Privacy Policy

Optivian · Last updated: October 28, 2026

I. Introduction

In the following, we provide information about the collection and processing of personal data in the context of the AI sales co-worker and platform and related cloud-based services provided by Optivian Solutions Oy ("Optivian", "we", "us").

Depending on the processing activity, Optivian acts either as a Processor or a Controller:

As a Processor (see Section II), we process your personal data on behalf of your employer (our Customer), who in this case is the Controller. Please contact your employer directly for any questions regarding such processing.

As a Controller (see Section III), we process personal data for our own business purposes, such as account administration, billing, support, marketing, and website operation.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children.

II. Optivian as a Processor

Our platform is provided to companies as an AI sales co-worker and platform. If the Service is made available to you by your employer, your employer is the Controller of your personal data and Optivian is the Processor. Optivian processes your personal data only under the documented instructions of your employer (an Article 28 Data Processing Agreement) and is not responsible for your employer’s independent privacy practices.

1. Types of personal data processed as a Processor

a) Profile data

Name, work email address, profile photo, login credentials.

Additional profile attributes may be added by you or your employer.

b) Customer data

CRM records from connected systems (Salesforce, HubSpot or Pipedrive), such as contacts, opportunities and deal stages.

Business communications related to sales (e.g. work emails, meeting notes).

c) Calendar and meeting data

If you choose to connect your Google Calendar or Microsoft Outlook account, we access calendar event data through our sub-processor Recall (Hyperdoc, Inc.) to identify and join meetings for recording purposes. Transcription is performed by our sub-processor AssemblyAI, Inc. This data includes:

Calendar event metadata (event titles, scheduled times, attendee lists, and meeting URLs).

Meeting recordings and transcripts.

Speaker identification and timeline data.

Where a meeting is recorded, the customer (Controller) is responsible for providing notice and a lawful basis to all participants, including those who are not users of the Service.

Meeting recordings are deleted from our recording sub-processor within 72 hours of processing.

d) Mailbox connection data

If your employer has enabled email drafts and you choose to connect your Gmail or Outlook mailbox, we store the email address of the connected account, the connection status, when it was connected and last used, and the tokens Google or Microsoft issue to us so that the Service can save drafts in your mailbox. We never send email and do not read your mailbox. See Section VI for details.

Tokens are stored encrypted in a dedicated secrets manager and are deleted as soon as you disconnect the mailbox.

e) Access and technical data

IP address, browser type, operating system, device identifiers, date and time of access, error logs, and usage metrics (for stability and security).

f) Metadata

Pseudonymised statistics about how the Service is used.

2. Use of AI and profiling as a Processor

The Service uses artificial intelligence models to analyse Customer Data and generate sales recommendations and insights.

Some of this processing may constitute profiling under the GDPR, as it can involve automated analysis of personal data to identify patterns, assess engagement, evaluate commercial relationships, or predict likely sales outcomes.

The AI outputs are advisory only and are designed to support human decision-making. Optivian does not use solely automated decision-making that produces legal effects or similarly significant effects on individuals. All business decisions remain the responsibility of human users acting on behalf of the Customer.

Data subjects have the right to object to profiling under GDPR Art. 21. If Optivian were ever to introduce fully automated decision-making with legal or significant effects, data subjects would also have the right to request human intervention, express their views, and contest the decision (Art. 22 GDPR).

AI providers: Optivian does not build, train or fine-tune its own AI models. Prompts are sent over encrypted connections to the following third-party model providers, each under business terms under which the provider does not use our data to train or improve its models: Google Cloud Vertex AI (Gemini models and Anthropic Claude models), Amazon Bedrock (Anthropic Claude models), the OpenAI API (language models and text embeddings, through OpenAI’s EU or US data residency endpoints matching your hosting region) and AssemblyAI (meeting transcription, EU servers). We use no AI gateways or model aggregators: every request goes directly to the provider named here.

No model training: Neither Optivian nor these providers use Customer Data, or any data received from Google or Microsoft, to create, train, fine-tune or improve machine-learning or AI models, whether personalised, generalised or foundational. Personalisation, such as matching how you write email, works by including your own examples in the prompt for your own request; it does not train a model.

Google and Microsoft data and AI: No data received through the Gmail or Outlook mailbox connection (Section VI) is ever sent to an AI model. The only data we receive through it is the account’s email address and a confirmation that a draft was created. Calendar event details (title, time, attendees) from a connected calendar may be included in prompts, for example to prepare for a meeting or to attribute speakers in a transcript, under the same no-training terms.

