Privacy policy

1. Introduction

This Privacy Policy describes how Open Curiosity, Inc. ("Open Curiosity," "we," "us," or "our"), a company based in the United States, collects, uses, discloses, and safeguards information in connection with OpenTag, an AI coworker your team adds to its chat that does the work you delegate to it across the apps and accounts you connect, together with our websites and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this Privacy Policy.

Open Curiosity, Inc. is the controller of the personal information described in this policy. Where OpenTag handles content from your connected accounts or your OpenTag environment solely to carry out a task you gave it, we handle that content on your behalf and on your instructions.

We review this policy periodically to keep it accurate, complete, and aligned with how OpenTag actually works. If you have any questions, contact us at privacy@tryopentag.com.

2. How OpenTag runs

We provision and operate a dedicated OpenTag environment for your account. Your OpenTag's context, history, files, and connected-account credentials live in that environment, on infrastructure we manage. It is dedicated to your account, or to your team for a team environment, and isolated from other customers.

Your OpenTag environment is yours. This policy describes what we collect and where data goes.

3. Information we collect

A. Information you provide to us

• Account data. When you sign up for OpenTag, we collect the basic details needed to create and operate your account (your name, email address, and profile picture as provided by your sign-in provider), together with account settings and usage metering, kept in our access-controlled service datastore.
• Communications data. If you contact us by email, through a support channel, or by scheduling a call, we collect the information you include in those communications and use it to respond to you.
• Instructions and content. The tasks you give OpenTag, the files you upload to your OpenTag environment, and the outputs OpenTag produces for you.

B. Connected-app data

When you connect an account (for example, a Google account or a Slack workspace), OpenTag accesses data from that account only with the permissions you grant, app by app and scope by scope, to perform the tasks you ask it to do. Google user data is covered in detail in Sections 5 through 7, and Slack data in Section 8.

C. Credentials and tokens

OAuth tokens and secrets you provide are protected by access controls and used only to authenticate to the services you connected. We never ask you to email or paste long-lived secrets to us.

D. Task and memory data

The instructions you give OpenTag, what it learns from working with you, scheduled tasks you configure, and the results of its work are kept in your OpenTag environment so it can recall context and improve over time.

E. Data about others

Content in your connected accounts and your OpenTag environment may include personal information of third parties, for example the names and email addresses of people you correspond with, or contact details in a document. We process such information solely to provide the Service at your direction, as described in this policy. You are responsible for making sure you may lawfully share such information with OpenTag. Please do not connect accounts or share data you do not have the right to use. Content you connect or upload may also occasionally include sensitive ("special category") information, for example health details in an email. We do not seek out such data, and we process it only because, and to the extent, you direct OpenTag to work with content that contains it.

