Privacy & Data Protection

Privacy Policy

Last Updated: 10/24/2026

This Privacy Policy explains how Octasys LLC, a Kentucky limited liability company located in Louisville, Kentucky, USA (“Octabiz”, “we”, “us”, or “our”), collects, uses, stores, shares, and protects personal data when you use octabiz.ai, Octabiz applications, websites, and related services (the “Service”).

By using Octabiz, you agree to the practices described in this Privacy Policy.

1. Scope of This Privacy Policy

This Privacy Policy applies to:

Visitors to our website
Individual users of Octabiz
Business customers using Octabiz
Team members added to a customer account
End customers, vendors, employees, or other individuals whose data is entered into Octabiz by our customers

Octabiz may act as:

Data Controller when we process account, billing, website, analytics, security, and direct relationship data
Data Processor when we process business, customer, financial, operational, or end-customer data on behalf of our customers

Where Octabiz acts as a Data Processor, the customer is responsible for determining the lawful basis for processing the data.

2. Data We Collect

We may collect and process the following categories of data.

2.1 Account Data

Name
Email address
Phone number
Company name
Billing information
Login and authentication data
Role and permission settings

2.2 Business and ERP Data

Depending on the modules used, customers may upload or generate:

Inventory data
Warehouse data
CRM records
Procurement records
Vendor information
Accounting records
Invoices
Transactions
POS records
Booking records
Project management data
Pharmacy management data
Rug store and rug/carpet cleaning management data

2.3 Financial Data

Octabiz may process financial and accounting-related data, including:

Invoices
Payments
Ledger entries
Sales records
Purchase records
Tax-related records
Financial reports

Octabiz does not independently verify the accuracy, completeness, or legal sufficiency of financial data entered by users.

2.4 Customer and Third-Party Data

Customers may enter data about their own customers, vendors, employees, contractors, or other business contacts, including:

Names
Contact details
Transaction history
Service records
Purchase history
Notes and communications

Customers are responsible for ensuring they have a lawful basis to upload and process such data.

2.5 Technical and Usage Data

We may collect:

IP address
Device type
Browser type
Operating system
Access timestamps
Login history
Pages and features used
Error logs
Security logs
Approximate location based on IP address

2.6 Cookies and Tracking Data

We may use cookies, pixels, local storage, and similar technologies to:

Keep users logged in
Secure accounts
Remember preferences
Measure performance
Analyze usage
Improve marketing effectiveness

Non-essential cookies and tracking technologies will be used only where legally permitted or where valid consent is obtained.

2.7 AI Interaction Data

If you use AI-assisted features, we may process:

Prompts or inputs submitted to AI tools
AI-generated responses
User feedback on AI outputs
Metadata related to AI usage

AI features are intended to assist users, not to make final decisions on behalf of users.

3. How We Use Data

3.1 To Provide the Service

Create and manage accounts
Provide ERP functionality
Enable user roles and permissions
Process subscriptions and usage-based billing
Provide customer support
Maintain account security

3.2 To Improve and Maintain the Service

Debug errors
Monitor performance
Improve features
Analyze usage patterns
Develop new modules and functionality

3.3 To Provide AI-Assisted Features

We may use AI interaction data to:

Generate responses
Assist with system navigation
Improve usability
Detect errors or abuse
Improve AI-assisted features

Unless otherwise agreed in writing, Octabiz does not use customer business data, financial data, or end-customer data to train public, third-party, or generally available AI models.

Where AI improvement uses customer content, we will either:

Use aggregated or de-identified data where reasonably possible
Rely on a lawful basis under applicable law
Provide opt-out or consent controls where required

3.4 For Security and Abuse Prevention

We use data to:

Detect unauthorized access
Prevent fraud
Prevent spam or misuse
Enforce our Terms of Service
Protect users, customers, and the platform

3.5 For Legal and Compliance Purposes

We may process data to:

Comply with legal obligations
Respond to lawful requests
Resolve disputes
Enforce contracts
Maintain required business records

5. Data Processing Agreement (DPA)

For business customers subject to GDPR, UK GDPR, or similar data protection laws, Octabiz makes a Data Processing Agreement available.

The DPA governs processing where Octabiz acts as a Data Processor and includes:

Subject matter and duration of processing
Nature and purpose of processing
Categories of personal data
Categories of data subjects
Customer instructions
Confidentiality obligations
Security measures
Subprocessor rules
Assistance with data subject requests
Data breach notification support
Deletion or return of data after termination
Audit and compliance cooperation

If there is a conflict between this Privacy Policy and an executed DPA, the DPA controls for processor-related processing.

6. AI and Automated Processing

Octabiz may use AI-assisted features to support users.

We log each AI request in PostHog, our analytics provider in the United States, to monitor the cost, reliability, and quality of AI features. Each log records the model, token counts, response time, and any error. By default it also records the text of the prompt and the reply, which can include personal data that you or your users enter into an AI feature, such as names, messages, or invoice and receipt details.

AI outputs may be inaccurate, incomplete, or unsuitable for a specific use case. Users are responsible for reviewing, validating, and deciding whether to rely on AI outputs.

