What we collect, how we use it, and how we protect it.

Effective April 1, 2026Updated May 22, 2026

This is the long version, in plain language. The short version: encrypted storage, never sold, never used to train AI, deleted when you disconnect. Orevlo can draft and send email and manage your calendar — but only ever when you ask it to, and it never sends or changes anything on its own.

Information we collect

Account information

When you create an account, we collect your name, email address, and password (or authentication credentials via a third-party provider). If you subscribe to a paid plan, we collect billing information through our payment processor — we do not store credit card numbers directly.

Email data (Gmail and Microsoft Outlook / Microsoft 365)

With your explicit authorization via OAuth, we access your business email account(s) to provide email intelligence features. This includes:

• Email metadata: sender, recipient, subject line, date, read/reply status, and attachment file names (we do not access attachment file content unless you opt into a feature that requires it)
• Email body content, which is processed by our AI providers (Anthropic; see Data sharing below) to generate insights and stored in our database (encrypted at rest) for up to 400 days. After 400 days, raw email body content is automatically deleted by a nightly retention sweep. Generated insights derived from your email may persist beyond 400 days unless you delete your account.

Orevlo also lets you compose and send email on your behalf, and organize mail (label, archive, mark as read, move to trash — never permanent deletion). To enable this we request the Google gmail.modify scope and the Microsoft Mail.ReadWrite and Mail.Send permissions. We deliberately do not request the ability to permanently delete your email. Orevlo never sends an email unless you have authorized it — either by reviewing and approving that specific message, or by setting up a standing rule (for example, "when a customer emails asking about pricing, reply with this"), reviewing the exact message and trigger, and confirming it. Every message Orevlo sends is recorded in your account. If you only want the intelligence and briefing features, you can connect your inbox and simply never use the send capability — it does nothing until you ask.

For team and business accounts, an administrator may authorize access to multiple inboxes within a Google Workspace or Microsoft 365 organization. Connected employees should be informed by their administrator that their business inbox is connected to Orevlo.

Calendar data (Google Calendar and Microsoft 365 calendar)

When you connect Gmail or Outlook, you also grant Orevlo access to your calendar so it can see your schedule and create, reschedule, or cancel events when you ask. To enable this we request the Google calendar scope and the Microsoft Calendars.ReadWrite permission. Orevlo reads calendar events to answer questions like "am I free Thursday" and writes to your calendar only to carry out a request you have made. As with email, Orevlo never creates or changes a calendar event on its own — only in response to something you asked it to do.

Reminders you set

You can ask Orevlo to remind you about something, or to follow up if a reply hasn't arrived. We store the reminder text, the time it should fire, and (for a follow-up reminder) a reference to the email thread being watched, so the reminder can be delivered to you.

Financial data (via Plaid)

If you choose to connect bank accounts or credit cards, we use Plaid, Inc. to securely access your financial data. Through Plaid, we receive:

• Account balances and transaction history
• Transaction descriptions, amounts, dates, and merchant categories
• Account identifiers (account name, type, institution)

We do not receive or store your bank login credentials. Plaid handles authentication directly.

Accounting data (QuickBooks Online and Xero)

If you choose to connect your accounting software, we access data via OAuth API including:

• Invoices, accounts receivable, and accounts payable
• Revenue and expense records
• Customer and vendor records
• Profit and loss summaries

Phone and voicemail data

When you connect phone forwarding, Orevlo:

• Provisions a dedicated phone number from our telecommunications provider (Twilio, Inc.) for you to forward missed calls to
• Receives an audio recording when a caller leaves a voicemail on that number
• Transcribes the audio using a third-party AI speech-to-text service (OpenAI Whisper)
• Analyzes the transcript using Anthropic's Claude AI to classify the voicemail and extract relevant details (caller name, requested service, dollar amounts, deadlines)
• Stores the recording, transcript, classification, and caller's phone number in our secure database
• Links callers to contact records using their phone number, joining phone signals with email and financial data for cross-source insights
• Uses aggregate, anonymized patterns (e.g., "X% of missed calls in industry Y are new leads") to improve the service for all users — never identifying any individual caller, business, or call content
• Retains voicemails and transcripts while your account is active; deletes them within 30 days of account cancellation

You can disconnect phone forwarding at any time in Settings → Connected Accounts, which releases the provisioned number and stops further data collection.

Callers leaving voicemails should understand that the voicemail is being recorded (as is standard for any voicemail system) and that the contents will be transcribed for your business use.

Usage data

We collect information about how you interact with the Service, including pages viewed, features used, actions taken, and device and browser information. This data is used to improve the Service.