F. Automatic data collection

• Service and security logs. Operational records such as timestamps, request and response metadata, error logs, and usage metering (for example, how many AI-model tokens your account consumed). These logs are for running, securing, and billing the Service.
• Device and connection data. Standard technical information received when you use the Service over the network, such as IP address, browser type, and operating system.
• Website analytics, advertising measurement, and visitor identification. On our websites (including tryopentag.com), we use measurement, advertising, and visitor-identification tools, currently PostHog and Google Analytics for measurement and Meta Pixel for advertising and conversion measurement, and RB2B for identifying business visitors so we can follow up about OpenTag. Whether these run at all depends on where you are and what you choose: see Section 10 for the exact rules, the cookies involved, and your controls. Where they run, they collect device and connection data, pages viewed, referrers, clicks and other interactions, approximate location derived from IP address, and identifiers stored in cookies or similar technologies. Where they run, PostHog also records a session replay of your visit (the pages as they appeared and your interactions with them), including ordinary form inputs. Passwords, fields identified as containing API keys or other credentials, and recognizable tokens are masked before the recording leaves your browser. Meta may associate website activity and ad-click identifiers with information it already holds to measure and optimize our advertising and create website audiences. Meta Pixel also runs inside the signed-in OpenTag app at app.tryopentag.com, and that is the only place it receives anything about your account. When you create an account, and only while you have given us an explicit, current permission for marketing, we report that signup to Meta together with a one-way hashed form of your email address and your OpenTag account identifier, so that Meta can match the signup to the advertisement that led to it. Your email address is hashed in your browser before it is sent. We do not send Meta your name, your credentials, your workspace contents, or anything you or OpenTag do inside the product beyond the fact that an account was created. We may report the same signup and paid-subscription events to Meta from our servers instead of from your browser, carrying the same identifiers; both routes carry a shared event identifier so that one event is not counted twice. RB2B and its partners may associate website activity with other information they or others hold about you, including a business email address, as described in Section 10. Separately from these vendors, and only while measurement is on, tryopentag.com sets 2 first-party cookies of its own: opentag_visitor_id, a random identifier (400 days) that keys our consent records and connects a signup back to the campaign that first brought you, and opentag_attr (90 days), which stores that first campaign or referrer. Both are readable by us alone and by no vendor. Turning measurement off on the Your Privacy Choices page, or a Global Privacy Control signal, removes them and stops them from being set again.
• Product usage analytics. Inside OpenTag itself, we use PostHog for product usage analytics: interaction signals such as which feature ran, how long it took, and clicks, scrolls, and navigation within OpenTag's interface. Google user data stays out of analytics entirely (Section 6), and no Slack message content, tokens, or user identifiers are sent to analytics (Section 8).

4. How we use information

We use the information described above to:

• Provide and operate the Service. Authenticate you, run your OpenTag environment, execute the tasks you delegate, maintain the integrations you enable, and remember context between sessions.
• Generate responses with AI models. Relevant portions of your data are processed by AI models to produce the responses, drafts, and other outputs you ask for, as described in Section 6.
• Maintain security and integrity. Detect and prevent fraud, abuse, and unauthorized access, and investigate incidents.
• Support and communicate with you. Respond to your requests and send service-related announcements such as security notices and administrative messages. Unless you opt out, we also send occasional product updates and marketing communications (see Section 14).
• Improve the Service. Understand reliability and usage patterns using service logs and masked, aggregated, or de-identified signals that cannot reasonably identify you.
• Comply and protect. Comply with applicable law and lawful requests, enforce our terms, and protect the rights, safety, and property of our users and Open Curiosity.

We do not sell your personal information for money, and we do not use Google user data, Slack data, or the contents of your OpenTag environment to serve advertisements. On our websites, for the consent-controlled tools described in Section 10, where you are in a region that permits it or you have consented, we use the analytics, advertising-measurement, and visitor-identification tools described in Sections 3 and 10 to understand site usage, measure and optimize our advertising, and identify business visitors for our own outreach about OpenTag. Where we rely on aggregated or de-identified data, we maintain and use it only in that form and do not attempt to re-identify it, except as permitted by law to confirm that our de-identification measures work. Our use of Google user data is further limited by Sections 5 through 7, which control over anything else in this policy.

Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your personal information under the following legal bases of the GDPR and UK GDPR:

• Performance of a contract. To create and operate your account, run your OpenTag environment, execute the tasks you delegate, provide support, and send essential service communications.
• Consent. To connect your Google account and process Google user data through the scopes you approve on Google's consent screen; to send you marketing or product-update email; and to use non-essential analytics and visitor-identification cookies on our websites where the law requires consent (in those regions, these tools do not load until you accept). You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal: for Google data, by revoking OpenTag's access in your Google Account settings; for marketing email, by unsubscribing; for website cookies, on our privacy choices page.
• Legitimate interests. To keep the Service secure and prevent fraud and abuse; to understand reliability and improve the Service using aggregated or de-identified signals; to enforce our agreements and defend legal claims; and to carry out corporate transactions. Where we rely on legitimate interests, we balance them against your rights, and you may object as described in Section 14.
• Legal obligation. To comply with applicable law, respond to valid legal process, and keep records the law requires us to keep, such as tax and accounting records.

