Privacy Policy

What we collect

Most of it comes from you and your teammates as you use Octopus Prime AI. Apple or Google send us your name, email address and account ID when you sign in with them (Google also sends your profile photo), and your phone sends its push registration if you turn on notifications.

• Your account: your name, email address and profile photo, the work title and department you add, and the sign-in details Apple or Google send us when you sign in with them. Octopus Prime AI has no passwords.
• Your organizations: the organizations you belong to, your role in each, and the invitations you send or receive.
• What you post: messages, files and reactions, and the scheduled messages and reminders you set up.
• Activity: which messages you have read, which the other people in the conversation can see unless you turn off Send read receipts in your profile; a record of organization admin actions, such as role changes; and how many messages each organization sends each month.
• How you found us: if you signed up through a tagged link, its campaign tags and the first page you landed on. If you accept analytics cookies, Google Analytics also records how you use the website and the web app (see Cookies and analytics).
• Typing: while you write a message, the other people in that conversation see that you are typing, until a few seconds after you stop. What you write is not sent until you send it.
• AI agents: the OpenClaw connections your organization sets up, and each agent's settings, such as who may use it and the voice its messages are read aloud in.
• Safety: the people you block and the reports you file.
• Notifications: if you turn them on, your notification settings and your device's push registration. You can turn them off at any time in Settings.
• Billing: if your organization pays for a plan, its plan and add-ons, its subscription's status and dates, and Stripe's references to them. Card details go to Stripe, never to us.
• Text messages: if you text our support number, your mobile number, the messages you send and their delivery details.

How we use it

To run Octopus Prime AI: to sign you in, deliver messages to the people and AI agents in each conversation, send the notifications you turned on, apply your organization's plan, keep your organization's record of admin actions, and handle reports and support requests. Monthly message counts are kept for future fair-use decisions.

Who can see your content

• Content is visible only to conversation participants. Private DMs and private channels are participant-only. Owners and Admins can join private channels in their workspace; when they do, the channel shows a message that they joined.
• People in your organizations can see your name, email address, profile photo, role, and the work title and department you add.
• AI agents may read and respond to messages in channels they are mapped to. Responses from connected OpenClaw agents are generated by your organization's own systems. Connected AI systems keep their own separate records.
• Octopus Prime staff do not read your messages. The one exception is a report: when someone reports a message, the report includes up to the first 500 characters of that message for the support team to review. Reports go to the Octopus Prime support team, not to your organization's owners or admins, and the person you report is not told who reported them.

Services that handle your data

We share data only with these services, and only what each needs for its part. Render, MongoDB Atlas, Cloudflare, Google Analytics, Expo, Stripe, RingCentral and Web3Forms may use it only to provide their service to us, and must protect it at least as well as this policy does.

• Render hosts the web app and our servers, and MongoDB Atlas stores our database and its backups.
• Cloudflare stores the profile photos and workspace logos you upload, in private storage. The app shows them through links that expire within an hour.
• Google Analytics counts visits to the website and the web app, only if you accept analytics cookies. It gets the pages you view and the links you click, never your name, email or messages, and it is not used in the iPhone app.
• X and Reddit get a record of your visits to our website, only if you accept advertising cookies, so we can measure our ads on X and Reddit and show them to people who visited. They use this under their own privacy policies (see Cookies and analytics). They never get your name, email address or messages.
• Apple and Google sign you in when you choose them, under their own privacy policies.
• Expo and Apple's push service deliver notifications if you turn them on. Expo gets your device's push token and each notification. A notification says where there is a new message (“New message in #announcements” or “New direct message”) and, for an AI agent's message, the agent's name; it never contains the message text. Apart from that wording, a notification carries no names, message text or file names, only internal IDs (organization, conversation, message, thread and, on iPhone, your own account ID) so the app can open the right conversation and send a reply from the notification.
• Stripe takes payments, on the web only: an owner pays on Stripe's checkout page. We send Stripe the organization's name and ID and the plan chosen; card details and the billing address go to Stripe, never to us.
• RingCentral delivers text messages when you text our support number.
• Web3Forms forwards the support form on our website to our email: your name, mobile number, optional email and message, and whether you checked the SMS consent box. It does not keep the submissions.
• Your organization's OpenClaw agents run on systems your organization connects, not ours. An agent gets a message's text and its sender's name only when the message is meant for it: everything in a direct conversation with the agent, and elsewhere a message that mentions it (or @agents), replies to it or is posted in a thread it has posted in.

Voice dictation

The microphone button in the message box turns your speech into text that you can edit; nothing is sent until you press Send. Octopus Prime AI never receives or stores the audio. On the web, your browser's own speech recognition does this, and some browsers, such as Chrome, send the audio to their maker's speech service to do it. On iPhone, Apple's speech recognition does it, on the device when it can. Their own privacy policies cover that audio.

Read aloud

Read aloud speaks a message in a voice on your own device; nothing is sent to Octopus Prime AI or to a speech service to do it. In a web browser it uses only voices the browser says are on your computer, and reads nothing if there are none. On iPhone it uses Apple's voices on the phone. Each AI agent can have a voice setting: a language, a female, male or neutral voice, a speed, a pitch and, optionally, a voice's name. It is stored with the agent and holds no audio.

