Privacy, handled the way we handle everything.
We built ORACA AIfor regulated, high-stakes work — so your data is treated as evidence: documented, secured, and never sold. Here's exactly what we collect, why, and the control you keep over it.
Encrypted end to end
Data is encrypted in transit and at rest. Access is logged and least-privilege.
Never sold
We don't sell or rent your data. Ever. No ad networks, no data brokers.
Consent-first
We only contact you with your consent — and you can withdraw it anytime.
AI, disclosed
When you talk to an AI agent, we tell you — and explain how it uses your input.
Who we are & what this covers
ORACA AI — represented by Nael, ORACA AI provides AI-assisted services through this website and chat interface. This policy explains how we handle personal information across this website, our booking tools, and the AI agent we operate.
When you message our agent, book a call, or submit a form, we collect only what's needed to help you — and we protect it the way the regulated industries we serve demand.
When ORACA AI operates an AI agent, your data is handled under this policy. We act as the data controller for the information you provide — we determine how it is used and are responsible for protecting it.
Information we collect
We collect only what each interaction requires. We don't buy personal data or build hidden profiles.
| Category | Examples |
|---|---|
| You give us | Name, email address, phone number, and anything you type into the chat, booking form, or inquiry form. |
| Conversation data | Messages exchanged with our AI agent, the goal or topic you shared, and the outcome (booked, redirected, etc.). |
| Collected automatically | Browser type, approximate region, and session identifiers needed to run and secure the service. |
We do not intentionally collect health records, payment card numbers, or government ID through this service. However, our AI chat accepts free-text input — if you type sensitive information, it is received and stored as conversation content.
How we use your information
- To respond to your enquiry and connect you with Nael.
- To send booking confirmations, reminders, and — with your consent — follow-up communications about your request.
- To operate, secure, and improve our AI-assisted services.
- To meet our legal and regulatory record-keeping obligations.
We do not use your conversations to train third-party public AI models, and we do not sell your information.
AI & automated processing
Our chat interface is powered by an AI assistant. We tell you when you're talking to one.
- Disclosure: the AI agent identifies itself before you share details. The widget displays a clear “AI assistant” label at all times.
- Scoring: enquiries may be assessed by an AI model to help prioritize follow-up. This supports — it does not replace — professional judgement.
- Human review: conversations may be reviewed by our team to ensure quality and accuracy.
You can ask to speak with a human at any time. You can also request that a significant decision not be made by automated means alone.
Consent & how we contact you
We rely on two consent bases under CASL, and we treat them differently:
| Basis | What it means & how long it lasts |
|---|---|
| Implied consent | When you message our agent or submit an enquiry, that's implied consent to reply and follow up about it. Under CASL this lasts 6 months — after that, enquiry-based contacts are automatically excluded from outreach unless you've expressly opted in. |
| Express consent | When you explicitly opt in (for example, by ticking a consent checkbox), we may contact you about relevant services until you withdraw it. No 6-month expiry. |
- Every commercial message includes our name, contact information, and an easy unsubscribe mechanism.
- Reply STOP to any email to be permanently removed from future messages.
- Withdrawing consent doesn't affect messages strictly needed to complete something you asked for, like a booking confirmation.
If you reach out and then go quiet, our system stops contacting you after 6 months on its own — that's CASL, enforced in code, not left to memory.
How we protect your information
Security isn't a feature here — it's the premise. We apply the safeguards our regulated clients require:
- Encryption in transit and at rest — all data moves over TLS; data stored in our database is encrypted at rest (AES-256).
- Least-privilege, logged access — every touch of your data is attributable. Our database enforces access controls at the row level.
- Append-only audit trail — every material action (capture, AI processing, email send, deletion) is logged and retained for accountability.
- Secret management — API keys and credentials are stored in encrypted environment vaults, never in source code or version control.
- Ongoing monitoring — we have defined processes for detecting and handling security incidents.
No system is perfectly secure, but we design, document, and audit ours so issues are containable and traceable.
How long we keep it
We keep personal information only as long as needed for its purpose, to meet legal obligations, and to resolve disputes — then we delete or anonymize it. Retention is tiered and enforced automatically:
| Record type | Retention period |
|---|---|
| Leads with contact info & appointments | 6 years |
| Anonymous chat sessions (no email collected) | 6 months — data minimization: no ongoing relationship basis |
| Conversation logs | 6 months |
| Compliance & audit log | Extended — retained to preserve a defensible chain-of-custody record |
| Unsubscribe records | Permanent — CASL requires suppression lists to be kept indefinitely |
You can ask us about any specific record at any time using the request form in §09.