5. How OpenTag accesses and uses Google user data

If you connect a Google account, OpenTag requests access to Google Workspace services through OAuth scopes that you explicitly approve on Google's consent screen: Gmail, Google Calendar, Google Drive (including Google Docs, Sheets, and Forms), and Google Meet. Depending on the scopes you approve, this data may include: email message content (body text, subject lines, and attachments), sender and recipient information, and other email metadata; calendar events and calendar settings; the contents and metadata of your Drive files and documents; meeting spaces, conference details, and settings associated with Google Meet; and basic account information (your name, email address, and profile picture), used to identify which account you connected and to sign you in.

OpenTag uses this access solely to provide and improve user-facing features you invoke inside OpenTag: as you direct it, OpenTag reads, searches, creates, edits, organizes, sends, shares, and deletes content in these services on your behalf, for example summarizing an email thread, scheduling a meeting, or editing a document you describe. OpenTag accesses this data only in service of a task you gave it, whether a one-off request or a recurring task you configured, like watching your inbox. Access is granted scope by scope, and you can revoke it at any time from your Google Account settings.

6. With whom we share, transfer, or disclose Google user data

We do not sell Google user data, or any of your personal information, to anyone. Google user data is shared, transferred, or disclosed only in the following circumstances, and in each case only the minimum data needed:

• AI model providers. OpenTag generates its responses with large language models. When you give OpenTag a task that involves your Google data (say, summarizing an email or editing a document in Drive), the portions of that data needed for the task are included in the request sent to the AI model provider so it can produce OpenTag's response. That provider is Microsoft Azure (Azure OpenAI Service), a Microsoft product; no data goes to OpenAI's consumer API. It processes the data only to return the response, is prohibited from using it to train AI models, and retains it for a limited period, if at all, for abuse monitoring under its API terms. The current list of sub-processors is published in our Trust Center.
• Infrastructure service providers. OpenTag runs on infrastructure operated by a third-party hosting provider acting on our behalf. That provider stores and transmits data solely to host your environment, is bound by confidentiality and data-protection obligations, and is not permitted to use your data for any purpose of its own.
• Recipients you direct. When you instruct OpenTag to send data somewhere (share a Drive file with a teammate, email a document, post a summary to another app you connected), OpenTag transfers that data as your agent, at your explicit direction, to the destination you chose. If you set up a shared team environment, accounts and data you connect to it are usable by your team's members.
• Security and legal. We may disclose data where necessary for security purposes (for example, investigating abuse) or to comply with applicable law or valid legal process.
• Change of ownership. If Open Curiosity is involved in a merger, acquisition, or sale of assets, Google user data would be transferred only after obtaining your explicit prior consent.

And to be explicit about who does not receive your Google user data:

• No advertising platforms, ad networks, data brokers, or information resellers. OpenTag integrates with none of these.
• No Google user data in analytics. Where product usage analytics runs (see Section 3), an analytics service receives interaction signals only, never message bodies, file contents, calendar details, or any other Google user data. Website analytics on tryopentag.com is separate and does not receive Google user data from a connected Google account.
• No AI training pipelines. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models, and our model provider is contractually prohibited from doing the same with data we send it.

7. Limited Use of Google user data

OpenTag's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve user-facing features that are prominent in OpenTag's interface.
• We do not transfer Google user data to third parties except as described in Section 6: to provide or improve those user-facing features with your consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
• We do not sell Google user data, and we do not use or transfer it for serving advertisements (including retargeting, personalized, or interest-based advertising), or to determine credit-worthiness or for lending purposes.
• We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.
• We do not allow humans to read your Google user data, except: with your affirmative agreement for specific messages or files; where necessary for security purposes (such as investigating abuse); to comply with applicable law; or where the data has been aggregated and anonymized for internal operations.

