Privacy Policy
This policy describes how the private, owner-operated ControlOS pilot accesses, uses, stores and protects Google user data.
Effective date: 21 September 2026
Data ControlOS accesses
- Google Calendar: calendars, events, recurrence, all-day status, updates and deletions needed to calculate availability. ControlOS may create, update and delete planning blocks only on its dedicated ControlOS calendar.
- Gmail: for an owner-connected pilot mailbox, read-only message and thread data needed to identify commitments, waiting items and task signals. ControlOS does not request permission to send email.
- Merchant Center: read-only account, product, processed-state, eligibility, availability, price, issue and bounded-report data for owner-approved client accounts. ControlOS does not create, update or delete Merchant data.
- Google Analytics: read-only property, data-stream and bounded event-reporting data used to verify an exact owner-approved measurement route. ControlOS does not change events, key events, attribution or property settings.
- Google Tag Manager: read-only account, container and live-version data used to verify exact owner-approved tags, triggers and consent dependencies. ControlOS does not create, update, delete or publish GTM data.
- Account identity: the Google account identity needed to confirm that the expected owner account authorized the connection.
How the data is used
Google user data is used only to provide owner-requested planning, reconciliation and reminder functions. Calendar source events are not modified. Merchant Center, Google Analytics and Google Tag Manager access is read-only and restricted to exact owner-approved client evidence checks. Gmail bodies are processed transiently; the system retains only the minimum derived planning records and provenance required for reconciliation, deduplication and audit.
Storage and security
OAuth refresh credentials and protected derived fields are encrypted at rest with independent production keys. Access is restricted to the owner-controlled Main environment. ControlOS does not sell Google user data, use it for advertising, or share it with data brokers. Google Calendar or Gmail content is not sent to paid OpenAI API services.
Retention and deletion
Derived records are retained only while needed for the private planning service and its audit trail. Source updates and deletions are reconciled. The owner may disconnect an account, revoke Google access, or delete associated connector data. Encrypted backups expire under the system's backup-retention policy.
Owner control
The owner can revoke ControlOS access at any time from Google Account security settings. Revocation stops future synchronization; ControlOS also supports server-side connector disablement and credential deletion.
Current safety boundaries
Employer-gated connectors, external email sending, Slack sending, external posting, campaign publishing and paid OpenAI API access are disabled. Gmail access, where activated, remains read-only.