Marketing site analytics

The Orevlo marketing site (orevlo.com) uses Cloudflare Web Analytics, a privacy-first analytics tool that does not set cookies, does not use device fingerprinting, and does not follow you across other websites. It collects aggregated metrics — page views, country, browser, referrer — to help us understand which content reaches people. No identifiers about you personally are stored. This is why you don't see a cookie consent banner on our marketing site: there are no tracking cookies to consent to.

How we use your information

We use the information we collect to:

• Provide the core Service: analyze your email and financial data to generate business insights, briefings, and reports
• Deliver daily and weekly briefing emails summarizing items that need your attention
• Power the "Ask Anything" chat feature that answers questions about your business data
• Draft and — only when you authorize it — send email on your behalf, organize your inbox, manage your calendar, and deliver reminders you have set
• Generate the First Scan / Business Health Report upon account setup
• Provide multi-inbox team summaries for authorized business accounts
• Improve AI accuracy through aggregated, anonymized usage patterns
• Send service-related communications (briefings, alerts, account notices)
• Detect and prevent fraud, abuse, and security incidents

Google API Services User Data Policy

Orevlo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use access to Google user data to provide and improve the Service's email intelligence, sending, and calendar features as described in this policy
• We use the gmail.modify scope to read your email, organize it (label, archive, mark read, move to trash), and — only when you ask — send email on your behalf. We use the calendar scope to read your calendar and, only when you ask, create, reschedule, or cancel events. We do not request the ability to permanently delete email.
• We do not use Google user data for advertising purposes
• We do not use Google user data to train, or improve, generalized AI or machine-learning models
• We do not allow humans to read your email content unless: (a) you provide affirmative consent for a specific message, (b) it is necessary for security purposes such as investigating a bug or abuse, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized and is used for internal operations
• We do not transfer Google user data to third parties except as necessary to provide or improve the Service, as required by law, or as part of a merger/acquisition with adequate data protection commitments

How we store and protect your data

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• OAuth tokens are stored encrypted and are never exposed in logs or to unauthorized personnel
• We do not store raw email or bank login credentials — access is maintained via revocable OAuth tokens
• Access to user data within our organization is restricted to personnel who need it to operate the Service
• We maintain audit logs of all data access
• Our infrastructure is hosted on secure, reputable cloud providers

Data residency and international transfers

Application servers and the primary database are hosted in the United States. Subprocessors listed below process data in the United States. Google and Microsoft OAuth-accessed data (Gmail, Outlook) remains in your existing Google or Microsoft account region; Orevlo retrieves only the subset needed to deliver the Service and stores it alongside the rest of your account data in the United States.

For EU and UK customers, transfers of personal data to the United States rely on the European Commission's Standard Contractual Clauses (2021/914) and, for UK transfers, the UK International Data Transfer Addendum, together with the supplementary safeguards described in this section. EU and UK customers may request a countersigned Data Processing Agreement incorporating these clauses by writing to hello@orevlo.com.

Data sharing and disclosure

We do not sell your personal information or business data. We share data only in the following circumstances:

• Service providers. We use third-party services to operate the platform (cloud hosting, email delivery, payment processing, AI processing). These providers are contractually bound to use your data only to provide their services to us.
• AI processing. Email, financial, and voicemail data is processed by AI language models (currently provided by Anthropic) to generate insights. Data sent to AI providers is used solely for generating your results and is not used to train their models.
• Aggregated and anonymized data. We may use aggregated, de-identified data that cannot reasonably be used to identify you or your business for analytics, benchmarking features, and service improvement.
• Legal requirements. We may disclose data if required by law, subpoena, court order, or government request.
• Business transfers. In the event of a merger, acquisition, or sale of assets, user data may be transferred with adequate privacy protections.

Key subprocessors

The following third-party service providers may process your data as part of delivering the Service:

Multi-inbox privacy

When a business administrator connects employee inboxes through Google Workspace or Microsoft 365 admin authorization:

• Connected employees are notified that their business inbox is connected to Orevlo
• Administrators see summaries, flagged items, and response metrics — not full email content of employee inboxes
• Orevlo is a business operations tool, not an employee surveillance tool

Data retention and deletion

• We retain your data for as long as your account is active and as needed to provide the Service
• When you disconnect an integration (email, bank, accounting, or phone), we stop accessing new data from that source. Previously processed insights are retained unless you request deletion.
• When you delete your account, we delete or anonymize all personal data and business data within 30 days, except where retention is required by law
• Voicemail recordings and transcripts are deleted within 30 days of account cancellation
• You may request data deletion at any time by contacting us at privacy@orevlo.com

Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Revoke access to connected accounts at any time by disconnecting integrations in your account settings or revoking OAuth access directly through Google, Microsoft, Plaid, QuickBooks, Xero, or by releasing your phone number in Settings
• Opt out of non-essential communications

To exercise these rights, contact us at privacy@orevlo.com.

Contact

Orevlo LLC
privacy@orevlo.com
orevlo.com