8. How OpenTag accesses and uses Slack data

If you add OpenTag to a Slack workspace, OpenTag connects through Slack's OAuth consent flow as a bot, and its access is limited to the permissions granted when it is installed:

• Messages. Depending on the permissions granted when OpenTag is installed, OpenTag can read direct messages sent to it, messages in public channels, and messages in channels it has been added to. It posts its replies back to the conversation and adds emoji reactions to acknowledge requests. OpenTag uses this content to understand and carry out your team's requests and to maintain conversation context.
• Workspace and member information. The workspace's ID and name, OpenTag's own bot user ID, and member identifiers: Slack user IDs and, depending on the permissions granted, member profile details such as names and email addresses. We use these to route each member's messages to the right OpenTag environment, to set up or link OpenTag accounts for workspace members, and to personalize what OpenTag knows about your team.
• Connection credentials. The bot token Slack issues when OpenTag is installed is kept under access controls and used only to operate the integration.

Messages you send OpenTag in Slack are instructions like any other: they are used to generate OpenTag's response (see Section 6), answered in the same conversation, and kept in your OpenTag environment's history like any other conversation with OpenTag. Workspace and member information used to operate the integration and set up accounts is kept under access controls. Installing OpenTag in a workspace sets up a team environment; each member who connects OpenTag gets their own connection, and direct messages with OpenTag are handled in that member's own environment.

Our commitments for Slack data are the same as above:

• We use Slack data only to provide and operate OpenTag. We do not sell it, and we do not use or transfer it for advertising.
• We affirm that Slack APIs and Slack data are not used to develop, improve, or train generalized AI or machine-learning models.
• No Slack message content, tokens, or user identifiers are sent to analytics.

Your use of Slack itself is subject to Slack's own terms and privacy policy. You can remove OpenTag from a workspace at any time through Slack's app management. When OpenTag is uninstalled or its token is revoked, the connection stops and we delete the stored bot token. Conversations already in your OpenTag environment remain yours, handled as described in Section 13.

9. How we share other information

Beyond Google user data (covered exclusively by Section 6), we share other personal information only with:

• Service providers. Vendors that host and operate the Service on our behalf, bound by contracts that limit their use of your data to providing services to us. These include our hosting and AI infrastructure on Microsoft Azure, model and run observability (which may receive prompts, tool arguments and results, and related run payloads needed to operate and debug the Service), and an analytics provider that receives the product interaction signals described in Section 3. The current list is in our Trust Center. Our Data Processing Addendum covers processing of Customer Content on your behalf.
• Website analytics, advertising, and visitor-identification vendors. On our websites, and only in the consent states Section 10 describes, we use PostHog and Google Analytics for measurement, Meta Pixel for advertising and conversion measurement, and RB2B for business-visitor identification. Meta Pixel also runs inside the signed-in app, under the stricter rule Section 10 sets out. These vendors process the website data described in Section 3 under their own terms and privacy policies, on our instructions or as independent controllers of the identifiers they maintain. See Section 10 for the cookies involved and our privacy choices page for your controls.
• Professional advisors. Lawyers, auditors, and insurers, where necessary in the course of the professional services they render to us.
• Authorities. Law enforcement or government authorities where we believe in good faith that disclosure is required by law or necessary to protect rights, safety, or the integrity of the Service.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be disclosed to the parties and advisors involved, subject to confidentiality protections and, for Google user data, only as described in Section 6.
• Parties you direct. Anyone you instruct OpenTag or us to share information with.

We do not sell personal information for money, and we do not share Google user data, Slack data, or Customer Content with advertising networks, data brokers, or information resellers. Separately, where the marketing category is on, Meta receives the website activity described in Section 10 for ad measurement and optimization, and RB2B may associate a site visit with business contact information so we can send our own outreach about OpenTag. Meta additionally receives, from the signed-in app and only under an explicit current permission, the fact that you created an account or started a paid subscription, together with a hashed email address and your account identifier, as described in Sections 3 and 10. Neither vendor receives Customer Content, your workspace data, your connected-app data, or anything OpenTag does on your behalf, and you can switch both off.

