Privacy Policy

This Privacy Policy explains how Operavo(“Operavo”, “we”, “us”) collects, uses, shares, and safeguards personal information when you use Operavo, our real-time voice agent that answers, qualifies, books, and hands off inbound calls, together with our dashboard, websites, and related services (the “Service”).

Operavo is sold to and configured by businesses (our Customers) who route their inbound phone calls through us. When you, as an end caller, dial a Customer using Operavo, the Customer is the “controller” of your personal information and Operavo acts as a “processor” on their behalf. For our own marketing site and dashboard accounts, Operavo is the controller.

Depending on how you interact with Operavo, we collect the following categories of information:

• Account data. Name, work email, company, password hash, role, and approval status you submit when you request access at /signup or sign in at /signin.
• Call audio and transcripts. Inbound call recordings, real-time speech-to-text transcripts, and structured turn-by-turn logs of what was said by the caller and by Operavo.
• Caller details. Phone number, caller ID where available, and any details the caller shares on the call (typically full name, email, address, appointment preferences, and reason for calling).
• Booking and CRM data. Appointment time, calendar invite metadata, lead score (Hot / Warm / Cold), AI-generated summary, recommended next action, and any CRM or spreadsheet rows we write on your behalf.
• SMS confirmations. Phone numbers and message content sent through our telephony partners when Operavo texts a booking confirmation.
• Integration data. Read and write tokens for the third-party tools you connect, such as Google Calendar and our SMS provider, limited to the narrowest scope required to deliver the feature you enabled. Where our own automation uses Google Drive or Google Sheets, it does so through Optify’s own Google account, not through a permission you grant.
• Usage and device data. IP address, browser, operating system, pages visited, referring URL, and product interaction events for the dashboard. Used to keep the Service secure and to debug problems.
• Cookies. Strictly necessary cookies for authentication (session token, theme), and optional analytics cookies if you accept them. See Cookies & tracking below.

When a business connects Google Calendar to Operavo, we request the email address of the connected Google account and permission to see and create events on the calendar you connect. We do not request access to Gmail, Google Drive, Google Contacts, or any other Google service through this authorization.

A connected calendar is required to use Operavo. Booking appointments is the core function of the product, so an account cannot be activated until a calendar is connected. This is made clear during sign-up, before you are asked to grant anything.

• What we read. When a caller asks for a specific time, we check events in that time window on the connected calendar to see whether the slot is already taken. We use this only to decide whether the time is available, and the response is never written to storage. We do not display, copy, or store the content of your existing events.
• What we write. Once the caller agrees a time, we create one new event on the connected calendar. The event contains the caller’s name, their phone number and email if they gave them, the service they asked about, and the agreed time, all taken from the phone call rather than from your calendar. We do not modify or delete events that Operavo did not create.
• What we store. The connected account’s email address, the OAuth access and refresh tokens, the granted permissions, and the token expiry, in a database table with no read policy, unreachable from any browser session. We also store the event ID Google returns for each appointment we create, so the dashboard can link an appointment to the calendar entry made for it.

We do not sell Google user data. It is processed only by Operavo and by the infrastructure and automation providers that run the booking feature described above, under contractual restrictions appropriate to their role, and is otherwise disclosed only where the law requires it.

You can disconnect at any time from Settings → Integrations. Operavo sends a revocation request to Google that invalidates the token, then deletes the stored connection. You can also remove Operavo’s access from your Google Account’s own permissions page. After disconnecting, your voice agent keeps answering and qualifying calls, but it can no longer book appointments until a calendar is reconnected.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Operavo answers and records inbound phone calls on behalf of our Customers. Many U.S. states (including California, Florida, Pennsylvania, Massachusetts, and Washington) and several countries require all parties to consent before a call is recorded.

• Disclosure. Every Operavo workspace is configured to play a short recording disclosure at the start of the call (for example: “This call may be recorded for quality and scheduling.”). Customers are responsible for keeping that disclosure enabled in their region.
• Caller controls. A caller can ask Operavo to stop the recording or to be transferred to a human at any time. Operavo will not store audio if a caller opts out before consent is captured.
• Retention. Recordings are retained for the period configured by the Customer (default 90 days) and then permanently deleted.

Operavo sends SMS text messages from a verified toll-free or 10DLC number on behalf of our Customers. The program is transactional only: appointment confirmations and reminders for bookings made through the Operavo voice agent. We do not send marketing messages, drip sequences, or third-party content, and we never sell, rent, or share phone numbers with third parties for their marketing.

What we send and how often:

• Confirmation. Sent immediately after the caller verbally opts in and the booking lands on the Customer’s calendar.
• Reminder. Up to one reminder before the appointment, when the Customer has reminders enabled.
• Reschedule or cancellation. Sent if the appointment time changes through Operavo.
• Frequency. Typically 1 to 3 messages per booking. No recurring marketing campaigns.

