Owlcumen Privacy Policy
How Owlcumen handles personal and Google user data
Effective and last updated: 3 October 2026.
This policy explains how DangerPretty Co, operating the Owlcumen platform (“Owlcumen”, “we”, “us”), accesses, collects, uses, stores, shares, protects, retains and deletes personal information. It applies when a person visits owlcumen.com, creates or uses an Owlcumen account, uses a business’s public client portal, contacts us, or connects a third-party service.
Owlcumen is designed for Australian businesses. We handle personal information with regard to the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable privacy laws. For questions or requests, contact admin@owlcumen.com.
Information we collect
Depending on the features used, Owlcumen may collect account identity and contact details; authentication records; business profile, services, hours, policies and knowledge; customer enquiries and contacts; bookings, job details, messages and call records; uploaded documents; quotes and invoices; payment status and processor references; subscription and billing status; hardware-order setup choice, delivery name, address and phone number; integration metadata; support and feature requests; AI instructions and outputs; device, usage, security and audit events; and information a user chooses to provide.
We collect information directly from users, from their authorised workspace activity, from public client-portal interactions, from connected services they choose to authorise, and from service providers operating on our behalf. Owlcumen does not receive or store a user’s Google or Microsoft password or full payment-card number. Native iCloud connections use Apple’s app-specific-password process through Nylas; Sign in with Apple alone does not grant iCloud data access. We do not intentionally request sensitive information unless it is necessary for an enabled feature and the customer has a lawful basis to provide it.
Google user data accessed
Continue with Google uses only a production-ready route. When Owlcumen’s production Nylas Google connector is active, one Google approval can verify the account and initialize the authorised Mail, Calendar and Contacts features. If that connector is not available, Owlcumen falls back to basic identity-only sign-in using openid, email and profile information; communications remain disconnected. Owlcumen never exposes a Nylas sandbox flow to customers.
The production Nylas connection requests the consolidated permissions needed for the enabled Mail, Calendar and Contacts features and does not request Google Drive permission. The consent screen identifies the requested access before approval, and Owlcumen keeps the communications connection disabled unless that provider route is explicitly verified for production.
| Google permission | Data and purpose |
|---|---|
| openid | Confirms the Google account identity during sign-in or connection. |
| https://www.googleapis.com/auth/userinfo.email | Reads the account email address so Owlcumen can identify the user and label the connected account. |
| https://www.googleapis.com/auth/userinfo.profile | Reads the account name and basic profile information used for the Owlcumen account. |
| https://www.googleapis.com/auth/gmail.modify | Reads and searches mail, threads, headers, labels, attachments and message content needed for the Inbox, and manages states such as read or unread. It does not permit permanent deletion. |
| https://www.googleapis.com/auth/gmail.compose | Creates drafts and sends or replies to messages, booking updates, invoices and quotes when the user or an authorised workflow requests it. |
| https://www.googleapis.com/auth/calendar | Lists calendars; checks availability; and reads, creates, updates, cancels or responds to events used by Owlcumen. |
| https://www.googleapis.com/auth/contacts | Reads, searches, creates and updates contacts used in the Owlcumen customer record when the user enables synchronization. |
Google Calendar data may include calendar names and event titles, dates, times, locations, descriptions, attendees, organisers and status. Owlcumen uses it to calculate availability, avoid conflicts, associate bookings with contact records, and synchronise events the user has authorised.
Gmail data may include message identifiers, sender and recipient details, subject, timestamp, labels, thread information, attachments, snippets and message content when needed to display or act on an authorised Inbox item. Draft and send access is used to create, send or reply to a message, booking update, invoice or quote when the user or an authorised Owlcumen workflow initiates that action.
The requested permissions are the consolidated set needed for the live Mail, Calendar and Contacts features. gmail.modify supports inbox search, read/unread state, drafts, replies and sending without granting permanent deletion; Calendar access supports availability and event management; and Contacts access supports customer synchronization. Owlcumen does not request Google Drive, Gmail settings, domain administration, add-on or unrelated Google permissions.