10. Cookies and similar technologies

Signed-in parts of the Service use cookies that are necessary for it to function, for example to keep you signed in to your OpenTag environment, product usage analytics as described in Section 3, and one advertising tool, Meta Pixel, under the stricter rule set out below. On our websites, Google Analytics, PostHog, Meta Pixel, and RB2B run under a consent system, and what happens depends on where you are. The rules below apply to those consent-controlled tools.

We also use Plausible to measure website traffic, including pages viewed, referral sources, and browser and device types. Plausible does not use cookies or local storage. It derives a daily visitor identifier on its servers without storing raw IP addresses or User-Agent strings. This cookieless measurement runs independently of the Measurement switch and Global Privacy Control, alongside Vercel Web Analytics and Speed Insights. See Plausible's data policy for details. In the tables below, plausible.io appears in the always-on category because it is contacted in every consent state.

• Where the law requires consent first (the EEA, UK and every other region outside the United States), no analytics, advertising-measurement, or visitor-identification tool loads, and no optional cookie is set, until you accept. Declining is one click, and the site works identically either way.
• In the United States, measurement, advertising tags, and visitor identification run by default, with notice, and you can switch them off at any time on our privacy choices page. Opting out also clears the identifier cookies these tools set on our domain.
• Global Privacy Control. We honor the GPC signal as a valid opt-out: a browser that sends it gets analytics, advertising tags, and visitor identification switched off automatically, in every region, and we record having done so.
• Inside the signed-in app (app.tryopentag.com), the only advertising tool is Meta Pixel, and it follows a stricter rule than our websites do. (Product usage analytics inside the app is a separate matter, described in Section 3.) The app never asks you for a decision and never records one. It reads the decision you made on tryopentag.com and treats anything short of an explicit, current permission as a refusal: no decision, a decision made under an older version of this policy, or Global Privacy Control all mean nothing loads. The United States default described above does not apply there, so if you have not affirmatively said yes, no advertising tool runs inside the app at all.

The tables below are generated from the same declaration our consent system enforces in the browser, and an automated check drives a real browser through these states against this site to verify the declaration holds, so this section cannot silently drift from what the site actually does. Where Meta Pixel runs, it sends Meta page URLs, browser and device details, IP address, and its first-party browser and ad-click identifiers (_fbp and _fbc) to attribute conversions, measure and optimize our ads, and create website audiences. Meta may associate those signals with information it already holds. Inside the signed-in app it additionally sends a one-way hashed email address and your OpenTag account identifier alongside the signup and paid-subscription events described in Section 3. When you visit our websites, RB2B and its partners may use cookies and similar technologies to associate your visit with other information they or others hold about you, including a business email address, and we may then send our own communications to that address. You can opt out of that advertising through Retention.com's opt-out, opt out of collection under the GDPR through RB2B's opt-out, or simply switch marketing off on our privacy choices page, which stops it on this site regardless of the vendor-side settings. California law requires us to say how we respond to browser "Do Not Track" signals: there is no consistent industry standard for DNT, and the Service does not respond to it; we honor Global Privacy Control instead, as described above. Most browsers also let you remove or reject cookies; if you disable necessary cookies, signed-in parts of the Service may not work.

11. When data leaves your environment

Some features, most notably generating a response with an AI model, send task data outside your OpenTag environment to the parties described in Section 6 (for Google user data) and Section 9 (for other information).

12. How your data is stored and protected

Any Google user data OpenTag works with is kept in an environment dedicated to your account, and the Google OAuth credential needed to maintain your connection is stored in our access-controlled service datastore. No other customer can access your environment; if you set up a shared team environment, it is shared with your team's members. Data is encrypted in transit over public networks, operational access is restricted to what is needed to run the service, and human access to your Google user data is governed by the Limited Use rules in Section 7.

OpenTag keeps a record of the actions it takes, and you can configure it to require your explicit approval before it acts. No internet service is perfectly secure, but OpenTag is designed to keep as little of your data as possible in shared, centralized stores.