3. Storage duration as a Processor

Customer Data: Deleted within 90 days after contract termination, unless required longer for legal claims.

User Account Data: Deleted within 90 days after termination of the Customer’s contract.

Technical Logs: Deleted within 90 days.

Mailbox connection tokens: Deleted immediately when you disconnect the mailbox, and otherwise together with your User Account Data.

III. Optivian as a Controller

Optivian is the Controller for personal data processed for our own business purposes, including account management, billing, communications, support, marketing, and website operation.

1. Categories of data processed as a Controller

a) Account and contact data

Names, job titles, business email addresses, profile photos, Customer billing information.

b) Support and communication data

Data from support requests, administrative correspondence, or other communications with Optivian.

c) Website and marketing data

Cookies and analytics information (where applicable). For details of cookies used on our website, see our Cookie Notice.

Newsletter or product update subscription information.

2. Legal bases for processing as a Controller

Optivian processes personal data under the following GDPR legal bases (Art. 6):

Contract (Art. 6(1)(b)): To provide and administer the Service, manage user accounts, and fulfil agreements.

Legitimate Interest (Art. 6(1)(f)): To secure, improve and operate the Service, support Customers, and communicate relevant updates.

Legal Obligation (Art. 6(1)(c)): To comply with statutory obligations (e.g. tax, accounting).

Consent (Art. 6(1)(a)): For optional activities such as marketing or participation in product feedback programs. Consent can be withdrawn at any time.

3. Storage duration as a Controller

Account and billing data: Stored for the duration of the contractual relationship and thereafter as required by law.

Marketing data: Retained until you withdraw consent or opt out.

Support and communications data: Retained as long as necessary to resolve the issue and for legitimate record-keeping.

4. How we use your information

We use the information for a few key purposes:

To Provide and Improve the Service: We use technical and usage data to operate, maintain and improve the Service, including stability, performance and feature development.

For Security and Troubleshooting: We monitor our systems to prevent security incidents and fix bugs.

To Communicate With You: We use your contact information to send service updates and support messages.

To Create Anonymised Insights: We may anonymise and aggregate data to analyse usage trends and improve our product. This Anonymised Data cannot be used to identify any individual or company.

IV. International transfers and data residency

Optivian is based in Finland. By default, the Service is hosted in the European Union. For customers requiring US data residency, US-based hosting is available as an option, selected per customer at onboarding; customer data then resides in the selected US region.

Where personal data is processed by sub-processors with operations in third countries (such as the United States), appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and, where applicable, certification under the EU–U.S. Data Privacy Framework (DPF).

V. Sub-processors

To deliver the Service and operate our business, Optivian engages a small number of sub-processors. These include hosting and database providers, AI inference providers, meeting capture and transcription providers, error-tracking and analytics providers. All sub-processors are bound by written Data Processing Agreements.

The current list of sub-processors is set out in our Data Processing Agreement, available at optivian.ai/dpa.

VI. Google and Microsoft account connections

Some features work by connecting your Google Workspace or Microsoft 365 account to the Service. Every connection is optional, is made by you from the Service’s settings, and can be removed by you at any time. This section explains what we access through these connections, how we use, store and share that data, and how you revoke access. It applies in addition to Sections II and III.

1. Email drafts (Gmail and Outlook)

If your employer has enabled email drafts, you can connect your work mailbox so that Ollie, the AI sales co-worker, can save the emails it writes for you as drafts in your own Drafts folder.

What we request: For Gmail we request only the permission to create drafts (gmail.drafts.create), together with your basic account identity (openid and email) so that we can confirm that the connected account is the same work account you use in the Service. This permission does not let us read, change, delete or send any email, including the drafts we create. Microsoft offers no drafts-only permission, so for Outlook we request the Mail.ReadWrite permission and use it only to create drafts.

How we use it: We use the connection for one purpose: to place an email that you asked Ollie to write into the Drafts folder of your connected mailbox. We never send email on your behalf. You open, review, edit and send each draft yourself. We do not read your email, your existing drafts, your contacts or any other content of your mailbox.