How Owlcumen uses personal and Google user data
We use information to authenticate users; provide customer communication, calendar, booking, contact, document, invoicing, payment and workflow features; take payment for, prepare, dispatch and support hardware orders; carry out actions a user authorises; personalise a workspace from its saved business settings; calculate feature usage; secure the service; prevent fraud and abuse; administer subscriptions; provide support; diagnose faults; maintain audit records; comply with law; and improve service reliability and quality.
Google user data is used only to provide or improve the prominent, user-facing Google-connected functions described above. It is not used for unrelated purposes, advertising, retargeting, determining creditworthiness, lending, or building advertising profiles.
Google API Limited Use disclosure
Owlcumen’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Google Workspace APIs are not used to develop, improve, or train generalised or non-personalised AI or machine-learning models. Owlcumen does not sell Google user data. It does not use or transfer Google user data for advertising, retargeting, personalised marketing, data-broker activity or credit assessment. Google user data is not used to train general-purpose AI or machine-learning models, including Owlcumen models. Humans do not read Google user data except where the user has affirmatively agreed to support access for specific data, access is necessary for security or abuse investigation, access is required by law, or the data has been aggregated and de-identified for lawful internal operations.
How Owlcumen shares Google user data and other information
Owlcumen does not sell or rent personal information. We disclose information only to the customer’s authorised workspace users; a third-party integration the customer instructs Owlcumen to use; contracted providers needed to host, secure, communicate, analyse or bill for the service; professional advisers bound by confidentiality; a successor in a corporate transaction where lawful notice and consent requirements are met; or an authority where disclosure is legally required.
| Provider category | Limited purpose |
|---|---|
| Google sign-in, Gmail and Google Calendar functions chosen by the user. | |
| Nylas | Hosted provider authorisation and the synchronized Email, Calendar and Contacts API. Nylas holds provider OAuth credentials; Owlcumen stores an opaque grant identifier and connection health. |
| Cloudflare | Application hosting, private object storage, network security and operational delivery. |
| OpenAI | Requested AI responses or analysis using only the minimum relevant instruction or workspace context. |
| Stripe | Owlcumen subscriptions, hardware orders, billing status and hosted payment processing. |
| Twilio | Calling, text messaging, related delivery status and recordings when those features are enabled. |
| Microsoft | Microsoft account and mailbox functions when separately connected by the user. |
| Apple | Sign in with Apple identity and native iCloud services when the user separately connects iCloud using Apple’s app-specific-password process. |
| Transactional email provider | Delivery of requested service, booking, invoice, support and account messages. |
Each provider receives only the information reasonably required for its role and handles it under contractual or provider terms. Google user data is transferred only when needed to provide a user-requested feature, maintain or secure the service, comply with law, or where the user gives specific permission. A customer may also direct Owlcumen to send information to its own connected provider or recipient.
AI processing
Finance Manager processes uploaded originals and filenames, extracted income and expense details, source links, review corrections, business-use and GST inputs, and potential-deduction estimates. When you upload a record for automatic reading or request AI extraction, necessary contents may be sent to OpenAI for that task. We also store the user, workspace, notice version and time of your Finance Manager acknowledgement. Financial originals linked to entries are protected from ordinary document deletion; this does not prevent a verified account-deletion or privacy request under the procedures below. Keep independent copies required for your business and legal record-keeping obligations.
When an authorised user invokes an AI feature, Owlcumen may send the minimum relevant instruction, business knowledge or workspace record to a contracted AI provider to generate the requested response or analysis. Google user data is not used for generalised AI or machine-learning model training. Workspace content is not authorised for provider model training unless the customer separately and expressly opts in and the provider terms permit it. Users should avoid submitting sensitive information that is not necessary for the requested task.
How Owlcumen stores and protects Google user data
Nylas stores and manages Google, Microsoft and iCloud provider credentials. Owlcumen does not store those raw provider OAuth access or refresh tokens for new Nylas connections. Owlcumen stores an opaque Nylas grant identifier, provider email, approved capability metadata, selected calendars and synchronization health in its tenant-scoped database; API credentials remain server-side and are never exposed to browser code. Owlcumen ordinarily fetches mailbox and calendar data when needed and stores only its own booking, job, synchronized contact, invoice, document and audit records required for workspace operation and accountability.