Sample messages:

• Confirmation. “Hi [Name], your appointment with [Business Name] is confirmed for [Date] at [Time]. Reply STOP to opt out, HELP for help. Msg & data rates may apply.”
• Reminder. “Reminder from [Business Name]: your appointment is tomorrow at [Time]. Reply STOP to opt out, HELP for help.”

Opt-out and help keywords:

• STOP. Reply STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message. We send a single confirmation and remove your number immediately. Replying STOP does not cancel the appointment; call the business directly to reschedule.
• HELP. Reply HELP or INFO for sender identification and our contact email (info@optifyllc.com).
• Costs. Operavo does not charge for these messages. Message and data rates may apply from your mobile carrier.
• Carriers. All major U.S. carriers are supported. Carriers are not liable for delayed or undelivered messages.

We use the information described above to:

• Run live calls: route caller intent, check calendar availability, book the appointment, and trigger the SMS confirmation.
• Hand off to a human agent and pass a short spoken brief when the caller asks for a person or the conversation falls outside what Operavo should handle.
• Tag every call Hot / Warm / Cold, write a two-sentence summary, and recommend the next action so your team knows who to call back first.
• Provide and improve the Service, including debugging failed calls, tuning recovery prompts, and training internal speech models on de-identified call audio only. Data received from Google APIs is never used for this purpose.
• Keep accounts, audio, and integrations secure: detect abuse, prevent fraud, and respond to incidents.
• Send transactional messages (workspace approval, billing, security alerts) and, only with your consent, product updates and release notes.
• Comply with legal obligations and enforce our Terms.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR:

• Contract. To provide the Service to a Customer or to you as the dashboard user.
• Legitimate interests. To keep the Service secure, prevent abuse, improve product quality, and operate our business, balanced against your rights.
• Consent. For optional analytics cookies, marketing emails, and any recording in jurisdictions that require it.
• Legal obligation. To meet tax, accounting, and law-enforcement requirements.

We do not sell or rent personal information. We share it only with:

• Customers. The business whose number the caller dialed receives the call audio, transcript, lead score, and booking record so they can follow up.
• Sub-processors. Vetted vendors that run essential parts of the Service: telephony, speech-to-text, large-language-model inference, SMS delivery, calendar sync, error monitoring, cloud hosting, and email delivery. Each is bound by a written data-processing agreement and may only use the data to deliver their service.
• Professional advisors. Lawyers, auditors, and accountants under confidentiality obligations.
• Authorities. Where required by valid legal process, or to protect the rights, property, or safety of Operavo, our Customers, or the public.
• Successors. In connection with a merger, acquisition, or sale of all or part of Operavo, under equivalent privacy commitments.

Operavo is operated from the United States. When personal information is transferred from the EEA, UK, or Switzerland to the United States or other countries, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures such as encryption in transit and at rest.

Retention defaults are listed below. Customers can shorten any of these in their workspace settings; we will not extend them without a written agreement.

• Call audio. 90 days from the call, then permanently deleted from primary storage and backups within a further 30 days.
• Transcripts & lead records. 13 months, so quarterly reporting works year-over-year.
• SMS message bodies. 90 days. Delivery metadata is kept for 13 months for deliverability auditing.
• Account & billing records. For the life of the account, plus 7 years after closure to meet tax and accounting obligations.
• Server logs. 30 days.
• Google Calendar tokens. Kept while your calendar is connected. Deleted immediately on disconnect or account closure.
• Created-event identifiers. Kept with the appointment record for 13 months, matching the retention period for other booking records.

Subject to local law, you have the right to access, correct, delete, export, restrict, or object to our processing of your personal information, and to withdraw consent where processing is based on consent.

• Dashboard users. Manage most of these directly from your account, or email info@optifyllc.com.
• End callers. Submit your request to the Customer you called (they control your data); we will support them in fulfilling it.
• California (CCPA / CPRA). You have the right to know, delete, correct, and limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Appeals. If we decline a request, you may appeal by replying to our decision email, and we’ll respond within 45 days.

We protect your data with industry-standard safeguards: TLS 1.2+ in transit, AES-256 at rest, scoped access tokens, least-privilege IAM, mandatory two-factor authentication for staff with production access, and continuous logging of administrative actions. No system is perfectly secure, so please tell us about a vulnerability at info@optifyllc.com.

We use a small set of cookies and similar technologies. You can manage non-essential cookies through your browser or our cookie banner where shown.

• Strictly necessary. Session, CSRF, and theme, required for the dashboard to work. Cannot be disabled.
• Product analytics. Aggregated usage events to improve flows. Loaded only after you opt in.
• No third-party advertising. We do not run ad-tracking pixels or share data with ad networks.

Operavo is built for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact info@optifyllc.com and we will delete it.

We update this policy as the Service evolves. Material changes will be announced in-product and by email to workspace admins at least 14 days before they take effect. The “Last updated” date at the top of this page always reflects the current version.

For privacy questions, data-subject requests, opt-out help, or to designate an authorized agent, reach us at:

• Email. info@optifyllc.com
• Phone. +1 (908) 552-1695