Octabiz does not use AI to make solely automated decisions that produce legal or similarly significant effects on individuals.

If this changes in the future, we will update this Privacy Policy and provide required safeguards, including notice, human review, and rights to contest decisions where applicable. GDPR Article 22 restricts solely automated decisions with legal or similarly significant effects unless specific conditions and safeguards apply.

8. Subprocessors and Third-Party Service Providers

Octabiz uses third-party providers to operate the Service.

Current subprocessors and service providers may include:

Provider	Purpose
Stripe	Payment processing and billing
QuickBooks	Accounting integration
Twilio	SMS, voice, and authentication services
ClickSend	SMS delivery for transactional and marketing notifications
Cloud hosting providers	Infrastructure, storage, databases, and application hosting
PostHog (United States)	Product analytics, session recordings, error tracking, and monitoring of AI features, including the prompts sent to AI models and their replies
Analytics providers	Product analytics and performance measurement
Email providers	Transactional and support communications
AI service providers	AI-assisted functionality, where applicable

We require subprocessors to process data only as needed to provide their services and to maintain appropriate security and confidentiality obligations.

For GDPR-covered customers, material subprocessor changes will be handled according to the DPA.

Octabiz does not sell personal data.

9. International Data Transfers

Octasys LLC is based in the United States. Personal data may be transferred to, stored in, or processed in the United States or other countries where we or our subprocessors operate.

Where required, we use lawful transfer mechanisms such as:

European Commission Standard Contractual Clauses
UK International Data Transfer Addendum, where applicable
Other approved transfer mechanisms

10. Data Retention

We retain data only as long as reasonably necessary for the purposes described in this Privacy Policy.

10.1 Active Accounts

Data is retained while the account remains active or as needed to provide the Service.

10.2 Cancelled Accounts

After subscription cancellation, customer data is retained for up to 90 days, unless:

A longer period is required by law
The customer requests deletion earlier where legally permitted
Data is needed for dispute resolution, fraud prevention, or legal compliance

After the retention period, data may be deleted, anonymized, or irreversibly de-identified.

10.3 Backups

Deleted data may remain in encrypted backups for a limited period until backup rotation completes. Backup data is not actively used except for disaster recovery, security, or legal compliance.

11. Data Security

We use reasonable technical and organizational measures designed to protect personal data, including:

Encryption of sensitive information
Password protection and hashing
Role-based access controls
Optional two-factor authentication via app and SMS
Access logging
Security monitoring
Restricted employee access
Vendor security controls

However, no system is completely secure. We cannot guarantee absolute protection against unauthorized access, loss, misuse, or disclosure.

12. Data Breach Notification

If we become aware of a security incident involving personal data, we will:

Investigate the incident
Take reasonable steps to mitigate harm
Notify affected customers or users where legally required
Support business customers with information reasonably needed for their own notification obligations

Where Octabiz acts as a processor, breach notification obligations are governed by the applicable DPA.

13. Data Subject Rights

Depending on your location, you may have rights to:

Access your personal data
Correct inaccurate data
Delete personal data
Restrict processing
Object to processing
Request data portability
Withdraw consent
Lodge a complaint with a supervisory authority

Requests may be sent to: support@octabiz.ai

We may verify your identity before fulfilling requests.

Where we process data as a processor on behalf of a customer, we may refer the request to the relevant customer unless otherwise required by law.

14. Business Customer Responsibilities

Business customers using Octabiz are responsible for:

Providing legally required notices to their own customers, employees, vendors, and contacts
Obtaining consent where required
Ensuring uploaded data is lawful, accurate, and necessary
Responding to data subject requests where they act as controller
Configuring roles and permissions properly
Exporting data before cancellation or deletion deadlines

Octabiz is not responsible for unlawful or unauthorized data uploaded by customers.

Using Octabiz is also governed by our Terms of Service. Section 8 of the Terms (Non-Competition and Protection of Our Methods) is a condition of use. While a customer uses Octabiz, and for 10 years after it stops, it may not build or help build software that competes with Octabiz, and it may not copy or reuse our features, workflows, business rules, documentation, or prompts.

15. Financial, Accounting, and Regulated Data

Octabiz may process financial and accounting data as part of ERP functionality.

Octabiz does not provide:

Legal advice
Tax advice
Accounting advice
Financial advisory services
Audit services

Users are solely responsible for verifying financial outputs and complying with applicable tax, accounting, and regulatory obligations.

16. Children’s Privacy

Octabiz is not intended for individuals under 18 years old.

We do not knowingly collect personal data from individuals under 18. If we become aware that such data has been collected, we may delete it.

17. Marketing Communications

We may send service-related messages, such as:

Security alerts
Billing notices
Product updates
Administrative messages

These are not optional where required for service operation.

We may send marketing communications where permitted by law. Users may unsubscribe from marketing emails at any time.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we will provide reasonable notice, such as by:

Posting an updated version on our website
Sending an email notice
Displaying an in-app notification

Continued use of Octabiz after the effective date means you accept the updated Privacy Policy.