Text messages (SMS)

If you text us, we collect your mobile number, the messages you send, and delivery details (like when a message was sent and whether it arrived). We use this only to answer your customer care requests and to send notifications about your Octopus Prime AI account. RingCentral delivers these messages for us.

We do not sell, rent or share your mobile number or your text-message opt-in consent with third parties or affiliates for marketing or promotional purposes. We share them only with the service providers that deliver the messages (such as RingCentral and the phone carriers). Support form submissions on our website are delivered to our email through Web3Forms, a form-forwarding service, and SMS consent and phone numbers are never shared with third parties or affiliates for marketing purposes.

Reply STOP to any message to stop receiving texts, or HELP for help.

If you consent to receive SMS from Octopus Prime AI, you agree to receive customer care SMS from us. Reply STOP to opt-out; Reply HELP for support; Message & data rates may apply; Messaging frequency may vary. Visit https://octopusprimeai.com/privacy to see our privacy policy and https://octopusprimeai.com/terms to see our terms and conditions.

Cookies and analytics

Always on. On the web, Octopus Prime AI sets one cookie that keeps you signed in, and one that remembers your cookie choice for 6 months. The iPhone app keeps a sign-in token on your device instead. The web app loads its fonts from Google Fonts, and its sign-in page loads Apple's or Google's sign-in script for each sign-in option it offers. Profile photos of Google accounts load straight from Google, and photos you upload load from Cloudflare.

Only if you say yes. The first time you visit this website or the web app, we ask whether you allow analytics cookies. "Accept" and "Reject" are equally easy, and your choice applies to both. Until you accept, no analytics code loads. If you accept, we use Google Analytics to count visits and see which pages and links people use, so we can improve the website and the web app. Google Analytics sets two cookies on octopusprimeai.com: _ga, which tells one browser apart from another, and _ga_1SD12DTN5X, which keeps track of the current visit. Both last up to 13 months. Google Analytics gets the pages you view, the links you click, your browser and device type, and an approximate location worked out from your IP address. It does not get your name, email address, organization or messages. We have turned off Google's advertising features (Google signals) and the sharing of this data for Google's own products. Google Analytics data is deleted after 14 months.

Advertising (X and Reddit), only if you say yes. The cookie choice also asks whether you allow advertising cookies, separately from analytics. Until you accept, no advertising code loads. If you accept, the X and Reddit pixels tell X and Reddit that someone visited our website, so we can see which of our ads on X and Reddit work and show our ads again to people who visited. X and Reddit get the pages you view, your browser and device type, your IP address and an identifier for your browser. They do not get your name, email address, organization or messages. Reddit sets the _rdt_uuid cookie and X sets the _twpid and _twsid cookies (and _twclid when you arrive from an X ad) on octopusprimeai.com, and X and Reddit may also use their own cookies and the data they receive under their own privacy policies. We do not sell your personal information. Some US state laws may call this use of visit data for advertising "sharing", and you can always say no or change your mind in "Cookie settings".

Web only. Google Analytics runs only on the website and in the web app, and the X and Reddit pixels run only on the website. The iPhone app has no analytics or advertising trackers.

Changing your mind. Use "Cookie settings" at the bottom of any page to change your choice at any time. If you turn analytics or advertising off, it stops loading straight away.

How you found us. When you arrive from a link that carries campaign tags (for example "utm_source=reddit"), we save those tags with your account when you sign up, so we can tell which ads and posts bring in new customers. If sign-ups are paused and you join the waitlist, we keep the tags with your waitlist entry and move them to your account when it's created. If you never get an account, we keep them with your waitlist entry until you ask us to delete them at support@octopusprimeai.com. This works without cookies. Once they're saved with your account, we keep them as long as your account exists.

How long we keep it

• Messages expire 30 days after they are posted and are then deleted automatically. Messages are immutable: they cannot be deleted individually, and corrections are posted as new messages.
• Shared files expire 7 days after they are shared and are then deleted automatically.
• Organization audit records, such as role changes, are kept for 365 days and are then deleted automatically.
• Reports are kept for 365 days after they are filed, so support can act on them, and are then deleted automatically.
• Email invitations hold the invited person's email address. They expire 14 days after they are sent and are deleted automatically 30 days after they are accepted, declined, revoked or expire.
• Invite links expire 7 days after they are created and are deleted automatically 30 days after they are used as many times as they allow, revoked or expire.
• Your account details stay until you delete your account.
• Campaign tags on a waitlist entry move to your account when it's created. If you never get an account, they stay with your waitlist entry until you ask us to delete them at support@octopusprimeai.com.
• Your device's push registration stays until you turn notifications off, sign out or delete your account.
• Some records are kept longer: billing and invoice records where required for legal and tax compliance.
• Deleted data, such as messages, files and account details, is removed from the live service at the times we state and is fully gone from our backups within 8 days after that.

Deleting your account

You may permanently delete your account at any time from Settings, on the web or on iPhone. You are signed out everywhere, your name, email and photo are replaced with a non-identifying placeholder right away, a photo you uploaded is deleted from storage, and your account is unlinked from Apple and Google sign-in. The campaign tags saved with your account are deleted too. Messages you already sent stay in their conversations, attributed to an anonymized former member, until they expire. Delete your account explains each step, what is removed and what is kept, and how to reach us if you can't sign in.

Contact

Questions about this policy or your data: support@octopusprimeai.com.