Who we share it with
We share personal information only as needed to run the service. Our sub-processors are bound by contract to process data only on our behalf:
| Sub-processor | Purpose & data involved |
|---|---|
| Hosting & database (Vercel, Supabase) | Running the application and storing lead, conversation, and appointment records securely. Data resides on US-based servers. |
| AI model provider (OpenAI) | Generating agent responses. The full text of your chat messages is sent to OpenAI's API to produce replies. |
| Email delivery (Gmail) | Booking confirmations, reminders, and consented follow-up emails. Includes your name, email, and appointment details. |
| Calendar & scheduling (Google) | Creating calendar events and meeting links when you book. Includes your name, email, and appointment goal. |
| Internal notifications (Slack) | Notifying our team of new enquiries. Includes your name, email, and a summary of your message. |
All sub-processors listed above are based in the United States. When your information is processed outside Canada, it may be subject to the laws of that jurisdiction, which may differ from Canadian privacy law. By using our services, you acknowledge this cross-border transfer.
We never sell or rent personal information, and we don't share it with advertising networks or data brokers. We may share with legal or safety authorities when required by law.
How we handle Google user data
This section applies if you engage ORACA AI as a client and connect a Google account so we can schedule on your behalf. Data we obtain from Google APIs (“Google user data”) is handled under the rules below, in addition to everything else in this policy. Connecting Google is optional — we also offer a service-account calendar-sharing path that requires no Google sign-in.
What we access
Two permissions, requested at the moment you connect and never before:
| Permission | What we do with it |
|---|---|
auth/calendar | Read busy/free times on the calendar you connect, and create, update, or cancel the appointments your agent books. |
auth/meetings.space.readonly | Read the settings of the Google Meet space attached to those events, so the video link we send your client actually works. |
We request no Gmail permission of any kind, no Drive or Docs access, no Contacts access, and no Google Workspace admin or directory access. We cannot read your email.
How we use it
Only to operate the scheduling features you authorized: checking availability before a time is offered, booking it, and issuing reschedules or cancellations. We do not use Google user data for any other product, feature, or purpose.
How we store it
- Your Google authorization tokens are encrypted at rest, stored per-client with row-level access controls, and held server-side only — never exposed to browser code, written to logs, or committed to version control.
- Busy/free times are read from Google at the moment we calculate availability and are used to produce that answer. We do not build or keep a copy of your calendar.
- What we retain is the appointment record itself — the booking your agent made, under the retention schedule in §07.
How we share it
- Google user data is transferred only to the sub-processors needed to run the authorized feature (§08), under contract and only for that purpose.
- We never sell or rent it, and never transfer it to advertising platforms, data brokers, or for targeted advertising.
- We never use it for credit assessment, lending decisions, or any similar purpose.
- We never use or transfer Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models — not by us, and not by any provider we use.
Who can read it
ORACA AI personnel do not read Google user data except:
- with your explicit, specific agreement, to resolve an issue you raised;
- where necessary for security investigations or abuse prevention;
- where required by law; or
- where the data has been aggregated and anonymized for internal operational metrics.
Limited Use
ORACA AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Withdrawing access
You can revoke ORACA AI's access at any time at myaccount.google.com/permissions, or by emailing us. On revocation we stop calling Google APIs on your behalf immediately and delete your stored tokens within 30 days; scheduling stops working, and calendar events already created stay on your calendar untouched. On termination we revoke and delete them within 30 days without you having to ask.
Your rights & choices
Under PIPEDA, you have the right to:
- Access — request a copy of the personal information we hold about you. We will respond within 30 days (PIPEDA s.8(3)).
- Correction — request that inaccurate or incomplete information be corrected (PIPEDA s.12).
- Deletion — request that your personal information be deleted from our active systems. We will honour requests except where law requires retention.
- Withdrawal of consent — withdraw consent to our use of your personal information at any time, which may limit our ability to serve you.
- Unsubscribe — reply STOP to any commercial email to be permanently removed from our contact list.
We'll verify your identity before disclosing records, and respond within 30 days. You may also raise a concern directly with the Office of the Privacy Commissioner of Canada.
Talk to us about your privacy
Questions, requests, or concerns about this policy or your data — reach our Privacy Officer directly.