20. Phone Numbers & SMS Messaging

This section explains how Octabiz collects, uses, shares, and retains phone numbers and data related to SMS (text) messaging. It supplements the broader data practices described elsewhere in this Privacy Policy.

SMS Communications — At a glance

✔We collect phone numbers to send SMS messages requested by the user.
✔Message frequency varies.
✔Message and data rates may apply.
✔Reply STOP to opt out.
✔Reply HELP for assistance.
✔Users may opt out at any time.
✔Mobile opt-in data and consent will not be shared, sold, rented, or disclosed to third parties or affiliates for marketing or promotional purposes.
✔Phone numbers are only used to provide requested services and transactional communications.
✔No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
✔Separate consent is collected for Transactional SMS (appointments, orders, account notifications) and Marketing SMS (offers, discounts, promotions). Each is optional and unchecked by default.

20.1 Data We Collect

Mobile phone number provided by you or by an authorized administrator of your organization
Opt-in source, timestamp, and consent record
SMS delivery metadata (timestamp, status, carrier responses, message identifiers, error codes)
Outbound message content for transactional messages sent on your behalf or to you
Inbound replies you send to our SMS numbers, including STOP, HELP, and free-text support replies

20.2 Why We Process This Data

We process phone numbers and SMS data only to:

Send opted-in transactional and informational SMS messages, including support replies, booking and order updates, delivery notifications, and verification or login codes
Send marketing SMS (offers, discounts, promotions) only where you have provided a separate, explicit marketing opt-in
Honor opt-out, HELP, and support requests received by SMS
Maintain audit and consent logs for compliance, abuse prevention, and troubleshooting
Diagnose delivery problems and prevent fraud, spam, or messaging abuse
Comply with applicable laws, carrier requirements, and messaging industry rules (including TCPA, CTIA, and 10DLC requirements where applicable)

20.3 Sharing

We share phone numbers and SMS metadata or message content only as needed to deliver messages and operate the service:

With our SMS delivery provider, Twilio, which transmits messages on our behalf
With mobile carriers responsible for delivering the message to the recipient handset
With service providers that host or secure our infrastructure, under confidentiality and security obligations
Where required to comply with legal obligations, lawful requests, or to protect rights, safety, or property

No third-party marketing. We do not sell phone numbers, and we do not share mobile information or SMS opt-in data with third parties or affiliates for their own marketing or promotional purposes. Mobile opt-in data and consent are not shared with third parties for any purpose other than message delivery and the operational purposes listed above.

20.4 Retention

Phone numbers and SMS records are retained only as long as reasonably necessary to:

Provide the service and continue messaging where you remain opted in
Troubleshoot delivery issues
Maintain consent and opt-out records as required by law
Comply with legal, tax, or regulatory obligations

After this period, SMS records are deleted, anonymized, or aggregated. Opt-out (STOP) records may be retained indefinitely to ensure we continue to honor your opt-out.

20.5 Opt-Out and Help

You can stop receiving SMS messages at any time by replying STOP to any message. Reply HELP for help, or contact support@octabiz.ai. Message and data rates may apply. Message frequency varies. See the SMS Messaging Terms in our Terms of Service.

21. Contact

For privacy questions, requests, or complaints:

Octasys LLC

Louisville, Kentucky, USA

Email: support@octabiz.ai

22. Data Protection Contact

For GDPR, UK GDPR, or data protection inquiries:

Email: support@octabiz.ai

23. Google API Services User Data Policy (Limited Use)

Octabiz’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

23.1 Scopes We Request

When you connect a Google account to Octabiz, we may request one or more of the following OAuth scopes, only as needed for the feature you enable:

openid, userinfo.email, userinfo.profile — sign in and identify your Google account.
drive.file — create and manage only the files Octabiz creates or that you explicitly open with Octabiz in Google Drive.
drive.readonly — read files you select to import into Octabiz.
spreadsheets / spreadsheets.readonly — read from or write to Google Sheets you connect for imports, exports, or reporting.
gmail.send — send transactional messages (such as invoices, estimates, or receipts) from your Gmail address at your request.
gmail.readonly — read messages you explicitly select for import or reconciliation.
analytics.readonly, webmasters.readonly — read Google Analytics and Search Console metrics to display in your Octabiz dashboards.

23.2 How We Use Google User Data

Data received from Google APIs is used solely to:

Provide and improve user-facing features that you have explicitly enabled (for example, importing a spreadsheet, sending an invoice by Gmail, or displaying analytics).
Comply with applicable law.
Investigate abuse or a security incident, where limited human review is necessary.

23.3 What We Do Not Do

We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
We do not sell Google user data.
We do not use Google user data, or data derived from it, to develop, improve, or train generalized or non-personalized AI and/or machine learning models. Any AI feature that operates on your Google data runs only on your explicit request and only to produce output for you.
We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

23.4 Revoking Access

You can disconnect Octabiz from your Google account at any time from Octabiz’s Integrations settings, or by visiting Google Account → Security → Third-party apps with account access. Once access is revoked, we stop accessing new data from your Google account and delete cached Google user data on the schedule described in Section 10 (Data Retention).