Existing direct Google Calendar or mail connections may retain encrypted access and refresh tokens on Owlcumen servers to keep the services you authorised synchronized. These tokens are restricted to that workspace and are removed when the direct connection is disconnected or the account is deleted. Nylas-managed connections instead use the grant identifiers described above.
Safeguards include HTTPS in transit, encryption of sensitive credentials at rest, tenant-scoped authorisation, server-side validation, rate limiting, private object storage, audit events, restricted administrative access, provider-secret isolation, upload validation and quarantine, and monitoring for security and service faults. No online service can guarantee absolute security. Customers must protect their accounts, restrict workspace access appropriately and report suspected compromise promptly.
Google user data retention and deletion
Nylas grant identifiers and connection metadata are retained only while the connection is active and are deleted from Owlcumen when the user disconnects the integration or the Owlcumen account is deleted. Disconnection also requests deletion or revocation of the corresponding Nylas grant. Operational workspace records are retained while the account is active or for the customer’s configured operational period. Security, audit, dispute and financial records may be retained for the period reasonably required by law, fraud prevention, security investigation, accounting or dispute resolution.
Following a verified account or Google-data deletion request, relevant personal workspace data is deleted or de-identified within 30 days unless a specific lawful retention requirement applies. Encrypted backups expire under the service’s backup lifecycle and are not restored for ordinary use after deletion. Where we must retain a record, access is restricted and the record is used only for the retention purpose.
Your choices, access and revocation
An authorised workspace user can disconnect a Google, Microsoft or iCloud account from Owlcumen integration settings. A Google user can also revoke Nylas through Google Account third-party connections. Revocation stops future provider access but does not by itself delete independent Owlcumen records the user previously created.
To request access, correction, export, account deletion, or deletion of connected Google data, use the Owlcumen contact form or email admin@owlcumen.com. We verify the requester’s identity before acting and explain any lawful retention exception.
Cookies, international processing and children
Owlcumen uses essential cookies or similar storage for authentication, security, user preferences and checkout continuity. Our public website measures page visits, traffic sources, browser sessions, selected interactions such as page links, previews and signup steps, scroll-depth thresholds, repeated clicks on named page links, browser-error categories, and initial-load performance metrics by broad viewport size using first-party identifiers. We use aggregate observations for automated conversion insights, including AI-assisted recommendations; visitor identifiers, public IPs and account or message content are not supplied to the AI conversion review. Historical interaction, performance and compact page-visit records are retained for trend reporting. Visitor and successful sign-in records may include device category, browser family, public IP address when available, and approximate country, state, city and coordinates supplied by the network edge. IP locations can represent a shared network, carrier or VPN and do not establish a precise physical address. Successful sign-in records use an internal account identifier without storing a session token or password. Live visitor updates operate only while an authorised administrator is viewing Analytics; a minute-spaced checkpoint and page changes preserve history otherwise. Analytics records do not include screen recordings, pointer traces, browser error messages, form entries, customer messages, exact hardware identifiers, or connected Google mail, calendar or contact contents, and Do Not Track and Global Privacy Control browsers are excluded. A checkout attempt may retain its first observed traffic source and campaign for aggregate conversion reporting, without retaining the browser session identifier on the attempt. Signed-in workspaces record feature views and a defined set of control clicks against the account to help us understand adoption and improve the service; we do not collect button text or form contents for these events. These measurements appear in restricted administrative reports. Providers may process information outside Australia; where that occurs, Owlcumen uses contractual and technical safeguards appropriate to the service and applicable law. Owlcumen is a business service and is not directed to children.
Complaints and policy changes
Privacy questions or complaints can be sent to admin@owlcumen.com. We will investigate and respond within a reasonable period. An unresolved Australian privacy complaint may be referred to the Office of the Australian Information Commissioner.
Material changes will be published on this page with a revised effective date and, where appropriate, notified in the product. This policy should be read with Owlcumen’s Terms of Service, Acceptable Use Policy and other legal notices.