13. Data retention

• Your OpenTag environment. Your environment and its data persist while your account is active, so OpenTag can keep its context and continue your recurring tasks. When your account is closed or you make a verified deletion request, we delete your environment and its data, including stored Google OAuth tokens and any Google user data, from active systems, typically within 30 days; copies in backups are deleted as those backups expire.
• Service records. We retain account records and service logs only as long as needed to operate the Service, meet legal and accounting obligations, resolve disputes, and enforce agreements. Retention depends on the data, its purpose, and legal requirements; tax and accounting laws may require us to keep billing records for several years.

14. Your rights and choices

Access, correction, deletion, and portability

Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccuracies, request deletion, receive a machine-readable copy, or object to or restrict certain processing. You can exercise these rights by emailing privacy@tryopentag.com. We may need to verify your identity before acting on a request. You may also use an authorized agent to submit a request on your behalf by having the agent write to the same address; we will ask the agent for written proof of their authority and may verify your identity directly with you. We will respond within the timeframe required by applicable law, and we will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying with "Privacy Appeal" in the subject line, and you may lodge a complaint with your state Attorney General or, outside the United States, your local data protection authority.

Opt-out rights

Depending on your state, you may also have the right to opt out of the sale of personal information, of its processing for targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects, and, in California, to limit the use of sensitive personal information. We do not sell personal information for money, and we do not use Google user data, Slack data, or Customer Content for targeted advertising or such profiling. Our websites do use Meta Pixel for ad measurement, optimization, and website audiences, and RB2B may associate your visit with a business email for our own outreach. If your state's law treats either use as targeted advertising, a "sale," or a "share," the opt-out is our privacy choices page, one click, no account needed, and a browser that sends Global Privacy Control is opted out automatically. You can additionally use the vendor-side opt-outs from Retention.com and RB2B, or email privacy@tryopentag.com. We do not use or disclose sensitive personal information for purposes other than providing the Service you request and as applicable law permits, so there is nothing to limit.

Additional rights for EEA and UK users

If you are in the European Economic Area or the United Kingdom, you have the following rights under the GDPR or UK GDPR, which you can exercise by emailing privacy@tryopentag.com: to access your personal data; to have inaccurate data rectified; to erasure; to restriction of processing; to data portability; to object to processing we base on legitimate interests; and to object at any time to direct marketing, in which case we will stop. Where processing is based on your consent, such as your Google account connection, marketing email, or non-essential website cookies (withdraw on our privacy choices page), you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with a supervisory authority: in the EEA, the authority of the member state where you live, work, or where the issue occurred; in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first, but you may contact them at any time.

Revoking OpenTag's access to your Google account

You can revoke OpenTag's access to a connected account at any time. For Google accounts, use your Google Account connections page, which immediately cuts off OpenTag's ability to access your Google data going forward. Revocation does not by itself delete data already in your OpenTag environment; you can delete that data through OpenTag, or request deletion of your environment as described in Section 13.

Automated decision-making

OpenTag acts on your instructions: it performs the tasks you delegate. We do not use your personal information to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 of the GDPR and UK GDPR. If that ever changes, we will update this policy and provide the information and choices the law requires.

Communications

If you receive marketing or product-update email from us, you can opt out at any time via the unsubscribe link or by contacting us. You will still receive essential service communications, such as security notices.

15. International data transfers

We are based in the United States, and OpenTag environments are operated on infrastructure in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where applicable law requires safeguards for such transfers, we rely on appropriate mechanisms such as standard contractual clauses.

16. Children's privacy

OpenTag is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us at privacy@tryopentag.com and we will delete it.

17. Changes to this policy

We may update this policy as OpenTag evolves. When we do, we will revise the "Last updated" date above, and for material changes we will provide additional notice as required by law. If we change how OpenTag uses Google user data, we will update this policy and prompt you to consent before using your Google user data in a new way.

18. Contact us

Questions about this policy or your data? Email privacy@tryopentag.com.