Privacy Policy
How OASIS AI Solutions collects, uses, shares, and retains personal information — including what is sent to third-party AI providers.
Effective October 27, 2026
Notice: This application uses artificial intelligence (AI), automated algorithms, and large language models (LLMs) to process data, generate content, and execute workflows. AI output can be inaccurate and is not professional, legal, financial, or medical advice.
Last updated October 27, 2026
A French version of this policy is in preparation. Une version française de la présente politique est en préparation.
1.Who we are
OASIS AI Solutions (“we”, “us”) operates the OASIS Agent Command Center at oasisai.work. Our principal place of business is Collingwood, Ontario, Canada. For privacy questions, or to exercise any right described below, contact our person in charge of the protection of personal information (section 2) at support@oasisai.work.
The Command Center is a multi-tenant product. Where you submit information through a form published by one of our customers (a “tenant”), that tenant is the controller of your information and we process it on their behalf as a service provider.
2.Person in charge of the protection of personal information
Under Quebec’s Act respecting the protection of personal information in the private sector (Law 25), OASIS AI Solutions has designated a person in charge of the protection of personal information. That person is responsible for ensuring we comply with the Act, and handles requests to access, correct, or delete personal information and complaints about how we handle it.
Conaugh McKenna
Person in charge of the protection of personal information (Responsable de la protection des renseignements personnels)
OASIS AI Solutions, Collingwood, Ontario, Canada
support@oasisai.work
If you are not satisfied with our response, you may file a complaint with the Commission d’accès à l’information du Québec.
3.AI data processing and machine learning
This product is built on artificial intelligence. Automated systems and large language models read, classify, summarise, and act on the data you submit. You should assume that content you enter into an agent chat, and the contents of any document you upload for extraction, are transmitted to a third-party model provider for processing.
What is sent to model providers
- Messages and instructions you type into any agent or chat surface.
- Lead and application records when they are included in the context of an agent task (for example, drafting a reply about a specific deal).
- The full contents of documents you upload for automated field extraction — which for funding applications routinely includes government identifiers such as Social Security Numbers, dates of birth, and employer identification numbers.
Which providers
Depending on the task and how a workspace is configured, content may be sent to Anthropic PBC (Claude), OpenAI, L.L.C. (GPT), Google LLC (Gemini), or OpenRouter, which forwards a request to the provider hosting the model the workspace selects. These providers are based in the United States. The full subprocessor list, and what each one receives, is in section 6.
Automated decision-making
Agents in this product can classify inbound messages, score and route leads, and draft outbound communications without a human reviewing each step. These are operational decisions about workflow — they do not by themselves determine eligibility for credit, employment, housing, or insurance. Transactional messages such as submission confirmations and welcome emails are sent automatically. A human operator reviews and approves any other communication sent on a tenant’s behalf and any financial action.
If you are in Quebec, you have the right under Law 25 to be informed when a decision about you is based exclusively on automated processing, and to submit observations to a human. Write to support@oasisai.work to exercise that right.
Training
We do not train our own models on your data. We do not sell your data. Model providers operate under their own terms; where a provider’s consumer-tier terms permit training on submitted content, we treat that as a limitation to be closed rather than a permission we rely on, and we disclose the current state honestly in section 6.
4.Privacy data matrix
The table below lists every category of personal information the Command Center collects, why, and who receives it. Rows marked Sensitive are treated as sensitive personal information under Quebec Law 25 and the California Privacy Rights Act.
