Privacy Policy

Octo6 is an Agent Operating System that lets people and organizations create AI agents, organize human-agent teams, manage work, connect external tools, and automate user-directed activities. This Privacy Policy explains how Octo6 ("Octo6," "we," "us," or "our") processes personal information when you use octo6.com and the related Octo6 applications, APIs, and services (the "Services").

For privacy questions or requests, contact us at support@octo6.com.

Octo6 lets a user connect a Google Account directly to a selected AI agent. The connection is not shared with other agents. The current Google Drive integration is read-only: it can search files, list recent files, inspect file metadata and permissions, and retrieve or download file content that the connected Google Account is permitted to access. Octo6 does not enable the Google Drive MCP tools that create or copy files.

How we use Google user data. We access Google Drive data only when needed to provide a feature the user requests, such as finding, reading, or summarizing a file for that agent's work. We do not use Google user data for advertising, sell it, or use it to build, train, or improve generalized or non-personalized AI or machine learning models.

Storage. OAuth access and refresh tokens are encrypted at rest. Octo6 stores the connection status, granted scopes, and MCP tool metadata needed to operate the connection. Retrieved Drive data is not imported into permanent workspace knowledge by default. It may appear in a conversation, agent output, task, or workspace file when necessary to complete the user's request or when the user directs Octo6 to save that result.

Sharing. To perform a requested AI task, the minimum relevant Google Drive content may be transmitted to the AI model provider selected by the user, agent configuration, or workspace administrator. It may also be processed by infrastructure providers that host or secure the Services. These transfers are made only to provide or protect the requested functionality and are subject to contractual and access controls. Human access is limited to authorized support, security, or legal needs.

User control and deletion. A user can disconnect Google Drive from the agent at any time. Disconnecting removes the stored OAuth connection and tokens from Octo6 and prevents future Drive requests. A user can also revoke Octo6 in their Google Account permissions. Content already placed into a conversation or workspace remains subject to the workspace's retention and deletion controls; users may delete that content where the Services provide deletion or contact us for a privacy request.

Octo6's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Account information such as name, email, profile image, language, authentication status, and workspace membership.
• Prompts, messages, agent responses, comments, feedback, conversation metadata, and files or media you submit.
• Workspace knowledge, company context, projects, tasks, approvals, memories, skills, plans, and agent configuration.
• Integration configuration, encrypted credentials or secret references, scopes, tool metadata, connection status, and errors.
• Subscription, billing, Octo Credit, model and token usage, request timing, security, device, and diagnostic information.
• Information you provide when requesting support or joining an early-access waitlist.

• Provide, administer, secure, and troubleshoot accounts and workspaces.
• Generate AI responses and operate memory, knowledge retrieval, files, skills, and agent collaboration.
• Carry out user-directed work through approved tools, APIs, MCP servers, channels, and remote environments.
• Operate objectives, projects, tasks, approvals, reminders, notifications, subscriptions, metering, and support.
• Detect abuse, protect users, maintain reliability, and comply with legal obligations.
• Improve the Services using operational and diagnostic information that is appropriately governed.

Octo6 sends information needed for a request to the selected AI model provider. Depending on the request, this may include agent instructions, recent messages, selected memory, knowledge excerpts, work context, files, images, tool schemas, and authorized tool results. Available providers depend on workspace configuration and routing.

Third-party services you choose to connect are also governed by their own terms and privacy policies. You control which services are connected and must have authority to provide the data and credentials involved. AI output may be inaccurate, so users should review important results and proposed actions.

We may disclose information to authorized workspace members; AI model providers; hosting, database, storage, email, payment, monitoring, security, and support providers; connected services the user invokes; professional advisers; a successor in a corporate transaction; or authorities when required by law.

We do not sell personal information and do not share it for cross-context behavioral advertising. Service providers may process information only to perform services for Octo6 or as otherwise disclosed to the user.

Workspace owners and administrators control membership, agent access, integrations, tools, permissions, budgets, and available retention settings. Information in a shared workspace may be visible to authorized members, collaborators, administrators, and agents.

For customer-controlled workspace content, the customer generally determines the purposes and means of processing, and Octo6 acts as its processor or service provider. Customers are responsible for their instructions, permissions, notices, and lawful basis for processing.

Octo6 uses tenant-scoped authorization, role and ownership checks, encrypted transport, password hashing, encryption for supported integration credentials, secret references, rate limits, restricted media access, audit records, and controls for outbound tools and remote execution.

No system is completely secure. Users should use strong authentication, grant the minimum necessary permissions, review agent actions, rotate credentials when appropriate, and report suspected misuse promptly.

We retain information while an account or workspace is active and as needed to provide the Services, follow workspace instructions, secure the Services, comply with law, resolve disputes, and enforce agreements. Conversation retention can vary by subscription plan. Agent execution records are generally retained for up to 30 days; certain security, billing, and audit records may be retained longer when reasonably necessary.

Deleting an item or disconnecting a service removes it from active use. Residual copies may remain temporarily in restricted backups, security records, or legally required records before being deleted or de-identified under our retention process. To request account or personal-data deletion, contact support@octo6.com.

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, receive a portable copy, withdraw consent, or complain to a regulator. You can manage many settings in the Services, disconnect integrations, and revoke third-party permissions. Contact support@octo6.com for another request. We may verify your identity and authority before responding.

Octo6 and its service providers may process information in countries other than your own. Where required, we rely on recognized safeguards for international transfers.

The Services are not directed to children under 16, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information contrary to this Policy.

We may update this Policy as the Services or legal requirements change. We will publish the revised version and update its effective date. Material changes may receive additional notice where required.

Privacy questions, requests, and complaints can be sent to support@octo6.com. If you are entitled to complain to a data-protection authority, you may also contact the authority in your location.