Google Calendar data for advertising, does not sell it, and does not use it to train generalized AI models. AcaiOS's use of Google Calendar data complies with the Google API Services User Data Policy, including its Limited Use requirements.

Billing information

Stripe processes payment-card information for AcaiOS. AcaiOS receives transaction-related information such as your selected plan, billing status, Stripe customer or subscription identifiers, payment results, and limited billing contact information. AcaiOS does not store your complete payment-card number.

Connected services and AI surfaces

When you connect AcaiOS to Claude, ChatGPT, or another approved service, AcaiOS receives the account, authorization, tool-request, and business information needed to provide the requested function. The connected service may separately process conversation and account information under its own terms and privacy policy.

Automatically collected information

We may collect technical and usage information needed to operate and secure the service, including IP address, browser and device type, operating system, approximate region, login and authentication records, request and error logs, timestamps, security events, feature usage, and performance information.

2. How we use information

We use information to:

• Create, authenticate, secure, and support AcaiOS accounts.
• Preserve the selected plan and connect an authenticated customer to Stripe Checkout.
• Provision the correct AcaiOS organization, agents, tools, onboarding flow, and services after validated billing events.
• Operate AcaiOS through approved AI surfaces and respond to authorized tool requests.
• Process instructions, approvals, and configured autonomy settings.
• Maintain tenant isolation, prevent fraud and abuse, enforce permissions, and investigate security incidents.
• Provide billing, service, security, delivery, and operational notifications.
• Diagnose failures, improve reliability, develop features, comply with law, and enforce agreements.

We do not sell personal information. We do not use customer business data for cross-context behavioral advertising, and we do not use Google user data to build advertising profiles.

3. AI processing

AcaiOS uses artificial intelligence to interpret authorized requests, organize business information, generate content, recommend actions, and perform actions within the permissions the customer has granted. Information processed by AI may include onboarding answers, business content, instructions, tool inputs, and the minimum relevant context needed to complete a task.

AI can make mistakes. Customers should review outputs and proposed actions, especially where financial, legal, contractual, customer-facing, or operational consequences are involved. Consequential external effects require the customer's per-instance approval.

4. How we disclose information

We may disclose information to service providers that perform specific functions for AcaiOS, including:

• Cloudflare for hosting, networking, security, Workers, website delivery, and platform communications.
• Supabase for authentication, database, storage, and backend services.
• Stripe for payments, subscription billing, fraud prevention, and billing administration.
• Google for Google authentication and identity verification and, if you connect it, Google Calendar.
• Cloudflare Email Routing and Email Sending for delivering email that AcaiOS sends and receives for your business.
• Bland for Phone & Text calls and text messages, on your own Bland account, when you connect Phone & Text.
• Anthropic and OpenAI, where applicable, for approved AI-model processing or connected AI-surface functions.
• Operational providers used for monitoring, error reporting, support, security, or necessary infrastructure.

We may also disclose information at your direction or with your consent; to authorized users in your organization according to their roles; to comply with law or valid legal process; to protect rights, safety, security, and service integrity; or as part of a merger, financing, acquisition, reorganization, or sale of business assets subject to appropriate protections.

We do not permit service providers to use customer information for their own advertising merely because they process it for AcaiOS.

5. Data ownership and tenant isolation

Customers retain ownership of the business data they provide to AcaiOS. AcaiOS receives a limited right to process that data only as needed to provide, secure, support, and improve the service or as otherwise directed by the customer.

AcaiOS is designed as a multi-tenant service. Customer organizations are separated through application controls, tenant-scoped authorization, database policies, and other safeguards. Authorized users within an organization may have different permissions based on their roles.

6. Data retention

We retain account, billing, authorization, and business information for as long as reasonably needed to provide and secure the service, meet legal and accounting obligations, resolve disputes, prevent fraud, document consent or authorization, and enforce agreements.

When an account is closed or a verified deletion request is completed, AcaiOS deletes or de-identifies customer business data according to its operational deletion procedures, subject to legal, tax, accounting, dispute, security, fraud-prevention, and audit obligations. Information may remain temporarily in protected backups until normal backup rotation removes it.

Google OAuth transaction state and temporary session-exchange material are short-lived and are deleted, expired, cleared, consumed, or rendered unusable after use. AcaiOS does not place Google access tokens, Google ID tokens, Supabase session tokens, or Stripe secrets in customer-visible URLs.

7. Security

AcaiOS uses administrative, technical, and organizational safeguards intended to protect information. These include encryption in transit, provider-supported encryption at rest, tenant-scoped access controls, database policies, least-privilege permissions, narrow OAuth scopes, protected credentials and tokens, expiring authorization state, replay protections, authentication controls, audit records, monitoring, and revocation controls.

No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

8. Your choices and rights

Subject to applicable law, you may request access to, correction of, export of, or deletion of personal information or customer business data. You may also request restriction of certain processing or revoke a connected service authorization.

You can revoke Google access through your Google Account security settings. Revoking access may prevent AcaiOS login or connected features from working. To make a privacy request, contact hello@acaios.io. We may need to verify your identity and your authority over the relevant AcaiOS organization.

9. Cookies and similar technologies

AcaiOS may use cookies, local storage, and similar technologies that are necessary for authentication, security, session continuity, plan selection, preferences, and service operation. AcaiOS does not currently use personal information for cross-context behavioral advertising.

10. International processing

AcaiOS and its service providers may process information in the United States and other countries where they operate. Those locations may have data-protection laws different from the laws where you live. Where required, AcaiOS will use appropriate safeguards for international transfers.

11. Children

AcaiOS is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Customers must be legally able and authorized to enter agreements for their business.

12. Third-party services

AcaiOS may link to or connect with third-party websites, AI assistants, software, and services. Their privacy practices are governed by their own policies. AcaiOS is not responsible for the privacy or security practices of third parties that it does not control.

13. Changes to this policy

We may update this Privacy Policy to reflect changes in AcaiOS, connected services, legal requirements, or privacy practices. We will post the revised policy with a new effective date and provide additional notice when required by law or when changes are material.

14. Contact

AcaiOS
hello@acaios.io
acaios.io