| Category | Fields | Purpose | Shared with | Retention |
|---|---|---|---|---|
| Contact identifiers | first_name, last_name, email, phone | Account creation, service delivery, and operator communication | Turso (storage); the workspace's model provider when included in agent context; Google (email and calendar invitations); Twilio and Quo (SMS); Telegram (staff alerts) | Life of the account, then 24 months |
| Business identifiers | company, address, city, state, zip, revenue | Qualifying and routing an application to the correct workflow | Turso (storage); the workspace's model provider when included in agent context; and the tenant whose form was submitted | Life of the account, then 24 months |
| Government and financial identifiersSensitive | ssn, dob, ein, tax_id | Completing a funding application on behalf of the submitting business | Turso (storage), and Anthropic when present in an uploaded document submitted for extraction | Retained only as long as the application is active, then deleted on request |
| Uploaded documentsSensitive | Bank statements, signed applications, and other files submitted through the form dropzone | Automated field extraction and application assembly | Cloudflare R2 (storage), Anthropic (extraction) | Deleted on request; otherwise retained with the application |
| Usage and diagnostic data | IP address, request paths, timestamps, error logs | Security, abuse prevention, and debugging | Cloudflare (hosting logs) | Up to 30 days (platform logs). Request logs from before September 2026 remain with our former hosting provider until that account is closed (section 6). |
| Website ad measurement (only if you allow ad cookies) | pages visited, ad click identifier (gclid), IP address, browser and device details, the _gcl_au cookie | Measuring which of our Google ads bring visitors and purchases | Google (Google Ads), and only after you press Allow on the ad-cookie banner | The _gcl_au cookie expires after 90 days in your browser. Google keeps Google Ads data under its own retention policy. You can withdraw at any time with Ad cookie choices in the site footer. |
A machine-readable copy of this matrix is kept in the product repository at docs/compliance/PRIVACY_NUTRITION_LABEL.json and is the source used for app-store privacy declarations.
5.Analytics and tracking
The signed-in Command Center and the desktop app do not load third-party analytics SDKs, advertising pixels, or cross-site trackers. There is no Google Analytics, Meta Pixel, PostHog, or similar analytics tag anywhere in this application.
Our public website (the pages you can read without signing in) can use one advertising tag: Google Ads, which tells us which of our ads brought a visitor and whether they went on to buy. It is off by default. Nothing is requested from Google until you press Allow on the ad-cookie banner. If you allow it, Google receives the pages you visit on our site, the ad click identifier, your IP address, and browser and device details, and sets cookies including _gcl_au on our site and its own cookies on Google's domains. If you choose No thanks, or never answer, nothing loads.
You can change your choice at any time with Ad cookie choices in the site footer. Withdrawing stops the tag on that page and deletes the _gcl_* cookies it set on our domain; cookies Google set on its own domains can only be cleared from your browser or your Google account settings.
Apart from that, we use strictly necessary cookies for authentication and session state, and our hosting provider records standard server logs (IP address, request path, timestamp, user agent) for security and debugging. If we add an analytics or advertising provider in future, this section and the data matrix above will be updated in the same release.
6.Subprocessors
We share personal information with the following processors. Each entry states whether a data processing agreement is currently in place for that specific data path.
| Processor | Role | Data received | Region | DPA |
|---|---|---|---|---|
| Turso | Primary database (libSQL) | All account data, lead and application records, messages, and the audit log | United States | Under review |
| Cloudflare, Inc. | Application hosting (Workers), file storage (R2), and edge delivery | Every request to the application, including IP address and request logs, and uploaded documents and attachments | Global edge network | In place |
| Anthropic PBCSome automated tasks run through Anthropic's Claude Code tool on an OASIS subscription account rather than under a commercial API agreement. Subscription terms differ materially from Anthropic's Commercial Terms and data processing addendum. | Large language model inference (Claude) | Chat messages, agent prompts, lead context used to draft or classify messages, and the contents of uploaded application documents submitted for field extraction | United States | Under review |
| OpenAI, L.L.C. | Large language model inference (GPT), when a workspace or agent is configured to use it | Chat messages and agent prompts sent to that model | United States | Under review |
| OpenRouter | Model routing, when a workspace is configured to use it | Chat messages and agent prompts, forwarded to the model provider the workspace selects | United States; forwarded to the host of the selected model | Under review |