What we store: The email address of the connected account, the connection status, when it was connected and last used, and the access and refresh tokens that Google or Microsoft issue to us. Tokens are stored encrypted in a dedicated secrets manager in the hosting region selected for your employer and are used only to create drafts. We do not keep a copy of the drafts we create. The text Ollie wrote remains part of your conversation history in the Service and is treated as Customer Data.

What we share: We do not share, sell or transfer data received from Google or Microsoft through these connections to any third party. We do not use it for advertising, and we do not use it to develop, train or improve any artificial intelligence or machine-learning model. It is processed only on the infrastructure of the hosting sub-processors listed in our DPA, and only to provide this feature. It is never sent to an AI model or AI provider (Section II.2) and is protected by the measures in Section VII.

Revoking access and retention: You can disconnect your mailbox at any time under Settings → Email in the Service. Disconnecting deletes the stored tokens immediately and, for Gmail, also revokes our access with Google. You can also remove Optivian’s access from your Google Account permissions page or, for Microsoft, from your Microsoft account’s app permissions (or your organisation’s administrator can do so). Drafts that are already in your mailbox stay where they are. Connections and their tokens are also deleted when your user account is removed or your employer’s contract ends (see Section II.3).

2. Calendar

If you connect your Google Calendar or Microsoft Outlook calendar, we access calendar event data through our sub-processor Recall to identify and join meetings for recording, as described in Section II.1 c). Calendar data is used for no other purpose, and you can disconnect your calendar at any time from the Service’s settings.

3. Google API Services User Data Policy

Optivian’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

VII. How we protect your data

We apply the following technical and organisational measures to all personal data we process, including data received from Google and Microsoft through connected accounts. They are set out in more detail in Annex 2 of our Data Processing Agreement.

Encryption in transit: All connections to the Service, to Google, Microsoft and CRM APIs, and to our sub-processors use TLS 1.2 or higher.

Encryption at rest: Databases, file storage and backups are encrypted at rest with industry-standard encryption (AES-256) on Google Cloud Platform.

Credential storage: OAuth access and refresh tokens for connected Google and Microsoft accounts are stored only in Google Cloud Secret Manager, encrypted and access-controlled, and never in application databases, logs or error reports. They are read only at the moment a draft is created and are deleted when you disconnect.

Access control: Access to production systems and personal data is restricted to authorised Optivian personnel on a need-to-know basis, uses role-based access control and strong authentication, and is logged. Optivian staff do not read the content of your mailbox, and for Gmail we hold no permission that would allow it.

Customer separation: Each Customer’s data is logically separated by tenant identifier and stored in the hosting region (EU or US) chosen for that Customer.

Secure development and operations: Code review, automated testing, dependency and vulnerability scanning, and monitoring of systems for security events and unauthorised access.

Personnel: Staff are bound by confidentiality obligations and receive regular security and data protection training.

Incident response: We maintain an incident response process and notify affected Customers of a personal data breach without undue delay, as required by the GDPR and our Data Processing Agreement.

Retention and deletion: Data is kept only as long as set out in Sections II.3 and III.3. Tokens for connected accounts are deleted immediately when you disconnect, Customer Data is deleted after contract termination, and you can request deletion at any time (Section VIII).

VIII. Your Rights

As a data subject, you have the following rights under the GDPR (depending on the processing context and legal basis):

Right of access: to obtain confirmation as to whether your personal data is processed and to receive a copy (Art. 15 GDPR).

Right to rectification: to correct inaccurate or incomplete personal data (Art. 16 GDPR).

Right to erasure ("right to be forgotten"): to request deletion of personal data under certain conditions (Art. 17 GDPR).

Right to restriction of processing: to request limitation of processing under certain conditions (Art. 18 GDPR).

Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another Controller (Art. 20 GDPR).

Right to object: to processing of personal data, including profiling, where the legal basis is legitimate interest (Art. 21 GDPR).

Right to withdraw consent: if processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR).

We will respond to rights requests without undue delay and at the latest within one month of receipt.

For Customer Data (e.g. CRM records, work emails) processed by Optivian as a Processor, please contact your employer (the Controller).

For User Account, billing or website data processed by Optivian as a Controller, please contact us at info@optivian.ai.

You also have the right to lodge a complaint with your local data protection authority.

IX. Changes to this Policy

We may update this Privacy Policy from time to time. If we make any material changes, we will notify Customers’ designated administrators by email or through the Service. The updated version will always be available at optivian.ai/privacy.

X. Contact

If you have any questions about this Privacy Policy or our handling of your personal data, please reach out.