| Google LLC | Google Workspace APIs (Gmail sending and inbox monitoring, Calendar events), Gemini model inference when a workspace selects it, and Google Ads measurement on our public website for visitors who allow ad cookies | Outbound email content and recipient addresses, connected inbox messages, meeting details and attendee addresses, and prompts sent to Gemini. From website visitors who allow ad cookies only: pages visited, the ad click identifier, IP address, and browser and device details | United States | Under review |
| Stripe | Payments and billing | Customer name, email address, and payment details. Card numbers are entered directly with Stripe and never reach our servers. | United States | In place |
| Twilio Inc. | SMS messaging | Recipient phone numbers and message content (for example, meeting reminders and replies) | United States | In place |
| QuoQuo was formerly called OpenPhone. No data processing agreement with Quo is confirmed yet. | SMS messaging | Recipient phone numbers and message content. Quo also holds the replies recipients send to the Quo number. | United States | Under review |
| TelegramNo data processing agreement currently covers these alerts. | Operational alerts to staff | Contact details (name, email address, phone number) and form answers included in new-lead, booking, and support alerts | Global | Under review |
Former database provider. Records created before we moved our database to Turso in August 2026 also remain in a legacy database hosted by Supabase, Inc. in the United States. The application no longer uses that database, and we plan to delete it.
Former hosting provider. Until September 2026 the application was served by Vercel, Inc. in the United States. That deployment no longer receives traffic, but request logs and build artifacts from that period remain with Vercel under its own retention until we close the account.
7.International transfers
We are based in Collingwood, Ontario, Canada. Our database and most of our processors are located in the United States, and our application runs on Cloudflare’s global network; section 6 lists each processor’s region. Your information is therefore transferred outside your province, and in most cases outside Canada.
For people in Quebec: before personal information is communicated outside Quebec, Law 25 requires a privacy impact assessment that takes into account the sensitivity of the information, the purposes for which it will be used, the protection measures (including contractual ones) that would apply to it, and the legal framework of the destination, and it permits the transfer only if that assessment establishes adequate protection. We have not yet completed that assessment for any of the processors in section 6. The assessments are in progress. The transfers described above are already taking place, so this is an open gap in our compliance, not a completed step.
What is in place today is the processor list in section 6, which states where each processor is located and whether a data processing agreement covers that data path. For the processors marked “Under review”, we have not confirmed one.
8.Your rights
Subject to your jurisdiction, you may request access to the personal information we hold about you, correction of inaccurate information, deletion, portability, withdrawal of consent, and — in Quebec — the de-indexing of information in certain circumstances. California residents may additionally opt out of any sale or sharing of personal information; we do not sell or share personal information as those terms are defined by the CPRA.
Send requests to our person in charge of the protection of personal information at support@oasisai.work. We respond within 30 days. We will not discriminate against you for exercising a privacy right.
9.Security and breach notification
Data is encrypted in transit between your browser, our application, and our processors. Credentials you connect to the service — AI provider API keys, email account passwords, and OAuth tokens — are encrypted by our application with AES-256-GCM before they are stored. Uploaded documents are kept in private Cloudflare R2 storage, which encrypts stored objects, and are served only through short-lived signed links. Other database fields, including the categories marked Sensitive in section 4, are not separately encrypted by our application.
All customers’ workspaces share one database. Customer records are tagged with the workspace they belong to, and our application limits its queries to the workspace of the signed-in user. This separation is enforced by our application code; the database itself does not enforce per-customer access rules. OASIS staff who operate the service can access customer workspaces to provide support and keep the service running.
Changes to team membership and access, AI provider settings, automation controls, and e-signature events are recorded in a per-workspace audit log.
No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we will notify affected individuals and the Commission d’accès à l’information du Québec as required by Law 25, and any other regulator required by applicable law.
10.Children
The Command Center is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18.
11.Changes
We will post any change here and update the “last updated” date at the top of this policy. Material changes affecting how we share data with model providers will be communicated to account holders by email before taking effect.